The 2026 Threat Landscape, Iran, and AI-Powered Phishing with Michael Kosak

The 2026 Threat Landscape, Iran, and AI-Powered Phishing with Michael Kosak

Mike Kosak joins Cyber Voices to deliver a frank assessment of the 2026 cyber threat environment: it's not great, and it's getting worse. Mike is Director of Threat Intelligence at LastPass, with nearly 25 years of experience that began in the US Department of Defense as a counterterrorism intelligence officer. He served three deployments to Iraq supporting Operation Iraqi Freedom, led the Pentagon office responsible for intelligence updates to the Chairman of the Joint Chiefs of Staff, and acted as senior command representative to Joint Special Operations Command for the Defence Intelligence Agency. Since moving into the private sector he has led strategic cyber intelligence at Bank of America, headed the Cyber Threat Intelligence team at TIAA, and now drives threat intelligence at LastPass. In this conversation Mike and David unpack what the ongoing conflict in the Middle East means for Australian defenders, why Five Eyes membership puts Australia squarely in scope regardless of physical proximity, and how Iran targets opportunistically and then retrofits the rationale to fit. They look at China and Taiwan as a potential 2027 flashpoint, with critical infrastructure, education, and the defence industrial base already in frequent crosshairs. The conversation then shifts to phishing, where AI has lowered the barrier to entry and lifted operational tempo dramatically. Mike shares what his team has been observing as a single threat actor group develops its own AI-assisted phishing kit across three increasingly sophisticated versions, evolving from a basic login page to an attacker-in-the-middle reverse proxy. The episode closes with practical guidance for the Australian cyber community: the Essential Eight still gets you 80% of the way there, and getting a real handle on your tech stack, including shadow AI and shadow tech, will pay enormous dividends as the gap between vulnerability detection and exploitation continues to shrink.  Subscribe to Cyber Voices wherever you get your podcasts, and find us on YouTube for the video version.

Responding to a Cyber Crisis You Don’t Control with Darren Hopkins

In this episode of Cyber Voices, recorded live at BrisSEC 2026, host David Savva-Willett speaks with Darren Hopkins, Partner at McGrathNicol and a Brisbane-based cybersecurity professional with more than 30 years’ experience across law enforcement, digital forensics, incident response and cyber crisis management. Darren shares insights from his BrisSEC talk, “When You’re Already Losing: Responding to a Cyber Crisis You Don’t Control,” exploring the messy reality of cyber incidents where the playbook does not match the crisis. From third-party suppliers and SaaS dependencies to ransomware negotiations, regulators, media pressure, board expectations and limited information, Darren explains why effective incident response requires more than a neatly documented plan. David and Darren discuss why cyber crisis simulations matter, how organisations can build decision-making muscle memory, the importance of update cadence, the risks of over-communication, and why many incidents remain preventable through basic cyber hygiene, prioritisation and executive support. This episode is essential listening for CISOs, security leaders, board members, risk teams, communications professionals and anyone involved in preparing for or responding to a cyber incident. In this episode, we cover: * How to respond when you do not control the cyber crisis * Why incident response plans still matter, even when reality gets chaotic * The role of executives, legal, communications, HR and technical teams during a breach * Why third-party and SaaS risk changes crisis response * How cyber simulations can prepare boards and leadership teams * The importance of clear communication and update cadence * Why are many cyber incidents still preventable * What cyber leaders should start doing differently today

Inside the Mind of an Attacker — Atticus D'mello on Bypassing Social Media's Security Controls

Recorded live on the floor at BrisSEC 2026 in Brisbane, David Savva-Willett sits down with Atticus D'mello, higher degree research student, vulnerability researcher, and emerging cybersecurity specialist with Safety Net Cyber, to unpack his BrisSEC talk Inside the Mind of an Attacker. Atticus walks us through how he and his team approached one of the most under-discussed problems in consumer cybersecurity: how attackers bypass account creation limits on the world's biggest social media platforms to spin up anonymous accounts at scale. Working with nothing more than a laptop and a typical home internet connection, they mapped the controls, found the gaps, and responsibly disclosed the vulnerabilities, many of which have now been fully patched. The conversation goes beyond the technical, exploring why burner accounts are the gateway to online bullying, mass phishing, artificial engagement, and large-scale scams, and the very real human toll that follows. Atticus also shares his work helping victims regain access to compromised Instagram and Facebook accounts, the rise of fake "Meta verification" phishing emails, why TikTok's security-by-default model is worth paying attention to, and what every one of us can do to make social media a safer space. If you've ever wondered how those random accounts in your DMs come from nowhere — this one's for you.

Quantum Safe Queensland: A Practical Roadmap with Prof. Craig Costello

Q-Day is coming — and the encryption protecting your most sensitive data may already be on borrowed time. In this episode of Cyber Voices, host David Savva-Willett sits down at AISA's BrisSec 2026 with Professor Craig Costello, cryptographer at the Queensland University of Technology and one of the global researchers shaping post-quantum cryptography (PQC) standards. Craig demystifies what post-quantum cryptography actually is, why "harvest now, decrypt later" attacks mean the threat is already here, and what recent breakthroughs from Google AI, UC Berkeley and Caltech mean for the timeline. He unpacks Google's bold 2029 Q-Day prediction, explains why PQC runs on the classical hardware you already own, and walks through a pragmatic transition roadmap aligned to the Australian Signals Directorate's guidance — from naming a transition lead and running an inventory scan, to prioritising key exchange over digital signatures, and managing vendor migrations. Whether you're a CISO, security architect, or just trying to understand what quantum computing really means for your organisation, this is a clear-eyed, panic-free conversation about preparing for the biggest cryptographic shift in 50 years. Topics covered: • What post-quantum cryptography is (and isn't) • Harvest now, decrypt later attacks explained • Why Google says Q-Day arrives by 2029 • Recent algorithmic breakthroughs lowering qubit requirements • A practical PQC transition plan: 90 days and beyond • ASD guidance and the road to 2030 • Crypto agility as a long-term security discipline Cyber Voices is the official podcast of the Australian Information Security Association (AISA). Planning for Post-Quantum Cryptography (the page Craig referenced directly) The ASD's practical framework covering inventory scans, transition timelines, and milestones — including the recommended deadline of end of 2030 to cease use of traditional asymmetric cryptography. 🔗 https://www.cyber.gov.au/business-government/secure-design/planning-for-post-quantum-cryptography [https://www.cyber.gov.au/business-government/secure-design/planning-for-post-quantum-cryptography] Information Security Manual (ISM) — landing page The full ISM, intended for CISOs, CIOs, and cyber security professionals. 🔗 https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism [https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism] ISM — Guidelines for Cryptography The chapter that contains the specific PQC controls Craig mentioned, including ISM-2073 (PQC transition plan requirement) and the list of ASD-approved post-quantum algorithms. 🔗 https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-cryptography [https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-cryptography]  Professor Craig Costello — QUT profile For listeners who want to take Craig up on his offer to engage directly with industry partners. 🔗 https://www.qut.edu.au/about/our-people/academic-profiles/craig.costello [https://www.qut.edu.au/about/our-people/academic-profiles/craig.costello]

Inside the Dark Web Economy: Anastasia Tikhonova on 2026's Top Cyber Threats

The Problem of Trust: Identity Fraud, Deepfakes & APAC Threat Trends with Anastasia Tikhonova What happens when cybercriminals stop attacking your CEO and start targeting your developers instead? In this episode of Cyber Voices, host David Savva-Willett sits down with Anastasia Tikhonova, Global Threat Research Lead at Group-IB, joining live from Phuket, Thailand, to unpack the threat trends defining 2026 — and why Australia remains squarely in the crosshairs. Anastasia shares how her team connects threat intelligence dots across APAC, EMEA, and Latin America, and explains why she calls 2026 the year of "the problem of trust" — where attackers no longer need just your email and password. They want your voice, your face, your LinkedIn, and your professional connections to impersonate you convincingly enough to compromise the organisations you work with. In this episode, you'll hear about: * The rise of identity fraud, deepfakes, and AI-powered social engineering * Why Scattered Spider, Lazarus Group and others are shifting from mass campaigns to highly targeted persona attacks * The Axios NPM supply chain compromise (80 million weekly downloads) and what it means for every organisation * How dark web marketplaces, arbitration "courts," and Telegram-based criminal communities operate today * Why Australia is the #2 ransomware target in APAC — and the lessons from the April 2025 super fund attacks * The role of hacktivism, geopolitical conflict, and national state actors in Australian threat activity * Practical advice on managing your digital footprint when you, your family, or your executives have a public profile Whether you're a CISO, security analyst, developer, or simply curious about how cybercrime is evolving, this conversation delivers global perspective with sharp Australian relevance. Cyber Voices is the official podcast of the Australian Information Security Association (AISA) — bringing you the voices shaping cybersecurity in Australia and beyond. 🎧 Subscribe wherever you get your podcasts and follow AISA for more.