Government submissions
Official documents I submitted to Australian Government bodies to help improve national cyber security.
CyberPath can define occupations, skills and experience well and still produce the wrong system behaviour once its standards acquire economic value. Before a pilot, its major mechanisms should be stress-tested for incentives, gaming and emergent effects so genuine capability remains more rewarding than the appearance of capability.
Government can deliver every initiative in the National Cyber Security Strategy and still be unable to show that Australia is safer. Reporting should connect each initiative to a priority national cyber risk, identify who owns that risk, and provide evidence that the risk is moving toward an agreed tolerance.
Government can hit every participation target for a cyber program and still not know whether the country is safer. The real test is not how many businesses enrolled or graduated, but whether specific protections were implemented and whether risk or losses fell.
A cyber strategy should not be judged by how comprehensive it looks to government; it should be judged by whether it changes attacker decisions. If an adversary can read the plan and see few measurable consequences, the strategy may create activity without changing the economics of attack.
Professionalising cyber will not fix weak practice if the scheme itself cannot survive scrutiny, win broad support, and resist capture by vested interests. Done too early, it risks turning a real trust problem into another credential market that looks official without proving competence.