Government submissions
Official documents I submitted to Australian Government bodies to help improve national cyber security.
Government can hit every participation target for a cyber program and still not know whether the country is safer. The real test is not how many businesses enrolled or graduated, but whether specific protections were implemented and whether risk or losses fell.
A cyber strategy should not be judged by how comprehensive it looks to government; it should be judged by whether it changes attacker decisions. If an adversary can read the plan and see few measurable consequences, the strategy may create activity without changing the economics of attack.
Professionalising cyber will not fix weak practice if the scheme itself cannot survive scrutiny, win broad support, and resist capture by vested interests. Done too early, it risks turning a real trust problem into another credential market that looks official without proving competence.