Compliance Overload Draining Australian Security Teams As Cybercriminals Accelerate Attacks

Australian organisations are contending with one of the most complex regulatory cybersecurity environments in the world, while the adversaries they defend against operate without constraint, compliance obligations or speed limits.

That is the assessment from Fortinet, which argues the growing asymmetry between defenders weighed down by overlapping compliance requirements and attackers moving at machine speed is creating systemic risk.

The regulatory landscape

Australian security teams must navigate an expanding web of cybersecurity and privacy requirements. These include the Security of Critical Infrastructure (SOCI) Act, the Notifiable Data Breaches Scheme, APRA CPS 234, the Privacy Act 1988, the Cyber Security Act 2024 and the Australian Signals Directorate (ASD) Essential Eight.

Glenn Maiden, Chief Security Officer and Director of Threat Intelligence for Australia and New Zealand at Fortinet, acknowledged the importance of these frameworks but pointed to the cumulative toll they take.

“These frameworks are critical for strengthening national resilience. However, the cumulative compliance burden consumes time, budget and skilled resources that could otherwise be directed toward proactive threat defence,” Maiden explained.

Attackers moving at machine speed

Fortinet’s 2025 Global Threat Landscape Report underlines the scale of the challenge. In 2024 alone, active scanning activity surged 16.7 per cent globally, reaching 36,000 scans per second. More than 97 billion exploitation attempts were recorded across industries. Compromised credentials for sale on the darknet increased by 42 per cent year-on-year, and infostealer malware logs shared in underground forums grew by 500 per cent.

“Cybercriminals automate reconnaissance, compress the time between vulnerability disclosure and exploitation, and industrialise their operations,” Maiden noted. “They do not need to complete risk assessments, draft compliance reports, or navigate governance committees. They simply move at machine speed.”

He contrasted this with the reality facing defenders. “This accelerating adversary advantage contrasts sharply with organisations that must divert security teams toward audit preparation, reporting requirements, policy documentation and gathering evidence across multiple regulatory regimes.”

Overlapping frameworks creating drag

While compliance remains non-negotiable for Australian boards and executive teams, the requirements often overlap without full harmonisation. Security teams frequently manage multiple reporting cycles, varied maturity assessments and differing control interpretations across regulators.

The SOCI Act mandates enhanced obligations for critical infrastructure operators. APRA CPS 234 places clear accountability on financial services entities. The Privacy Act and Notifiable Data Breaches Scheme impose strict reporting and response timelines. The ASD Essential Eight outlines baseline controls increasingly treated as mandatory by government procurement frameworks.

“Too often, we see security teams spending time on evidence collection exercises for frameworks that measure the same underlying controls in slightly different ways,” Maiden remarked. “Meanwhile, threat actors probe exposed services, undermine identity systems and exploit unpatched devices.”

Compliance effort eclipsing resilience

Attackers continue to exploit long-standing vulnerabilities because organisations struggle to maintain cyber hygiene across large environments. Gaps in access and identity management, massive availability of compromised credentials, patch management delays, misconfigurations and fragmented visibility remain common entry points.

“In some cases, the effort required to demonstrate compliance eclipses the effort required to strengthen resilience,” Maiden observed.

Critical infrastructure under dual pressure

The compliance burden falls particularly heavily on operators of critical infrastructure. As operational technology (OT) environments converge with IT networks and cloud platforms, regulatory scrutiny increases.

The SOCI Act’s risk management program requirements, combined with sector-specific obligations and global standards such as IEC 62443 for OT environments, require organisations to maintain detailed asset inventories, segmentation strategies and incident response capabilities. At the same time, threat actors actively scan for OT protocols such as Modbus TCP and SIP, which underpin industrial control systems.

“Critical infrastructure operators face a dual challenge,” Maiden warned. “They must demonstrate compliance with expanding regulatory frameworks while defending highly connected and fragile environments against increasingly automated attacks.”

Integration, not deregulation

Maiden argued the answer is not less regulation but simplification and integration. Compliance should result from sound security architecture rather than existing as a parallel activity that drains resources.

He pointed to several priorities: robust access and identity management based on a zero trust approach, unified visibility across network, cloud, endpoint and OT environments, continuous threat exposure management rather than annual control assessments, automation in detection and response to offset skills shortages, and board-level focus on measurable risk reduction rather than policy completion alone.

“Attackers invest heavily in automation and scalability. Defenders must respond with the same mindset,” Maiden stressed. “If organisations implement compliance frameworks in silos, they increase complexity. However, if they are mapped to an integrated security strategy then they can reinforce resilience.”

Call for regulatory harmonisation

As Australia continues to strengthen its cybersecurity legislation, Maiden called for greater coordination across frameworks.

“Australia’s regulatory intent is strong and necessary. However, harmonisation across frameworks would significantly reduce duplicated effort and let organisations redirect capacity toward proactive defence,” he argued. “Cybersecurity governance and operational security must work together, not compete for resources.”

He added that organisations cannot afford to let regulatory complexity slow their ability to detect, respond to and recover from attacks. “Resilience depends on reducing both cyber risk and operational friction at the same time.”

Last Updated on April 8, 2026 by Nick Ross