Closing the gap: Turning insider risk policy into an operational program
Across Australia, government agencies, utilities and other critical infrastructure organizations are under growing pressure to understand and manage the risks posed by trusted users with access to sensitive data. The Information Security Manual and state government cyber policies expect organizations to identify these risks, put appropriate controls in place, and demonstrate that those controls are working. Frameworks governing critical infrastructure carry the same expectation.
Yet insider risk often remains rooted in policies, annual assessments and compliance exercises rather than an operational program with clear ownership, ongoing visibility and the ability to identify and respond to risky behavior. The challenge encompasses malicious insiders as well as negligent employees, contractors with privileged access and users whose accounts have been compromised.
Meanwhile, AI is changing the risk equation. Copilots, agents and other AI tools can make it much easier for users to find, aggregate and move information, while shadow AI, data exfiltration and prompt manipulation create additional concerns.
Join Mimecast experts as they explore how public sector and critical infrastructure organizations can put insider risk and data protection policies into practice, manage AI-related risks, and gain the visibility needed to prove effective security governance.
