Three risks your incident log won't show you. Aaron's take on the CISC 2026 Risk Review

Three risks your incident log won't show you. My take on the CISC 2026 Risk Review

CISC released their fourth Annual Risk Review this month and I've spent a fair bit of time with it. They rank the cross sector risks two ways, how plausible they are and how much damage they'd do. Three risks show up in the top five on both lists. Pre-positioned attacks on OT, insider risk from contractors and AI implementation.

The thing that ties those three together is that none of them announce themselves. You can go a whole year without an incident and still be carrying all three. That's what makes them worth talking about.

Attackers already sitting in OT

ASD and ASIO have both said state sponsored actors are routinely targeting Australian critical infrastructure. The goal isn't a quick hit. It's getting into OT and staying there undetected so they can learn how the systems work and use that access when it suits them.

The example CISC uses is an Iranian group called Seedworm. They've been inside multiple US operators since February and in July they used internet connected OT devices to disrupt several sectors at once.

CISC's advice here is pretty basic and I agree with it. Air gap where you can and lock down the connections between OT, IT and the internet so an attacker can't move around easily. In the assessments we do across distributors and utilities we still see plenty of flat or half segmented OT networks and not a lot of monitoring on them.

Question for your board: if a state actor had been in your OT network for six months how would you know?

Contractors with the keys

This one ranked first for plausibility and second for damage, which tells you something. Offshore and contract staff often get the same privileged access as your own team but with less oversight, and they're more exposed to being pressured or recruited by someone with bad intentions.

In my experience contractors, MSPs and offshore support teams tend to fall through the gaps. They're not always vetted the same way, their access doesn't get reviewed as often and offboarding can be patchy.

Recruitment is part of this now too. CISC calls out HR teams dealing with deepfake credentials, fake work histories and AI generated references. Most HR teams I know aren't set up to catch that and it's not fair to expect them to be without support from security.

Question for your board: can you list every contractor with privileged access to OT today and when each of them was last reviewed?

AI moving faster than governance

AI cuts both ways. On the outside it's making sophisticated attacks available to people who couldn't have pulled them off a couple of years ago. On the inside staff are pasting sensitive info into public AI tools and bringing in shadow AI without anyone knowing.

I haven't seen many operators with an AI policy that covers OT, the AI features vendors are quietly switching on, or how data gets handled. It's a governance gap more than a tech one.

Question for your board: what AI tools are in use across your business right now, including the ones your vendors have turned on?

The rest of the top five

Third party cyber risk and geopolitical supply chain disruption round out the plausibility list. On the third party side CISC's point is that one compromised vendor plugged into lots of operators can cause a lot of disruption for not much effort. CrowdStrike showed us what that looks like even without an attacker involved.

On supply chain the Hormuz closures hit more than fuel prices. Bitumen, plastics, insulation and OT gear all got caught up in it. The quieter problem is cost pressure pushing operators towards cheaper suppliers where security comes second.

State sponsored sabotage and low levels of cyber security finish off the damage list. Iranian drones hit cloud data centres in the UAE this year, which is a good reminder that if your services run offshore you can lose them without anything happening locally. And legacy systems are still a big one. A lot of them were never built for today's threats and they're often hooked into newer systems without proper separation.

What's changed for Aussie SOCI entities

The Enhanced CIRMP Rules 2026 now require entities to properly understand their major third party providers and any foreign ownership, control or influence risk that comes with them. There are new legacy system requirements as well. So third party visibility has gone from nice to have to something the regulator expects to see.

NZ doesn't have an equivalent regime yet but in my experience Australian guidance ends up being the benchmark NZ boards look to anyway.

Why smaller operators should care most

The line in the review I keep coming back to is CISC saying the cost of attack will keep dropping while the cost of defence keeps going up, and smaller operators could struggle to keep pace.

That's a lot of the lines companies, water utilities and councils we work with. They're running essential services with small teams and tight budgets. They can't do everything so the priority has to be knowing where the exposure sits across OT, people and suppliers and putting the money where it'll make the biggest difference.

That's the work we do at Overcyte across NZ, Australia and the UK, AESCSF assessments, third party risk and continuous compliance. If you want to chat through how any of this applies to you, flick me a message.

‍