ACSC HIGH ALERT: Your CI/CD Pipeline is the New Frontline. Are You Prepared for a Supply Chain Attack?

Executive Summary: The Australian Cyber Security Centre (ACSC) has issued a high-level alert on the active targeting of online code repositories, signaling a strategic shift by adversaries towards Australia's software supply chain. Threat actors are no longer just attacking production systems; they are infiltrating the very "factory" where your software is built, turning trusted applications into delivery mechanisms for catastrophic breaches. This report deconstructs this evolving threat, analyses the multi-million dollar business impact, and outlines how adversary simulation is the only effective method to validate your defences against a compromise of your CI/CD pipeline.

Understanding the Threat: A New Battleground

The traditional cybersecurity paradigm focused on defending the perimeter—the hardened walls around production environments. However, a recent high-level alert from the Australian Signals Directorate's Australian Cyber Security Centre (ACSC) confirms a fundamental shift in the threat landscape. Adversaries are moving upstream, targeting the soft underbelly of modern enterprise: the software development lifecycle (SDLC).  

The ACSC explicitly warns of the "ongoing targeting of online code repositories," where threat actors are actively working to "scan for and extract secrets, access private code bases, and modify packages to infect users". This is not a theoretical risk; it is an active campaign targeting Australian organisations now.  

Adversary Tactics, Techniques, and Procedures (TTPs)

The sophistication of these attacks lies in their subtlety. Instead of deploying noisy, bespoke malware that traditional security tools might detect, threat actors are employing "living-off-the-land" techniques. The ACSC notes that adversaries are "abusing legitimate tooling and functions to achieve these results". This means your security operations centre (SOC) is looking for a wolf in a field of sheepdogs; the malicious activity is deliberately cloaked in the guise of legitimate developer workflows.  

Key intrusion vectors identified by the ACSC include :  

• Compromised Credentials & Tokens: Stolen passwords or authentication tokens provide direct access to source code repositories.

• Phishing & Social Engineering: Highly targeted campaigns designed to trick developers into divulging credentials.

• Infected Software Packages: The manipulation of open-source dependencies to introduce malicious code.

A prime example is the recent "Shai-Hulud" npm worm. This attack began with a targeted phishing campaign to compromise developer accounts, which was then used to inject a self-replicating worm into popular JavaScript packages. The payload was designed to steal cloud service tokens and hunt for more secrets, demonstrating the speed and scale of these automated supply chain threats.  

The Critical Enabler: Secrets Sprawl

The single greatest internal vulnerability amplifying this external threat is secrets sprawl. This refers to the unintentional leakage of sensitive credentials—API keys, database passwords, cloud access tokens, and private certificates—within source code, configuration files, and CI/CD pipeline logs.  

For developers working under tight deadlines, hardcoding a credential can seem like a harmless shortcut. However, once that secret is committed to a version control system like Git, it is effectively permanent and exposed. Attackers know this. One of their first post-compromise actions is to run automated scanners against repositories to harvest these exposed secrets, turning a minor code exposure into a full-blown, multi-system breach. A single exposed cloud token embedded in an application's source code can lead directly to the compromise of sensitive customer data stored in cloud buckets.  

Business Impact Analysis: The Multi-Million Dollar Fallout

A compromised CI/CD pipeline is not just a technical problem; it is a business-ending event. The financial and reputational fallout from a software supply chain attack is catastrophic and multifaceted, extending far beyond the initial cleanup costs.

For Australian organisations, the average cost of a data breach has already reached $3.35 million. However, a supply chain attack acts as a threat multiplier, with unique characteristics that inflate this cost dramatically:  

• Regulatory Annihilation: Under the Notifiable Data Breaches (NDB) scheme, the Office of the Australian Information Commissioner (OAIC) can now impose penalties for serious or repeated privacy breaches of up to $50 million, 30% of the company's adjusted turnover, or three times the value of the benefit obtained through the misuse of information—whichever is greater. This is a monumental increase from the previous $2.22 million cap.  

• Operational Paralysis: When a core software component is compromised, business operations can grind to a halt. The Kaseya supply chain attack famously forced a Swedish supermarket chain to close 800 stores for days because their point-of-sale systems were rendered inoperable, showcasing how digital compromises have devastating physical-world consequences.  

• Ecosystem-Wide Contagion: A single compromised software vendor can infect their entire client base. The SolarWinds attack provided threat actors with backdoor access to an estimated 18,000 organisations, including government agencies and Fortune 500 companies. Your organisation's security is now only as strong as your least secure software supplier. The OAIC confirms this trend in Australia, noting a high number of multi-party breaches originating from compromised cloud and software providers.  

• Irrevocable Trust Erosion: When your own software is used to attack your customers, the reputational damage is profound. The cost associated with customer turnover after a breach averages over $1.5 million, and the damage to brand equity can take years to repair, if ever.  

How Red Teaming Exposes This Vulnerability

Standard vulnerability scans and annual penetration tests are no longer sufficient. These methods are effective at finding known CVEs or misconfigurations in production systems, but they are fundamentally blind to the sophisticated, multi-stage TTPs used to compromise a CI/CD pipeline.

To defend against a thinking adversary, you must simulate one.

A CI/CD Red Team engagement is an objective-based adversary simulation designed to answer one critical question: Can an attacker compromise our software development lifecycle to deploy malicious code into production?

Our approach moves beyond checklists to replicate the real-world attack paths that adversaries are using against Australian companies today. We validate your defences against established industry frameworks like the OWASP Top 10 CI/CD Security Risks, providing a clear, evidence-based assessment of your true risk posture.  

Key Simulation Objectives

• Poisoned Pipeline Execution (PPE) (CICD-SEC-4): Can we inject malicious commands into a build script (e.g., Jenkinsfile, GitHub Actions workflow) that execute on a build server, giving us a foothold in your infrastructure?  

• Dependency Chain Abuse (CICD-SEC-3): Can we trick your build process into pulling a malicious package from a public repository instead of a legitimate internal one?  

• Insufficient Credential Hygiene (CICD-SEC-6): Can we find hardcoded API keys, tokens, or passwords in your source code and use them to pivot to sensitive cloud environments or databases?  

• Inadequate Identity & Access Management (CICD-SEC-2): If we compromise a single developer's account, can we escalate privileges due to overly permissive IAM roles within your SCM or cloud platforms?  

• Insufficient Logging & Visibility (CICD-SEC-10): Can we perform all of the above actions without triggering a single meaningful alert from your security monitoring team?

Our Methodology: A Controlled, Objective-Driven Assessment

Our red team engagements are meticulously planned and executed to test your entire SDLC, from developer identity to production deployment.

1. Threat Modelling & Reconnaissance: We work with you to understand your specific CI/CD architecture, tools, and workflows. We then perform reconnaissance to identify potential developer credentials or exposed information that could serve as an initial entry point.

2. Initial Compromise & IAM Exploitation: We simulate targeted attacks to gain an initial foothold, then probe your IAM configuration for weaknesses that allow for privilege escalation and lateral movement across your development ecosystem.

3. Pipeline Infiltration & Manipulation: We attempt to exploit weaknesses in your pipeline's configuration and access controls to achieve Poisoned Pipeline Execution, seeking to gain control of the build process itself.

4. Secrets Exfiltration & Impact Demonstration: We actively hunt for exposed secrets. Upon discovery, we demonstrate the potential business impact by using them to access a non-production data store or cloud service in a safe, controlled manner.

5. Reporting & Strategic Debrief: We provide a comprehensive report detailing not just the vulnerabilities found, but the entire attack narrative. Our executive debrief focuses on providing a prioritised, actionable roadmap for remediation, addressing the root causes in your people, processes, and technology.

Secure Your Software Factory Today

The ACSC's alert is a clear warning: the software supply chain is the new frontline in cybersecurity. Waiting for a breach to occur is no longer a viable strategy, especially with regulatory penalties and reputational stakes at an all-time high. Proactive validation through realistic adversary simulation is the only way to understand and mitigate this pervasive threat.

Don't let a compromised commit unravel your entire enterprise. Contact our team of experts for a confidential consultation to discuss how a CI/CD Red Team engagement can secure your development pipeline and protect your business.

Beyond the Basics: Advanced Security Testing Techniques for 2025 Threats - Infograph

This Lean Security infographic outlines advanced testing strategies for evolving 2025 cybersecurity threats, including AI-driven vulnerability scans, realistic red team simulations, adaptive testing, cloud-specific evaluations, and the combined strengths of automated and manual security testing for comprehensive protection.

Managed Web Vulnerability Scanning vs. Manual Testing: Which One is Right for You?

In today’s digital-first business landscape, web applications have become the backbone of operations, sales, and customer engagement. While this shift creates unprecedented opportunities, it also exposes organizations to new cyber risks. Businesses need reliable strategies to identify and fix potential weaknesses before they become entry points for malicious actors. Two popular approaches stand out: managed web vulnerability scanning and manual penetration testing.

But which one is best for your organization? To answer that, let’s explore how each method works, its benefits, limitations, and how it fits within broader managed network services strategies.

Understanding Managed Web Vulnerability Scanning

A vulnerability scanning service uses automated tools to search for known security flaws across websites, applications, and network systems. The scan typically checks for outdated software, misconfigurations, weak passwords, and other vulnerabilities. Because it is automated, scanning can be run regularly, ensuring that organizations are consistently monitoring their systems.

Most modern vulnerability scanners integrate seamlessly with managed network services, allowing businesses to monitor threats across all endpoints, cloud environments, and web applications without burdening in-house teams. This consistency makes scanning an attractive option for companies looking for continuous protection.

Advantages of Managed Web Vulnerability Scanning

1. Efficiency and Speed

Automated scans can analyze thousands of assets in a fraction of the time it would take a human team. This speed enables businesses to detect vulnerabilities quickly and reduce exposure.

2. Cost-Effectiveness

Compared to hiring penetration testing companies for regular audits, vulnerability scanning is more affordable. It allows small to mid-sized businesses to maintain a baseline level of cybersecurity without breaking their budget.

3. Regular Monitoring

Because scans can be scheduled daily, weekly, or monthly, organizations gain ongoing insights. Continuous detection of vulnerabilities reduces the window of opportunity for cybercriminals.

4. Integration with Reporting Tools

Most vulnerability scanning services generate clear, actionable reports, making it easier for IT teams to prioritize fixes. When paired with managed network services, these reports feed into broader security dashboards for streamlined oversight.

Limitations of Vulnerability Scanning

Despite its benefits, automated scanning isn’t perfect.

· False Positives: Scanners may flag issues that don’t pose real threats, requiring manual verification.

· Limited Context: Automated tools don’t understand business logic or unique workflows, leaving certain vulnerabilities undetected.

· No Exploitation Testing: Scanning identifies flaws but doesn’t attempt to exploit them, meaning it can’t fully measure the potential impact of an attack.

This is where manual testing becomes essential.

What is Manual Penetration Testing?

Penetration testing companies specialize in simulating real-world cyberattacks to uncover security weaknesses that automated tools might miss. Skilled professionals actively probe applications, networks, and systems, using their expertise to think like hackers. Unlike scanners, penetration testers go beyond simply identifying vulnerabilities—they test how they could be exploited in practice.

Manual testing often requires significant expertise, making it a service better suited for complex or high-risk environments.

Benefits of Manual Penetration Testing

1. Human Intelligence

Attackers are creative, often chaining multiple vulnerabilities together. Human testers can replicate this behavior in ways automated tools cannot.

2. Business Context Awareness

A penetration tester understands workflows, user roles, and system dependencies. This allows them to focus on vulnerabilities with the greatest potential business impact, not just technical weaknesses.

3. Real-World Attack Simulation

Unlike scanning, manual testing goes a step further to see if a vulnerability can be exploited. This provides insights into the actual risk, not just theoretical concerns.

4. Custom Recommendations

Reports from penetration testing companies often include tailored advice specific to your organization, ensuring more practical remediation strategies.

Drawbacks of Manual Penetration Testing

While powerful, manual testing has its challenges.

· Cost: Engaging penetration testing companies is typically more expensive than a vulnerability scanning service.

· Time-Intensive: Manual testing can take days or weeks, depending on the scope.

· Not Continuous: Penetration tests are usually scheduled periodically—such as annually or semi-annually—leaving gaps between assessments.

For organizations that need real-time visibility, relying solely on manual testing may leave blind spots.

Managed Network Services: The Bigger Picture

Neither vulnerability scanning nor manual testing should exist in isolation. Instead, both are crucial components of broader managed network services, which provide continuous oversight and holistic security management.

By outsourcing security operations to providers of managed network services, businesses gain:

· Centralized monitoring across all devices and endpoints.

· Integration of vulnerability scans with SIEM (Security Information and Event Management) tools.

· Access to specialized security experts who can interpret scan results and recommend next steps.

· Coordination with penetration testing companies for in-depth analysis when needed.

This combination ensures businesses have both breadth (through scanning) and depth (through manual testing) in their defenses.

Which Approach is Right for You?

Choosing between vulnerability scanning and manual penetration testing depends on your business needs, budget, and risk profile.

· Small to Mid-Sized Businesses: For organizations with limited budgets and moderate risk, a vulnerability scanning service offers consistent, affordable protection. When combined with managed network services, it provides a strong baseline security.

· High-Risk Industries: Companies handling sensitive data, such as healthcare, finance, or government contractors, should prioritize manual penetration testing. These environments require the expertise and real-world simulations that automated tools can’t deliver.

· Balanced Approach: The most effective strategy often combines both. Regular vulnerability scans keep day-to-day security in check, while periodic penetration tests dig deeper into business-specific risks. Together, they create a layered defense.

The Future of Cybersecurity Testing

As cyber threats evolve, the line between scanning and manual testing is becoming more blurred. Many penetration testing companies now integrate automated scanning tools into their workflows, while vulnerability scanning providers enhance their platforms with AI-driven insights.

Meanwhile, managed network services providers are playing a critical role by consolidating these efforts under one umbrella, ensuring businesses don’t need to choose between coverage and depth—they can have both.

The debate between managed web vulnerability scanning and manual penetration testing isn’t about which is superior, but about how they complement each other. Vulnerability scanning offers speed, affordability, and continuous monitoring, while manual testing delivers human intelligence, context, and real-world validation.

Organizations that integrate both into their managed network services strategy gain the most resilient defense against ever-evolving cyber threats. In the end, the right choice isn’t one or the other—it’s knowing how to leverage both effectively to protect your business.

At Lean Security, we understand that every business faces unique cybersecurity challenges. That’s why we offer tailored solutions that combine the efficiency of a vulnerability scanning service and the reliability of managed network services. Our team helps you uncover hidden risks, monitor systems continuously, and safeguard sensitive data against evolving threats. Whether you need ongoing vulnerability monitoring, deep-dive manual testing, or a fully managed approach, Lean Security delivers proactive protection you can trust. Partner with us today to strengthen your defenses and stay one step ahead of cybercriminals

Building a Resilient Web Security Platform: What Enterprises Should Look For

In today’s digitally driven economy, enterprise networks have become the backbone of business operations. As organizations expand their online presence, their exposure to cyber threats increases significantly. A resilient web security platform is no longer optional—it is a critical necessity for safeguarding data, ensuring compliance, and protecting the trust of clients. But what exactly should enterprises look for when evaluating or building such a platform? From risk assessment solutions to partnerships with penetration testing companies and reliance on managed network services, the key lies in adopting a layered and proactive defense strategy.

Understanding the Current Threat Landscape

Cyber threats are no longer limited to opportunistic hackers looking for quick wins. Modern attackers use advanced techniques, including ransomware, phishing campaigns, and zero-day vulnerabilities, to compromise enterprise systems. Moreover, industries such as healthcare, finance, and e-commerce remain prime targets due to the value of sensitive data they handle.

Given the pace of evolving threats, enterprises must embrace security as an ongoing process, not a one-time project. A resilient web security platform should anticipate risks, provide early detection, and include rapid response mechanisms.

The Role of Risk Assessment Solutions

One of the first steps in building a robust web security platform is adopting comprehensive risk assessment solutions. These tools and methodologies help enterprises identify potential vulnerabilities within their infrastructure before attackers exploit them.

Risk assessments typically evaluate:

· Network infrastructure – Identifying misconfigurations or outdated systems.

· Applications – Detecting insecure code, injection flaws, or broken authentication.

· User behavior – Highlighting insider threats or risky usage patterns.

· Regulatory compliance – Ensuring adherence to industry-specific standards such as HIPAA, PCI-DSS, or GDPR.

By leveraging advanced risk assessment tools, enterprises can prioritize which vulnerabilities pose the greatest threat and allocate resources efficiently. A strong platform integrates continuous monitoring, ensuring that risk analysis is not just a quarterly exercise but an ongoing defense mechanism.

Partnering with Penetration Testing Companies

While automated risk assessments provide valuable insights, they can miss complex, real-world attack scenarios. This is where collaboration with specialized penetration testing companies becomes essential.

Penetration testers, also known as ethical hackers, simulate real-world attacks to uncover weaknesses that automated tools may overlook. Unlike traditional scanning, penetration testing provides context by demonstrating how vulnerabilities can be chained together for maximum impact.

Key benefits of engaging penetration testing companies include:

· Realistic threat simulations to mimic actual attacker behavior.

· Tailored recommendations for remediation based on industry and business model.

· Validation of security investments, ensuring deployed tools and policies work as intended.

· Regulatory alignment, as many frameworks now mandate penetration testing as part of compliance.

Enterprises that build relationships with trusted testing partners gain confidence in their defenses, knowing they are tested against cutting-edge attack strategies.

The Importance of Managed Network Services

A resilient web security platform cannot rely solely on in-house IT teams. Cybersecurity requires constant vigilance, and many enterprises lack the resources to operate 24/7. This is where managed network services come into play.

Providers of managed network services deliver continuous monitoring, threat detection, and response capabilities. By outsourcing to experts, enterprises can:

· Achieve around-the-clock surveillance, catching attacks at any time of day.

· Benefit from advanced analytics, including machine learning and threat intelligence feeds.

· Ensure faster incident response, reducing downtime and financial losses.

· Scale security services as the organization grows, without overwhelming internal teams.

Choosing the right managed service provider means selecting one that integrates seamlessly with existing infrastructure and aligns with business objectives. A strong partnership ensures that enterprises stay one step ahead of attackers.

Building a Multi-Layered Defense Strategy

No single tool or solution can guarantee security. A resilient web security platform must be built on a multi-layered defense strategy, where different components complement one another.

Core layers include:

1. Perimeter defense – Firewalls and intrusion prevention systems to block external threats.

2. Application security – Web application firewalls and secure coding practices.

3. Endpoint protection – Advanced anti-malware and behavioral analysis.

4. User awareness – Training employees to recognize phishing and social engineering attempts.

5. Risk assessment and penetration testing – Identifying and validating vulnerabilities.

6. Managed network services – Ensuring ongoing detection and rapid incident response.

This layered approach minimizes the chances of a successful breach, as attackers must bypass multiple barriers to reach critical assets.

Compliance and Regulatory Considerations

Enterprises operate in a regulatory environment where compliance is as important as technical security. Frameworks such as ISO 27001, NIST, PCI-DSS, and HIPAA demand organizations to implement structured security measures. A resilient platform should integrate compliance requirements into its design.

Risk assessment solutions and penetration testing both contribute to compliance by offering documented evidence of security controls. Similarly, managed network services ensure continuous logging and reporting, simplifying audit preparation. Enterprises should look for platforms that streamline compliance without creating unnecessary complexity.

The Role of Automation and Artificial Intelligence

Modern web security platforms must also embrace automation and AI. Manual monitoring is not sufficient to handle the sheer volume of threats. Automation allows for faster detection, response, and remediation.

For example:

· AI-driven anomaly detection can highlight unusual traffic patterns that may indicate a breach.

· Automated patch management reduces the window of exposure to known vulnerabilities.

· Incident response automation ensures immediate containment of threats without waiting for human intervention.

When combined with expert oversight from managed service providers, AI-driven automation enhances resilience by reducing response times and human error.

Evaluating Vendor Partnerships

Enterprises must also evaluate the quality of vendors they partner with when building a web security platform. Not all providers of risk assessment solutions, penetration testing companies, or managed network services are created equal.

When choosing partners, organizations should consider:

· Proven track record in enterprise environments.

· Industry certifications such as CREST, ISO, or SOC 2.

· Flexibility and scalability to adapt as business needs evolve.

· Transparent reporting and actionable insights rather than generic recommendations.

· Collaborative approach that integrates with internal teams instead of working in isolation.

Vendor relationships should be long-term, fostering continuous improvement in security posture rather than one-off engagements.

Preparing for the Future of Web Security

Cybersecurity is a moving target, and enterprises must anticipate the challenges of tomorrow. As cloud adoption, IoT devices, and remote work continue to expand the attack surface, resilient platforms must evolve to cover emerging risks.

Future-ready platforms will integrate:

· Zero Trust models, ensuring verification at every access point.

· Cloud-native security solutions to protect hybrid and multi-cloud environments.

· Threat intelligence sharing, allowing organizations to learn from industry-wide attacks.

By aligning current strategies with future needs, enterprises can stay ahead in the cybersecurity arms race.

 At Lean Security, we help enterprises build resilient web security platforms that go beyond traditional defenses. Our comprehensive risk assessment solutions identify vulnerabilities before attackers exploit them, while our penetration testing company provides real-world validation of your defenses. With our expert-managed network services, your business benefits from 24/7 monitoring, proactive threat detection, and rapid response. Cybersecurity is not a one-time project—it’s an ongoing commitment. Trust Lean Security to safeguard your operations, ensure compliance, and strengthen your resilience against evolving digital threats.

ACSC ALERT: Is Your SonicWall VPN an Open Door for Akira Ransomware in Australia?

Executive Summary

On September 10, the Australian Cyber Security Centre (ACSC) issued a high-severity alert confirming that the Akira ransomware group is actively exploiting a critical SonicWall VPN vulnerability (CVE-2024-40766) to breach Australian businesses. The situation is more dangerous than it appears: patching the vulnerability is not enough to secure your network. Attackers are using a procedural loophole involving un-reset credentials to bypass the fix, leaving many organizations exposed despite their compliance efforts. This threat is amplified by Australia's new 2025 mandatory ransomware reporting laws, which can turn a technical breach into a regulatory and legal disaster. This analysis breaks down the technical risk, the severe business impacts, and the necessary steps to truly validate your defenses against this clear and present danger.

The Urgent Threat: What the ACSC is Warning Australian Businesses About

The Australian Signals Directorate's Australian Cyber Security Centre (ACSC) has sounded the alarm for a significant, ongoing cyber threat targeting Australian organizations. In a high-severity alert published on September 10, 2025, the agency confirmed the active exploitation of a critical vulnerability in widely used SonicWall SSL VPNs. This is not a theoretical risk; it is a live campaign with confirmed victims in Australia.  

The threat actor behind these attacks has been identified as the Akira ransomware group, a sophisticated and financially motivated criminal enterprise known for its double-extortion tactics. The ACSC's alert specifically highlights that Akira is leveraging this VPN flaw as an initial access vector to breach corporate networks, with a focus on small and medium-sized businesses as well as critical infrastructure providers. The term "active exploitation" is cybersecurity parlance for a clear and present danger—attackers are successfully using this method to compromise systems right now, making immediate and effective action a necessity for any organization using the affected technology.  

Technical Analysis: Why Patches Are Failing

The vulnerability at the heart of this campaign is CVE-2024-40766, a critical "improper access control" flaw in SonicWall's operating system. In simple terms, it allows a remote attacker to bypass the normal authentication checks required to gain access to a private network via the SSL VPN. However, the true danger lies in a critical nuance that many IT teams are missing, what can be called the "Patching Paradox."  

While SonicWall released a patch for this vulnerability over a year ago, the ACSC confirms attacks are still succeeding. Why? Because the attackers are not always exploiting the unpatched software. Instead, they are leveraging a procedural failure: the failure to reset local SSL VPN user passwords after the patch was applied.  

The attack chain is dangerously simple. Before a patch was applied, attackers exploited the vulnerability to steal a list of valid user credentials. Now, even after an organization has patched its SonicWall device, these attackers can return and simply log in with the old, stolen passwords. This is especially common in businesses that have migrated configurations from older Gen 6 to newer Gen 7 devices without enforcing a full credential reset. Your automated vulnerability scanner will report the device as "patched" and "secure," giving you a false sense of security while an attacker walks in the front door with a stolen key.  

Business Impact: Beyond Downtime to Regulatory Disaster

A successful breach by Akira is not just an IT headache; it is a multi-faceted business catastrophe. The group employs a double-extortion model, meaning they first steal copies of your most sensitive corporate and customer data before encrypting your systems. They then demand a ransom to restore your access and a separate payment to prevent them from leaking your stolen data publicly.  

For Australian businesses in 2025, the financial and operational damage is now compounded by a new and unforgiving regulatory landscape. A ransomware incident now triggers a cascade of legal obligations that can lead to severe penalties. Under the Cyber Security Act 2024, if your business has over $3 million in annual turnover and you make a ransom payment, you are legally required to submit a detailed incident report to the government within 72 hours.  

Furthermore, if customer data is compromised, the breach will likely trigger obligations under the Notifiable Data Breaches scheme and expose your company to class-action lawsuits under the new statutory tort for serious invasion of privacy, which came into effect in June 2025. An attack is no longer just about downtime; it's a legal and compliance crisis that can inflict lasting reputational and financial damage.  

The Solution: Moving from Compliance to Resilience with Adversary Simulation

The Akira-SonicWall campaign proves that a compliance-based, checklist approach to security is no longer sufficient. You cannot rely on a "green" light from a vulnerability scanner to know you are secure. The only way to be certain that your defenses can withstand a real-world attack is to test them against the same tactics, techniques, and procedures used by the adversary.

This is the role of penetration testing and adversary simulation. A comprehensive security assessment doesn't just check if a patch is installed. It simulates the entire attack chain used by Akira—from exploiting the perimeter to using stolen credentials, moving laterally within the network, and attempting to exfiltrate data. It validates not only your technology but also your procedures and your team's ability to detect and respond to an intrusion. This proactive approach moves your organization from a reactive state of compliance to a proactive state of proven resilience.

Call-to-Action

The Akira-SonicWall campaign is a clear and present danger to Australian businesses. Standard security measures are proving insufficient. Contact us today to schedule a comprehensive SonicWall Security Assessment and Adversary Emulation test to validate your defenses before they are put to the ultimate test.