Early this month the Australian Signals Directorate published new guidance on AI and cyber risk, written with the Australian Institute of Company Directors. The ASD AI guidance is addressed to boards of directors, which is a fair reason to assume it isn’t about you. I’d read it anyway. Strip out the governance language and three of its four asks cost a small business nothing but an afternoon. One of them is something almost no business has done.
What the ASD AI guidance actually asks for
The document is called Frontier AI Cyber Threat Considerations for Boards of Directors. The ASD published it on cyber.gov.au and the AICD’s copy carries the same guide. It landed in the first week of August.
Its argument is short. Capable AI models compress attack timelines. Work that took days now takes hours, and the skill needed to do it has dropped. The guidance warns this may rapidly invalidate the risk tolerance an organisation set a year ago. It then asks for four things, as iTnews reported. Treat foreign ownership and control of your AI providers as a cyber risk in its own right. Review how these models change your security posture. Counter threats from agentic AI environments. And improve your governance and capability for managing AI.
The AICD describes the oversight actions as applying to organisations of all sizes. That is the part worth taking seriously. This is not a document about big companies.
Most of it is the fundamentals wearing a new label
Read the ASD’s own priority list and the AI framing falls away. The immediate priorities are securing your attack surface and reducing software vulnerabilities. The short-term list is replacing legacy systems, tightening identity and access management, restricting unnecessary privileges, and preparing properly for an incident.
None of that is new. It is close to the Essential Eight, which has said the same things for years. The argument is not that AI created new weaknesses. It is that AI shortened the time between a weakness existing and someone finding it. The unpatched thing you were going to get to next quarter is the same unpatched thing. The window just got smaller.
So if a vendor uses this guidance to sell you an AI security product, be sceptical. The guidance does not ask you to buy anything. It asks you to do the boring work faster.
The genuinely new part: what your AI tools can already reach
The agentic point is the one I’d act on this week, because it describes something most businesses have done without noticing.
Over the past two years it became normal to connect AI tools to real systems. A meeting assistant that reads your calendar and joins calls. A mail plug-in that drafts replies. Something wired into your accounting file to categorise transactions. Each connection was approved by one person, in about a minute, and then forgotten.
What that produced is a set of accounts that are not people. They hold standing access to your mail, your documents or your ledger. They do not appear on the staff list. Nobody offboards them. The guidance’s advice is that an AI agent should have only the minimum access its duties require, and that is hard to apply to a connection nobody has looked at since the day it was switched on.
The fix is not technical. It is a list. Write down every AI tool connected to a business system, who approved it, and what it can see. Most businesses find between three and ten, and are surprised by at least one.
The vendor question worth asking, and the one to skip
The foreign ownership point is the weakest fit for a small business, and I’d say so plainly. A board of a large company can act on it. It can dual-source, negotiate, or move a workload. At twenty staff you cannot. The realistic set of capable AI vendors is small, none of them are Australian, and pretending otherwise is not a plan.
The useful version of the question is narrower. For each AI tool on your list, ask what happens to that process if the vendor is unavailable next Monday. Sometimes the answer is that someone does it by hand again, slower. That is fine, and you can stop thinking about it. Sometimes nobody knows, because the tool quietly became the only copy of how the work gets done. That is the risk, and it has nothing to do with who owns the vendor.
What to do this week
None of this needs a project:
- List every AI tool with a connection to your mail, files, CRM or accounting system. Include the ones a single person set up.
- For each, note who approved it and what it can reach. If it can reach everything, ask whether it needs to.
- Revoke anything nobody can name a current use for. Disconnected tools keep their access until someone removes it.
- For each remaining tool, write one line on what happens if it stops working tomorrow.
- Then go back to patching and multi-factor authentication, which is what the guidance is really asking for.
The whole exercise takes an afternoon. It produces a page you can hand to an insurer, an auditor or a nervous client, which is more than most businesses can do today. Knowing what holds your data, and what can reach it, is the same groundwork a data health check starts from. The ASD has simply given you a reason to do it this month rather than next year.