In Australia’s National Interest - Security of Critical Infrastructure

How much of what we judge to be a material security risk is driven by evidence — and how much by what we can most easily remember?
In this episode, Tim Slattery and Marina Shteinberg of Pentagram Advisory explore the availability heuristic and what behavioural science can teach us about security risk management and decision making under uncertainty.
In an era of heightened uncertainty, Boards, executives and security leaders are required to make consequential decisions with information that may be incomplete, uneven or constantly changing.
Recent incidents, personal experience and highly visible threats can quickly dominate attention — while less familiar but potentially material risks remain outside the spotlight.
Tim and Marina examine how availability bias can influence security risk assessment, risk prioritisation and investment decisions, and why a formal risk management framework does not remove human judgement — it structures where that judgement is exercised.
They also consider practical ways to strengthen decision-making through broader evidence, structured challenge and greater transparency around the reasoning behind risk ratings.
Because what is memorable is not necessarily what is material. And unfamiliarity is not evidence of safety.

What does employee engagement tell us about the strength and resilience of an organisation?
Drawing on findings from Gallup’s State of the Global Workplace 2026, Tim Slattery and Marina Shteinberg, Co-Founders of Pentagram Advisory, examine the latest Australian employee engagement data and explore what it may tell us about the relationship between employees and their workplaces.
The discussion moves beyond traditional questions of productivity and retention to consider the connections between engagement, trust, the psychological contract and organisational culture — and what these may mean for security.
Organisations can mandate policies, implement controls and monitor compliance. But security also depends on people exercising judgement, speaking up, taking ownership and acting when circumstances demand more than compliance.
We can mandate compliance. We cannot mandate care.
This episode explores why that distinction matters for Boards, executives, security leaders and people leaders — and why employee engagement should also be considered through the lens of organisational resilience and security.
Source: Gallup, State of the Global Workplace 2026

How is artificial intelligence changing the insider threat landscape—and how should organisations respond?
In this special episode from Pentagram Advisory, Tim Slattery and Marina Shteinberg, Directors and Co-Founders of Pentagram Advisory, are joined by Dr Jon Roginski, Founder and CEO of QualQuantAnalytics (Q2A), for an in-depth conversation about insider threat, artificial intelligence, advanced analytics and the rapidly evolving relationship between people and technology.
Jon brings more than two decades of experience across the U.S. military, academia and insider threat research, including leading the West Point Insider Threat Program research effort supporting the U.S. Army Insider Threat Program.
He is also the creator of Managing Insider Risk and Organizational Resilience (MIROR) and a longstanding collaborator and friend of Pentagram.
Drawing on this experience, Jon explores how organisations can make better use of increasingly complex data environments to create what he describes as a “decision advantage”—using AI-enabled data science, operations research, network science and applied analytics to support better-informed decision-making.
The conversation moves beyond the technology itself to some of the more difficult questions emerging as AI becomes embedded in organisations: Can AI truly be controlled? How should organisations manage systems whose behaviour cannot always be perfectly predicted? What safeguards are required? And what happens when we begin to consider AI through the same risk lens traditionally applied to human insiders?
Jon, Tim and Marina explore the distinction between control and management, the importance of observing, interrupting, correcting and recovering when systems behave unexpectedly, and the parallels between managing AI risk and established approaches to personnel security and insider threat.
The discussion also considers what these developments mean for critical infrastructure, personnel security, trusted workforce programs, organisational resilience and security decision-making.
Our sincere thanks to Dr Jon Roginski for joining Pentagram from the United States and for generously sharing his expertise, experience and perspectives with our community.
Featuring:
Dr Jon Roginski — Founder & CEO, QualQuantAnalytics (Q2A)
Tim Slattery — Director & Co-Founder, Pentagram Advisory
Marina Shteinberg — Director & Co-Founder, Pentagram Advisory
Pentagram Advisory works with organisations to strengthen critical infrastructure security, personnel security, insider threat management, trusted workforce programs, supply chain security, security governance and organisational resilience.
#InsiderThreat #ArtificialIntelligence #AI #JonRoginski #QualQuantAnalytics #PentagramAdvisory #PersonnelSecurity #TrustedWorkforce #CriticalInfrastructure #InsiderRisk #OrganisationalResilience

Australia is in decline. The nation is being attacked internally and externally by people and nation states who want to see Australia diminished, enfeebled.
I want to stop that decline. I want to see Australia grow more prosperous, more socially cohesive and respectful, more secure.
In this article I describe the Australia I want and suggest how those of us who support the idea of Australia as our home can work towards achieving that. I call it 'Oztopia'.

The Enhanced CIRMP Rules 2026 introduce a significant uplift in supply chain security requirements for affected critical infrastructure entities.
In this episode, Tim Slattery and Marina Shteinberg from Pentagram Advisory unpack section 10A and explore the shift from traditional supply chain risk management towards critical dependency assurance. We examine what organisations may need to map, the distinction between major suppliers and dependencies supporting critical components, how deeply supply chains should be mapped, and the challenges involved in determining Maximum Acceptable Outage (MAO).
We also explore major-supplier assessment and Foreign Ownership, Control or Influence (FOCI), the intersection between supply chain dependencies and critical worker obligations, and the practical implementation questions responsible entities should be considering as they prepare for the 10 June 2028 implementation deadline.
The central question is no longer simply: Who are our suppliers?
It is: What does our critical infrastructure asset depend upon, where do those dependencies sit, and do we have sufficient assurance and resilience to manage the resulting risk?