Virtual IT Group launches two managed security services across Australia and New Zealand

Virtual IT Group has launched two new managed security and IT services targeting mid-market organisations in Australia and New Zealand, marking the company’s second major product release this year.

The two offerings — Modern Managed Services and Managed Detection & Response — are designed for organisations facing heightened security risks as they adopt artificial intelligence tools, connect more systems, and navigate increasing governance pressure. Modern Managed Services is built around the company’s Modern Defensible Architecture framework, embedding security controls, governance frameworks, and operational practices into day-to-day IT management. Managed Detection & Response provides around-the-clock monitoring, investigation, and incident response supported by security analytics tools, and can be deployed independently or alongside the managed services product.

Second Major Release This Year

The launch follows Virtual IT Group’s earlier introduction of a Zero Trust Consulting Practise and a Zero Trust Detection & Response service. It also comes after the company’s acquisition of Security Centric and its prior addition of Auckland-based The Instillery, deals that have broadened its footprint across managed services, cloud, cybersecurity, data, and AI in both markets.

Chief Product Officer Jeremy Nees said the new services address a gap he sees in the traditional managed services market. "Too often, organisations purchase managed services only to discover they do not have the standard level of security they need. As businesses adopt AI, the old-world IT solutions that managed service providers are selling are simply not going to cut it," Nees said. He added that common security requirements have been built into the Modern Managed Services offering from the outset, applying principles including Secure-by-Design, Defence in Depth, and Zero Trust.

CEO Maurice McCarthy, who joined the business earlier this year, linked the company’s recent acquisitions to shifting customer expectations. "The traditional managed services model was built for a different era. Today’s organisations need partners that can help them unlock the value of data and AI while strengthening cybersecurity, managing risk, and continuously evolving their technology environment," McCarthy said, describing the launch as the first of several planned innovations. Virtual IT Group is also developing a dedicated Data & AI Practise and a customer framework called Momentum, which is currently being tested. The company’s Chief Security Officer noted that AI adoption and system integration are rapidly expanding the attack surface for businesses, warning that the gap between threats and in-house security capabilities is growing faster than many organisations realise. Both services are available immediately across Australia and New Zealand.

Industry alliance calls on Australia to back home-grown defence prime contractors

An Australian industry alliance is pressing the federal government to align defence procurement policy with its stated ambition of building sovereign, locally owned prime contractors — warning that structural reform alone will not deliver the outcome.

The Sovereign Australian Prime Alliance (SAPA), which represents seven large Australian prime contractors, has endorsed Defence Industry Minister Pat Conroy’s call for Australian-owned firms capable of operating alongside established global defence groups. But the alliance said rhetoric must be matched by changes to how contracts are awarded. Spokesperson Jamie Morse was direct: "Australian companies cannot become prime contractors if they are never trusted with prime contracts."

Procurement Rules at the Centre

SAPA’s core argument is that the industrial depth already exists across sectors the government considers strategically critical, including:

• Space, satellite technologies and launch systems
• Cyber security products used in sensitive government and defence networks
• Guided weapons, autonomous systems and explosive ordnance
• Shipbuilding, communications and systems integration

The alliance said the main barrier to scaling these businesses into national champions is not a shortage of technical skill, but the absence of procurement frameworks that give Australian-owned firms the opportunity to lead major programs. It is calling for acquisition rules that explicitly distinguish between foreign-owned subsidiaries operating in Australia and genuinely Australian-owned sovereign businesses, and for procurement decisions to account for broader economic effects such as local employment, domestic supply chains and profit retention within Australia.

Capital and the Defence Delivery Agency

SAPA also addressed the question of investment capital, welcoming government discussion about industry consolidation and the potential role of private equity and venture capital. However, Morse said finance alone would not be the decisive factor. "Investors will back Australian defence companies when they can see a credible pathway to growth," he said, adding that the pathway "ultimately comes from government procurement decisions."

The alliance described the planned Defence Delivery Agency as the most significant overhaul of defence acquisition in decades, but said its success should be judged on more than project delivery speed. It argued the agency’s true measure would be whether Australia emerges with a larger cohort of Australian-owned prime contractors. SAPA cited independent economic analysis commissioned from DeltaPearl Partners, which it said found greater domestic benefit from purchasing through Australian-owned suppliers. The alliance drew a parallel with earlier industrial policy that supported the automotive sector, arguing that defence, space, cyber security and advanced manufacturing now present a comparable nation-building opportunity.

Australian businesses underestimate cyberattack recovery time, new report warns

Australian organisations have poured significant resources into cyber defences, yet a critical blind spot persists at board level: how long would it realistically take to recover if those defences were breached?

New findings from Commvault’s State of Data Resilience ANZ 2026 report expose a persistent gap between executive expectations and operational reality. While business leaders increasingly expect systems to return to operation within days of a cyber incident, recovery in practice often takes weeks. The report identifies ransomware attacks, cloud outages, supply chain incidents and operational disruptions as now considered an inevitability rather than a possibility for most organisations.

Complexity Driving the Recovery Gap

The scale of the challenge is compounded by rapidly expanding technology environments. According to the report, data estates across Australia grew by 30 percent over the past year alone, with multi-cloud environments now representing the dominant infrastructure model for many organisations. Each additional layer — spanning SaaS applications, on-premises infrastructure, data lakes, AI workloads and machine identities — introduces new dependencies that must be restored, validated and secured before normal operations can resume.

The regulatory environment is also shifting. APRA’s CPS 230 Operational Risk Management standard now requires entities to identify critical business services, establish tolerance levels for disruption and demonstrate their ability to continue operating during severe incidents. Alongside CPS 234, which requires organisations to protect critical information assets against evolving threats, these regulations place the responsibility for resilience on individuals within organisations, not just the company as a whole.

One of the report’s more striking findings centres on the concept of the Minimum Viable Company — the minimum set of people, processes, applications and data needed to sustain essential operations during a crisis. The research found:

• 63 percent of organisations have defined a minimum viable business capability
• Only 42 percent have mapped out the technology capabilities required to support it
• That gap helps explain why recovery expectations and recovery outcomes remain so far apart

The report’s authors argue that recovery readiness must become a continuous discipline rather than an activity triggered only after an incident occurs — integrating cybersecurity, IT operations and data management around shared recovery objectives, including ongoing testing of recovery plans, validation of backup integrity and rehearsal of recovery scenarios.

Australian CIOs urged to prove AI business value as pilot era ends

Australia’s appetite for artificial intelligence remains strong, but a growing gap between ambition and measurable results is now forcing technology leaders to answer harder questions. According to the Logicalis Global CIO Report 2026 – Australian Results, 95 per cent of Australian organisations increased their appetite for AI over the past 12 months — yet only 34 per cent of CIOs reported their AI strategy was fully aligned with broader business plans or key performance indicators. Just 16 per cent were strongly confident their AI investments had delivered measurable business value.

The Business Problem Has to Come First

Writing for SecurityBrief Australia, Logicalis Australia and New Zealand General Manager Lisa Fortey argues the era of AI experimentation is closing, and CIOs must now define problems, intended outcomes, and conditions for scale before selecting technology. She notes that a successful pilot demonstrates a use case can work in a controlled setting — not that it solves an important business problem, operates sustainably in production, or generates enough value to scale. Fortey also stresses that ownership of outcomes should sit outside the technology team; without that accountability, technical success can be mistaken for genuine business impact.

A Pilot Is Not a Production Model

Scaling AI beyond controlled conditions exposes the organisational foundations that pilots often paper over. Australian CIOs surveyed identified consistent barriers to scaling:

• 93 per cent cited a lack of internal AI skills and talent
• 91 per cent cited regulatory and security compliance challenges, as well as organisational culture
• 89 per cent reported data challenges

Fortey warns that if a use case depends on specialist labour, extensive data remediation, or ongoing manual intervention, that effort must be visible in the business case before a pilot is treated as proof of value. Progress, she argues, should be measured by business outcomes — such as processing time, cost per transaction, forecast accuracy, or resolution time — rather than by licences issued, adoption rates, or project milestones.

The report also highlights the cost of inaction on stopping underperforming initiatives. Technically successful pilots that lack evidence of scalable value can continue absorbing time, talent, and budget indefinitely. Fortey frames selectivity — knowing what not to scale — as a core part of AI execution, allowing resources to concentrate on initiatives with the strongest evidence of value. With 79 per cent of Australian CIOs reporting they lack strong confidence in their ability to scale AI beyond pilots and proofs of concept, the challenge now is building a repeatable process: starting with the business problem, defining the outcome, building for production, measuring results, and deciding what deserves further investment.

AsiaPay rolls out card tokenisation service across 12 Asia-Pacific markets

Hong Kong-based digital payments firm AsiaPay has launched an all-in-one card tokenisation service for merchants across Asia-Pacific, built into its existing PayDollar payment platform. The product went live on 21 September 2026 and is designed to standardise how card payments are processed across seven international card networks and multiple Asian markets simultaneously.

The service replaces sensitive card details with encrypted substitutes during transactions, reducing the need for merchants to store or handle raw payment data. It covers Visa, Mastercard, American Express, UnionPay, JCB, Discover and Diners Club, and can be used for eCommerce purchases, mobile app payments and recurring billing.

Single Interface, Multiple Markets

A key feature is a single application programming interface that allows merchants to integrate once and operate across 12 Asian markets without needing separate acquirer arrangements in each country. The system is acquirer-independent, meaning it can run alongside different acquirers in parallel. The product meets PCI-DSS and PCI-3DS security standards and holds certifications for both the Visa Token Service and Mastercard Digital Enablement Service — accreditations that matter to businesses navigating card network compliance across multiple jurisdictions.

AsiaPay, founded in 2000 and headquartered in Hong Kong, operates 17 offices across Asia-Pacific, including in Australia, Singapore, the Philippines, Malaysia, Thailand, Vietnam, Indonesia, India, Cambodia, Mainland China and Taiwan. The tokenisation product adds to an existing range of payment methods on PayDollar that already includes credit and debit cards, prepaid cards, net banking, digital wallets, buy now pay later options and QR code payments.

Chief Executive Officer Joseph Chan said the launch was a response to growing security pressures alongside rising digital payment volumes. "As digital payments grow, so do security challenges. Our all-in-one tokenisation solution empowers merchants to future-proof their payment systems, enhance trust and boost customer loyalty locally and regionally through a seamless, simplified and standardised checkout payment process," Chan said. Terence Yau added that the solution was intended to meet consumer expectations on both fronts: "Consumers demand both convenience and security. With AsiaPay’s tokenisation solution, businesses can deliver instant, secure payments without compromising on either."

How one GitLab security lead cut AI detection costs to $1 a day

Asia Pacific enterprises are on track to outspend the rest of the world on artificial intelligence, with KPMG’s Global AI Pulse survey placing the region’s average planned investment at US$245 million over the next 12 months — well above the global average of US$186 million. Security accounts for a substantial share of that outlay. IDC forecasts total security spending across the region, excluding Japan, will hit US$39.5 billion in 2026 and US$52.4 billion by 2029, with 39% of enterprises planning to deploy AI or generative AI for threat detection and analysis within the year.

The cost problem, and a design-led fix

Matt Coons, Senior Manager of Security Operations at GitLab, argues that most teams burning through AI budgets are skipping a critical step: deciding which cases should ever reach a model in the first place. Writing in SecurityBrief Australia, Coons says he has brought detection costs down to roughly a dollar a day for trust and safety work by building a structured funnel before any large language model runs. Rules-based, deterministic filters — drawing on signals such as account age, email provider, and behavioural patterns — resolve the obvious cases upfront. Only the subset that clears those filters reaches an LLM.

For cases that do pass initial screening, Coons describes a two-tier model approach. A lightweight model handles the first pass, producing a malicious-or-benign determination at high or low confidence. High-confidence outcomes resolve automatically; low-confidence cases escalate to a more capable model with broader context. His team found only a 1–2% accuracy difference between lightweight and frontier models for their use cases, while frontier models cost roughly five times more per token. Prompt engineering, he notes, is just as consequential as model selection — one prompt written for agentic detections runs over 1,900 words, while some trust and safety prompts are two or three sentences, calibrated to the scope of what the agent must handle.

Coons is clear about where automation stops. Ambiguous cases — such as distinguishing a legitimate security researcher hosting malware samples from a malicious actor doing the same — require contextual judgment that current AI agents cannot reliably provide. Those cases reach a human reviewer. The goal, he writes, is to free engineers to build detection systems and write prompts at scale, rather than click through individual alerts. The stakes for the region are notably high: Asia Pacific remains one of the world’s most attacked regions, and only 7% of APAC enterprises consider themselves highly experienced in the governance and compliance skills these systems demand. Applying frontier models to every alert, Coons concludes, shifts the constraint from headcount to AI spend without closing either gap.

Cyber risk has shifted to software pipelines, and most organisations aren’t looking there

Most organisations are securing the right systems — they are just doing so in the wrong place. That is the central argument put forward by Serkan Cetin, Head of Solutions Engineering for ANZ at Tenable, who says cybersecurity’s next challenge is not about better tools but about understanding where exposure actually sits.

Software supply chains have quietly become part of the attack surface, yet they remain among the least governed environments in most enterprises. Gartner predicted that 45 per cent of organisations would experience an attack on their software supply chain by 2025, and industry research consistently shows incidents in that category have been rising — in some reports exceeding that forecast.

Why Development Pipelines Carry Outsized Risk

Cetin points to the nature of modern development environments as a core part of the problem. These systems are built for speed: automation removes friction, workflows trigger automatically, and code is pushed, tested and deployed in continuous cycles. That velocity is a genuine competitive advantage, but it comes paired with exposure that grows just as fast. Development pipelines frequently operate with elevated permissions and implicit trust — practical decisions made during build phases that can harden into persistent vulnerabilities if governance doesn’t keep pace.

The consequences are not contained to individual organisations. As Cetin notes, a vulnerability inside a development pipeline does not stay put. It moves downstream into the software being built, the businesses using it, and ultimately the customers relying on it — propagating quietly and at scale.

The gap between perceived risk and actual risk is also reaching the boardroom. Boards are receiving more cyber data than ever, but often without the context needed to connect alerts and incidents to core business functions or identify where material exposures genuinely sit. The result, Cetin argues, is a structural mismatch: governance frameworks, reporting layers and security investments are still largely calibrated to where risk used to live, not where it lives now. Closing that gap, he says, will require organisations to ask not just whether their systems are secure, but where risk now resides within the business itself.

Australian engineers switching from Fable 5 to GPT-5.6 over cost and token burn

Engineering teams across Australia are moving away from Anthropic’s Fable 5 and toward OpenAI’s GPT-5.6, according to usage and spending data gathered from approximately 1,000 engineers by AI tool management firm Antiburn.

Token costs driving the shift

Antiburn, which tracks AI coding tool usage and spending directly across engineering teams, says the change accelerated following Fable 5’s relaunch. The firm reports that Fable 5 consumes roughly four times more tokens than Anthropic’s own Sonnet 5 for equivalent work — averaging around 2 million tokens per task compared to approximately 500,000 for Sonnet 5. The share of Fable users hitting five-hour usage limits has also climbed to 20% or more, up from 3% previously.

Antiburn CEO and Co-Founder Dave Slutzkin said the core issue is economic rather than technical. "Anthropic’s Fable 5 launch was a case of the company overpromising and underdelivering. The original version of Fable 5, which many users loved, was very strong, but it was only live for a couple of days. The version they shipped is disappointing by comparison and too expensive for many," Slutzkin said. He added that OpenAI’s 5.6 model "turned out to be at least as good and much cheaper," which he described as a strategic misstep for Anthropic. Slutzkin said Fable was intended to serve as Anthropic’s "pre-IPO cash cow" but has instead been included in subscriptions, draining revenue without generating marginal income.

A narrower role for Fable 5

Other Australian technology executives described a more limited picture, identifying specific tasks where Fable 5 still holds an edge while noting that most routine engineering work can be handled more cheaply elsewhere. Jordi Hermoso, Co-Founder and Chief Technical Officer at Doccy & Medlo, said his team has used Fable 5 primarily for reviewing academic cybersecurity research and for architectural analysis across large codebases. He said he surveyed his engineering team and found that 80% had not identified a compelling use case for the model and had stopped using it, while the remaining 20% reserved it for rare, highly specialised tasks. "For a few specialised jobs, Fable 5 has a real lead. The problem is how few of those jobs there are," Hermoso said. He also noted that open-source distillation and competition among labs are likely to narrow Fable 5’s advantages over time, and described his team’s approach as deliberately model-agnostic.

Joe Gibbs, Lead Technology Engineer at Pressto AI, said businesses will increasingly scrutinise return on investment as model pricing becomes harder to absorb. He described Fable 5 as worthwhile only for the most demanding tasks, and noted that testing the model through API billing proved costly. The emerging picture across the three organisations is one where engineering teams are moving toward a mixed-model approach — using premium tools selectively while defaulting to lower-cost alternatives for everyday work.