Australia has announced the creation of a Cyber Attack Review Board , a move aimed at strengthening the country’s ability to respond to and learn from major cyberattacks. The initiative places Australia among a small group of jurisdictions worldwide that have established independent review mechanisms to assess significant cyber incidents and improve long-term resilience.
See also: Australia's social media ban faces questions
The Cyber Attack Review Board will conduct non-attribution reviews following significant cybersecurity events affecting both government and private organisations. Rather than assigning blame, the board's mandate is to identify systemic gaps and produce actionable recommendations to improve how Australia prevents, detects and responds to cyber threats.
Established under the Cybersecurity Act 2024, the council is a central element of Australia’s Cybersecurity Strategy 2023-2030. The broader goal is to position Australia as one of the most cyber-secure countries by the end of the decade, supported by resilient infrastructure, prepared communities and stronger industry practices.
Officials said the Cyber Attack Review Board will focus on drawing lessons from the incidents and translating them into practical steps that can reduce the likelihood and impact of future attacks.
The government has appointed a panel of senior cybersecurity and industry leaders to the Cyber Attack Review Board. The board will be chaired by Narelle Devine, Global Director of Information Security at Telstra.
See also: Australia: Meta, TikTok, Snapchat and YouTube fail to comply with social media ban for children
Other members include Debi Ashenden from the University of New South Wales, Valeska Bloch from Allens, Jessica Burleigh from Boeing Australia, Darren Kane from NBN Co, Berin Lautenbach from Toll Group and Nathan Morelli from SA Power Networks.
The team brings experience in cybersecurity operations, legal frameworks, governance, national security and critical infrastructure. Authorities said this mix was designed to ensure independent, credible advice that reflects both technical and political realities.
Australia's Cybersecurity Minister Tony Burkesaid the Cyber Attack Review Board would play a key role in ensuring continuous improvement in the national defence against cyber attacks. He added that the board would review significant cybersecurity incidents, develop findings and provide recommendations that can be applied across sectors.
The blameless model aims to encourage collaboration from affected organizations, while also generating information that can benefit the broader ecosystem.
In the United States, a cybersecurity review board has already examined several incidents, including a high-profile breach involving Microsoft. That report highlighted avoidable security failures and called for cultural and leadership changes within the company, prompting CEO Satya Nadella to prioritize security across all operations.
See also: Apple announces new partnership with Sydney Opera House
However, previous US reviews, such as those into the Log4j vulnerability and the Lapsus $ group , have been criticized for lacking focus and impact. Analysts noted that broader, less targeted reviews made it harder to hold people accountable or achieve meaningful change.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
