
<LinkedInPost url="https://www.linkedin.com/feed/update/urn:li:activity:7496031795126231040/" title="The Philippines offshoring industry is still growing" height="640" />

If AI were about to do all the work, the offshoring industry would be the first place you would see it. Whole business models built on doing repeatable information work at a lower hourly rate — exactly the work AI is supposed to eat.

The Philippines' offshoring industry is still growing.

That is worth sitting with rather than arguing with, because it tells you something more useful than any vendor roadmap will.

## Customers do not want to talk to your AI

Every customer conversation I have had on this lands in the same place, and it lands there fast.

They do not want AI at the forefront talking to their customers.

The reason is not nostalgia. It is risk. AI is not certain. It can be wrong confidently, it can be talked into things, and it can be deliberately played with by someone who knows what they are doing. When the thing that is uncertain is sitting in front of your customer wearing your brand, every mistake is a public one.

That risk calculation is the whole answer. In an internal process, a wrong answer costs you a rework. In a customer conversation, a wrong answer costs you the customer — and occasionally, if the subject was money or health or a commitment you now have to honour, it costs you a lot more than that.

So the work that stays human is the work where being wrong in public is expensive. Which is most customer-facing work.

## A small proof from last week

I was after some SEO information. I did what everyone does now — I went to AI first, and I spent hours going back and forth on it.

Then I spent five minutes with someone who actually does SEO for a living, and the five minutes beat the hours.

Not because the AI was stupid. Because the expert knew which question I should have been asking, and knew it immediately. That is the thing that does not show up in any benchmark: an expert compresses the problem before answering it. AI answers the question you asked.

It is still about speed, and on that job the human was faster. I keep having versions of this experience and I think a lot of people are quietly having them too, and not saying so because the room expects them to be enthusiastic.

## So where does AI actually pay?

Internally. Almost entirely internally.

AI is making real optimisations right now, and they are nearly all in the part of your business the customer never sees — automating steps of your own process, moving information between your own systems, doing the first pass of work a person then checks. That is where the maths works, because a wrong answer there is caught before it leaves the building.

The big wins in customer service, marketing and software development are still going to experts. Not because AI cannot contribute to those — it contributes to all three inside our own business — but because the judgement at the sharp end is still the thing being bought.

## What to do with that

If you are trying to work out where to point AI in your business, invert the usual instinct.

Do not start with the customer-facing thing, even though it is the most visible and makes the best slide. Start with the internal process nobody outside the business will ever see. Get the wins there, build the muscle for documenting process and checking output, and let the customer-facing question wait until you have earned an opinion on it.

The offshoring industry growing through the AI boom is not a hole in the story. It is the story: humans are still the answer where certainty and trust are the product, and AI is the answer where speed and volume are.

If you want help working out which of your processes is which, [come and have a chat with us](/contact) — or [get this kind of thinking weekly](/newsletter).



I thought that, since it was a Tuesday afternoon and I had nothing better to do, I would look at writing an article about my thoughts on the Australian Government.

No, not about whether I like the government or not. I wanted to look at the document they are using as their standard for building with AI.

Released in June, the policy update comes with the exciting and engaging title *Agentic AI addendum to the AI technical standard for Australian Government*. From now on, we can just call it "the addendum".

The first thing to consider when thinking about AI is how quickly the industry has changed.

In 2026 alone, there have been three major switch-ups: the emergence of agent harnesses and frameworks such as OpenClaw and its more attractive cousin, Hermes; the release of Fable 5, and its restricted twin Mythos 5 — the same model with the cyber safeguards taken off, handed only to the people the vendor decided had a good enough reason; and the emergence of cheaper and smarter Chinese models such as Kimi K3.

Among all of these changes, the government has decided to create a framework for how these systems should be built.

## Why now?

The adoption of AI systems, especially generative AI, has accelerated at an unprecedented pace.

Stanford's 2025 AI Index reports that organisational AI use rose from 55 per cent to 78 per cent in just one year. Eurostat has EU businesses with ten or more staff going from 13.5 per cent to 20.0 per cent between 2024 and 2025. Six and a half points in a year.

There had to be some kind of technical standard in place. I am not arguing with the premise of the standard. I will, however, argue with the way parts of it have been written.

## The bad: the definition of an AI agent

The technical standard spends a lot of time explaining what an AI agent is. The problem is that the definition it gives could easily apply to many software systems that are not agents.

The addendum defines an AI agent as:

> A software-based system that perceives inputs from its environment, maintains or updates an internal state, and selects and executes actions using APIs or other tools to achieve defined goals within assigned permissions and constraints. It may plan, learn from feedback when permitted, and self-monitor its behaviour to improve performance over time, while operating within defined governance, oversight, and control mechanisms.

Let's break down that first sentence.

<DefinitionAutopsy />

Now, the second sentence is where the interesting words live. Plan. Learn from feedback. Self-monitor.

Except every one of them is sitting behind the word *may*.

Optional. So the part of the definition that separates an agent from a thermostat is the part you are allowed to skip.

So, without sitting in the cheap seats just heckling — the addendum does say the thing I want. It says it about four hundred words later, in the background section, in a list of common methods and technologies.

Put it in the definition. The definition is the line people will paste into a procurement document.

## The "Control Tower"

Now that we have got that out of the way, there is another term in the addendum that even someone like me, who has been building these systems since ChatGPT was released, had not heard before.

They call it a "Control Tower".

The addendum defines it as:

> A centralised architectural governance layer that monitors, manages, and ensures secure agentic AI operations. A control tower can be used by business, system owners, and governance teams to monitor what agents are running, risks, security, costs, and compliance with regulations.

The idea itself is sensible.

In software engineering, we already have something similar. It is usually called observability. Production software needs monitoring because, when something goes wrong, you need to know what happened and who or what was responsible.

A Control Tower is broader than that. It is not just about whether the system is working. It also covers risk, security, cost and compliance.

For an AI system, that means capturing every step of a run. That happens to be the same list you need for an audit trail, so rather than write it out twice, it is further down.

So, while I think "Control Tower" is a slightly silly name, the idea behind it makes sense.

## Graceful recovery needs more detail

There is also a lot of discussion about graceful recovery in the addendum.

That is all well and good, but there does not seem to be much practical guidance around what graceful recovery should actually look like.

If a system fails, it has about five options. The addendum does not tell you how to choose between them.

<RecoveryMatrix />

Pick one before you go live. The default is worse than all five: the agent fails quietly, and your team finds out from the client.

Maybe I am nitpicking, but parts of the recovery guidance land at roughly the altitude of *make sure the system does not fail*.

That is a reasonable goal. It does not explain what an organisation should actually do when the system does fail.

## The good: use agents where they make sense

The addendum talks about narrowing the scope of where AI is allowed to make decisions. I think this is a good practice.

Why use an agent where it will "probably work" when you can use programming to create rules so it will "definitely work"?

Ultimately, an LLM is still a probability engine. It predicts the most likely response based on the information it has been given. That means its output can vary, and that variation creates risk in a business environment.

Ninety-seven per cent accurate is a great demo and a terrible referral process. The three per cent is a patient record with someone else's name on it, and you will not hear about it from the agent.

Traditional software can still have bugs, of course, but it is generally more predictable. If the same rules and inputs are used, you normally expect the same result.

Here is the neat part, though: you can use AI to build these traditional systems anyway. Most of what we ship is exactly that. An agent did the building, and what runs in production is boring, deterministic code that does the same thing every Tuesday.

So, hot tip: do not pick an agent when a programmed system can do the job, particularly if consistency is important.

There are also situations where a little randomness is not a major problem. Content generation is a good example. You are often tweaking the system anyway, and if it gets something wrong a small percentage of the time, you can review the result and ask it to try again.

That approach would not be suitable for every task. You probably do not want an AI agent randomly deciding how much money to pay an employee or whether a customer should receive access to an important system.

## Audit trails are essential

Under the silly name, the addendum also mentions that audit trails are essential.

I agree with that.

After ten years of building production software, I have found that it is rarely the obvious bugs that cause the biggest problems. It is usually the subtle ones.

Imagine that you are building a lead-finding agent. The agent finds a genuine sales lead but gets the company name wrong. That mistake may be difficult to notice among the hundreds of messages and records the system has created.

Swap the industry and the shape is identical. An intake agent that summarises a referral perfectly and files it against the wrong patient looks like a success in the log and a problem in the audit.

So this is what you want captured for every single run:

<AgentTrace />

In other words, it shows you the crime scene in detail.

That may sound dramatic, but when something goes wrong in a large system, you need evidence. Without an audit trail, you are left trying to work out what happened from the end result.

## Verification loops

The addendum also talks about feedback and verification loops that allow systems to improve over time.

This is becoming a necessity rather than a nice-to-have for agentic systems.

A verification loop can be as simple as telling the system:

> Make sure you verify "X" by doing "Y".

For example, an agent could be told to confirm a company name against a trusted database before sending a message.

However, checking a result and improving a system are not exactly the same thing. A verification loop checks whether the current result is correct. A feedback loop records what happened and uses that information to improve the system later.

That improvement might involve changing the prompt, adding a new rule, updating a tool or replacing the model.

None of it is exotic. It is refusing to let a machine act on something it has not checked.

## Final thoughts

It is probably a little early for the government to create a complete standard for building AI systems. Many people are still figuring out what building with AI looks like and what capabilities these systems can provide.

However, the addendum does include some sensible software practices that businesses should start using now:

- Keep AI decisions within a narrow scope.
- Use programmed rules where consistency matters.
- Monitor performance, cost and risk.
- Keep detailed audit trails.
- Verify important information before taking action.
- Decide in advance what a failure should do — retry, fall back, hand it to a human, or stop and say so.

So, while I think the addendum's definition of an AI agent is too broad and its advice on graceful recovery needs more detail, there are some useful ideas in it.

I will be using the name "Control Tower" in place of observability from now on.

Sorry, government. That one is sticking.

---

We design and build agentic systems for Western Australian businesses, and everything in that trace diagram is captured in ours. Not because a standard told us to, but because the alternative is guessing.

If you cannot answer *which model did this, what it was given, and who signed off* for a run that went wrong last Tuesday, you do not have a Control Tower. You have a hope.

[Book a 15-minute call](https://tidycal.com/mnp06p3/15-minute-meeting) and I will tell you which of the six you are missing, even if you never work with us.

**Sources cited:** Digital Transformation Agency, *Agentic AI addendum to the AI technical standard* — [digital.gov.au/policy/ai/agentic-ai-addendum](https://www.digital.gov.au/policy/ai/agentic-ai-addendum). The AI agent definition and the passage on language models are quoted from its *Background* page; the Control Tower definition is Criterion AGT.8.2 in its Monitor lifecycle statements. Stanford HAI, *AI Index Report 2025* (organisational AI use, 55 to 78 per cent). Eurostat, *Use of artificial intelligence in enterprises*, released 11 December 2025 (EU enterprises with 10 or more employees: 13.5 per cent in 2024 to 20.0 per cent in 2025). Anthropic, *Claude Fable 5 and Claude Mythos 5*.



<LinkedInPost url="https://www.linkedin.com/posts/samuel-wyndham-172416115_ai-productivity-australianbusiness-ugcPost-7500093422209277952-JWij/" title="I threw out my AI tools and went back to a journal and a pen" height="700" />

I run an AI company. I threw out my AI productivity tools and went back to a journal and a pen.

Not because AI does not work. It works. That is not the problem.

The problem is that my memory is limited, and AI made that worse.

## What was actually going wrong

Every AI conversation has to be untangled afterwards to work out whether any of it was useful.

Where does the train of thought start? Where does it end? Somewhere in a forty-turn conversation there were three good sentences and a decision I actually made, and they are now buried in a transcript that reads like two people thinking out loud — because that is what it is.

So the work does not disappear. It moves. Instead of thinking the thing through, I think it through *with* something, and then I have a second job: reading back what we said and deciding what counted.

And there is the plainer cost. **Time spent conversing with AI is time not spent doing.** A conversation feels like progress in a way that staring at a hard problem does not. That feeling is the trap.

## What went on paper

Four things, and none of them are clever.

**A to-do list, to get everything out of my head.** Not to organise it. Just to stop carrying it. The value is the emptying, not the list.

**Cross off what is not mine to do.** This is the step that does the work. Half of what lands on the page belongs to someone else, or to nobody, or to a version of the business from six months ago. What is left after the crossing-off is the actual priority list, and it is always shorter than the original and always more uncomfortable.

**A daily log of my conversations.** Written by me, so the context ends up in my memory rather than in the AI's. This is the one that changed the most. When the context lives in a tool, you have to go and get it, and going and getting it costs more than remembering it would have.

**Brainstorm on paper before I prompt.** So that when I do go to the AI, we need fewer rounds to get anywhere. A prompt written after ten minutes of thinking beats twenty minutes of conversation trying to think.

## The handwriting part

There is evidence for the handwriting specifically, and it is more interesting than the usual productivity folklore.

A 2024 study in *Frontiers in Psychology* by Van der Weel and Van der Meer put high-density EEG nets on 36 university students and had them either write words by hand or type them. Handwriting produced far more widespread connectivity across the brain — the theta and alpha patterns between parietal and central regions that are associated with memory formation and encoding new information. Typing did not.

Two honest caveats. The participants wrote with a digital pen on a touchscreen rather than pen on paper, though the researchers expect the result to hold for real paper. And it is a study about writing single words in a lab, not about whether journalling makes you a better operator.

But it points the same way as the experience: the writing is not a record of the thinking. **The writing is some of the thinking.** Outsource the writing and you have outsourced a share of the thought that would have come with it.

## More AI do, less AI think

This is the line I keep coming back to, and it is the whole argument.

If you ask AI to do your thinking, you get a worse result than if you already hold the mental model and hand it one very good instruction.

It is the same shape as the [checking problem that sinks most enterprise AI projects](/blog/why-95-percent-of-enterprise-ai-fails). AI takes away the thinking and hands back the verification, and verification is harder when you never built the model in the first place. You cannot review an answer to a question you did not really understand. You can only decide whether it sounds right, which is exactly the failure mode these systems are best at producing.

Hold the model yourself. Then hand over the doing.

That is not a retreat from AI. Everything I described earlier about [what AI actually took out of our cost base](/blog/three-ways-i-cut-costs-with-ai) still stands, and none of it has been switched off. The tools are doing more of the work than they were a year ago. What changed is where the thinking happens, and who is holding it.

The journal costs about four dollars. It is the cheapest thing in the stack by a wide margin.

If you want to talk about where AI should be doing and where it should stay out of the way, [come and have a chat with us](/contact) — or [get this kind of thinking weekly](/newsletter).



We're excited to announce that Biz365 has officially partnered with the **Australian Signals Directorate (ASD)** as a registered **Cyber Security Business Partner**.

For those unfamiliar, the ASD is Australia's leading authority on cyber security and signals intelligence. Through their **Australian Cyber Security Centre (ACSC)**, they provide critical guidance, threat intelligence, and advisory services to help Australian organisations defend against the ever-growing landscape of cyber threats.

## What does this mean for our clients?

As an ASD Cyber Security Business Partner, Biz365 now receives:

- **Monthly newsletters** containing the latest news, publications, and security advisories direct from the ASD
- **ACSC Alert Service** subscription, giving us early warnings on emerging threats and vulnerabilities
- **Targeted guidance** and relevant cyber security information tailored to businesses like ours—and yours
- **Invitations to events** presented by the ACSC, keeping us at the forefront of cyber security developments in Australia

This means we're not just reacting to threats—we're staying ahead of them. The intelligence and resources we receive through this partnership flow directly into how we protect and advise our clients.

## Why this matters

Cyber attacks on Australian businesses are on the rise, and staying informed is half the battle. By partnering directly with the ASD, we have access to the same threat intelligence and guidance that protects Australia's critical infrastructure. We're bringing that level of protection to small and medium businesses right here in Western Australia.

This partnership complements our existing work implementing the **Essential Eight** framework and reinforces our position as a trusted partner for businesses that take their cyber security seriously.

## Staying protected

We encourage all of our clients to take cyber security seriously. If you'd like to learn more about how this partnership benefits your business, or if you want to discuss your current security posture, we'd love to chat.

For more information on the ASD's Cyber Security Partnership Program, visit [cyber.gov.au](https://www.cyber.gov.au/partnershipprogram).

[Book A Meeting](https://tidycal.com/mnp06p3/15-minute-meeting)



Your business has no insurance, your premise has no locks, your banking passwords are written on every sticky note you can get your hands on. You decided today that you are going to go to the casino and put it all on black.

The risk appetite of someone who does this is huge—and you might be thinking to yourself, how can someone live with so much risk? Well, many businesses here in Western Australia are in the same boat. There's been an alarming increase in cyber attacks on WA businesses over the last 5 years, with ransomware, data breaches, and credential theft leading to major disruptions—some companies failing to meet payroll or even closing up shop entirely.

It's a huge risk, and while many businesses know they should keep backups, there's often a lack of awareness about what actually works against today's threats—from kids using ChatGPT to whip up malicious scripts, right through to professional cybercriminals who make a living ransoming data and extorting payments.

But here's the good news: you don't have to figure it out alone. The Australian Signals Directorate (ASD), in partnership with the government, has released the **Essential Eight** framework—a straightforward, prioritized set of mitigation strategies that dramatically reduces your exposure to the most common attack techniques.

The **Essential Eight** gets businesses protected fast and effectively, and the neat part? Biz365 is already rolling out many of these controls in the background for our clients, handling the heavy lifting so you can focus on running your business.

That said, some of the most impactful controls—like **application control** (which blocks unauthorized software and executables from running) and **disabling or restricting Microsoft Office macros** (to stop hidden malicious code in documents)—can feel disruptive at first. They might block certain legacy processes or require whitelisting approved apps/macros, which is exactly why we want to work closely with you.

We'd love to jump on a quick call to discuss your specific setup, understand any potential friction points, and help tailor these controls so they protect you without grinding operations to a halt. Many clients find that once implemented properly (with our guidance), these measures become seamless—and they sleep a lot better knowing they're aligned with ASD's recommended baseline.

Ready to chat about getting these protections in place? Let's schedule a time—your peace of mind (and your business's future) is worth it.

[Book A Meeting](https://tidycal.com/mnp06p3/15-minute-meeting)



How important is securing your personal information and data?

At Biz 365, it’s one of our top priorities to ensure that our staff and clients are protected from data theft – so we think it’s pretty important!

We have the right to our own data and information being safe and secure. That being said, hackers and businesses often have other ideas, stealing data, to be manipulated or used to take advantage of us.

Data collection, particularly by other countries can be incredibly unsafe from an identity and security perspective, so we ensure that we shut-off access from a number of countries to prevent our data from falling into the wrong hands and being used for harm.

We pride ourselves on ensuring our staff and clients are able to work and live with the security of knowing that their private data is safe.


<YoutubeVideo url="https://www.youtube.com/watch?v=H8Q2P4szXG0" title="How to Build a Really Bad AI Agent" />

Here is what you want to do if you want to make a really bad AI agent for yourself. I am not being entirely sarcastic — I watch businesses do every one of these.

## Step one: choose something you hardly ever do

Preparing your tax. Auditing the business for a new compliance regime. Pick one of those and just go ahead and point an agent at it.

Whatever you do, do not choose anything repeatable. Do not choose anything that happens in the normal running of your business.

## Step two: make sure there is no process document

The knowledge should live in one person's head. You want to be talking to Bob from the department so you can extract what he knows and feed it into the agent as you go.

## Step three: do not write down your thinking

This matters most on problems of classification. Just let the AI figure out what "good" means.

Say you are building a marketing agent. Ask it to work out the best market for you to enter, and give it no information about your business or what you actually do.

## Step four: choose a process with no margin for error

This might be getting the AI to control the brakes on your car. It might mean opening up all of your banks to the agent so it can control your business finances.

## Step five: let it run by itself

No human looking over it. Then congratulations — go take the day off, make yourself a nice cuppa, or knock off and go down to the pub.

Just kidding. Please do not do this.

Those five things are a recipe for ruining your experience with AI. Go down that route and you will transform your business into one that is no longer operating.

## Now invert all five

**Take a process that is repeatable.** Something that runs in the normal course of business, not once a year.

**Make sure the process is already documented.** If it is not, that is the real first job — and if you do not do it, people like me end up doing it for you anyway.

**Write down your thinking behind the process.** This is the step almost everybody skips. If you have a classification problem — say you are working out which leads are worth pursuing — you need to understand what actually makes a good lead. Is it someone already in your industry? Someone you have connected with in the past?

Include your exact reasoning, so that when the AI thinks about these things it knows which thoughts to pick up on and what it is supposed to be doing. That reasoning is usually the part missing from documentation, and putting it in is an easy way to make your agents ten times better at the work.

**Leave a little margin for error.** AI is never going to get everything one hundred per cent right. There is a cycle involved in perfecting what you are asking, and the thinking step above is what powers that cycle. But you have to start with a process that can tolerate a wrong answer on the way through.

**Keep a human over the output.** Have someone check the result — even if an agent does the first pass of that checking — to make sure the output is right.

Skip those steps and you will, boom, have a bad AI agent.

## What this means for choosing an AI partner

When you are looking at AI partners, this is the work you want to be doing with them. You do not want to just be hands off. That is going to be being a bad business owner.

If you are struggling with where an agent actually fits, [come and have a chat with us](/contact). We start with people and process before we go anywhere near the technology.



Sometimes when you are in a toxic relationship, after trying to reconcile over and over again without any progress you just have to end it.

That's kinda like what is happening right now on the internet. There are toxic countries that are constantly trying to steal your credentials, steal information, steal money and generally make your day infinitly worse.

Setting up a country block for your business is kinda like blocking that toxic friend who drains your energy and causes unnecessary drama. Just like cutting ties with them creates space for healthier relationships, blocking a country helps protect your business from negative influences and distractions, allowing you to focus on growth and positivity.

Think about it - would you keep letting someone into your house if they kept trying to steal your stuff? Of course not! The same goes for your digital space. These malicious actors from certain countries are like unwanted houseguests who keep showing up with bad intentions.

According to [IT Pro](https://www.itpro.com/security/state-sponsored-cyber-crime-is-officially-out-of-control), state-sponsored cybercrime has reached unprecedented levels, making it more important than ever to protect your business from malicious actors. We're talking about sophisticated attacks that can drain bank accounts, steal sensitive customer data, or even hold your entire system hostage with ransomware.

The scary part? These aren't just random hackers in basements anymore. Many of these attacks are state-sponsored, meaning they have serious resources and technology behind them. It's like dealing with a toxic ex who suddenly got super rich and hired private investigators to mess with you - not fun!

But here's the good news - you can take control. Just like you'd change the locks on your doors to keep out unwanted visitors, you can "change the locks" on your digital doors too. Country blocking is one of the most effective ways to do this.

If you are with Biz we have already done the work for you stepping in like a good friend and telling the toxic ones to get lost - only FVEY countries Canada, Aus, NZ, UK and US are on your allowed lists. Think of us as your digital bouncer, keeping the troublemakers out while letting the good guys in.

Remember, in both relationships and cybersecurity, sometimes the best defense is simply not letting the toxic elements anywhere near you in the first place. Stay safe out there!


Have you heard of Starlink?

We have recently began testing this high-speed, low-orbit satellite technology, with plans to potentially bring this into our services for those in regional WA.

Starlink’s technology enables people and businesses to access great internet in isolated locations, gaining opportunities for education, health services and essential communications in areas that were once completely blocked-off.

As we’re always looking to provide the best service and value for our clients, we are constantly growing our service options, in order to ensure the best quality. Starlink is a great example of this, and we are excited to be able to start offering this as an option for you!


Having a slow computer can inhibit your productivity and be an all-around frustration, no one wants that, especially when it impacts your business’ operations.

So, here are 5 reasons why your computer might be slow – keep them in mind and do your best to avoid them.

Full Disc
Storage problems can slow your computer down a huge amount. To avoid this, remove old files and documents by emptying your bin and removing old downloads. Also, look at reducing storage issues by frequently moving files onto an external hard drive or the cloud.

2. Too many things open!
Be sure to close down any apps, files or software that aren’t in use. The clearer your screen, often the better.

3. Running Powerful Software
This often occurs with older computers; new software may be too large and require to much memory for your computer to run comfortably. So, make sure you always have up to date tech and software that allows you to do everything you need.

4. Viruses
Viruses can dramatically slow down your computer and reduce performance. Often, this isn’t the reason behind a slow computer, but it is important to check frequently. Also do your best to avoid clicking on pop ups or unreliable links.

5. Anti-Virus Software
Whilst being great for preventing viruses from attacking your computer, anti-virus software can decrease your computer’s performance. So, make sure to find one that’s right for your computer.

Keeping these ideas in the back of your mind will save you time, frustration and ultimately money!

Looking for more tips to ensure that your computers and IT systems are working at their best? Make sure to jump onboard and follow along.

And as always, if you have any questions, don’t hesitate to send us a message!



Most IT support happens down a phone line. A lot of ours happens on a red dirt road.

We look after [health clinics in the Pilbara](/solutions/remote-clinic-connectivity). To do that, we drive there. Here is what the job really looks like.

## What is remote IT support?

Remote IT support means looking after computers, internet and phones at places far from a city. Most faults get fixed online. Some need a person on site.

The hard part is not the computers. It is the distance. You cannot pop out at lunchtime to swap a cable when the site is a day away.

## We drive there

Some of these clinics are hundreds of kilometres apart. The last stretch is dirt. A trip can take two days each way.

So we plan it. We pack spare parts before we leave. We carry two spare tyres. We fix things in batches, because the next visit might be months away.

<ArticleImage src="/photos/tyre-change.webp" caption="Flat tyre on the way to a clinic. Part of the job." />

Flat tyres are normal out here. So is red dust in everything. That is the work.

## We set up Starlink

Satellite internet changed remote health care. Clinics that had almost nothing can now run their systems and do video calls with doctors.

We [install Starlink at clinics and look after it](/solutions/remote-clinic-connectivity). Across four clinics we support in the East Pilbara, the internet has been up about 99% of the time since we put it in.

But we never rely on one connection. We always add a backup line. If the satellite drops out, the clinic keeps working. It just runs slower.

That backup matters more than the 99%. A clinic that still works on a bad day beats a link that is usually fine.

## We clean the red dust off

Red dust gets into everything. It clogs fans. It coats screens. It kills computers slowly, and nobody notices until one stops.

So when we visit, we clean. We open machines up and blow the dust out. We check cables. We look at the things nobody logs a ticket for.

It is not glamorous. It is most of the reason the gear lasts.

## We teach people how to use it

Good systems are no help if nobody knows how to use them.

We sit with staff and show them. How to log in. What to do when the internet drops. How to tell if it is [the printer or the computer](/solutions/communicare-printing). How to spot a [dodgy email](/solutions/essential-8-health). Who to ring, and when.

We also train one person at each site to be our hands. If something has to be touched, they can do it while we watch on a video call. We pay for their time and their training. That is real work, and it should not be free.

## Who we do this for

Puntukurnu Aboriginal Medical Service runs remote clinics in the East Pilbara, out of Newman. We set up their Starlink and we look after it.

They run the [health service](/industries/health). The community owns it. We look after the tech it runs on. That is the line, and we like to be clear about it.

## Why we do it

The drive is long. The work is dusty. We keep going back anyway.

We like it out there. You see things you see nowhere else. We have met camels living in people's houses as pets. You pull over for stock on the road and end up talking for half an hour.

The best part is the people. You sit down, have a yarn, and the job gets done properly. You find out what the clinic actually needs. That never comes through on a support ticket.

It is good work. You can see who it helps.

## What to ask any IT provider

If you run a site that is hard to reach, ask these:

- What happens when the internet drops? Is there a backup?
- How much can you fix without driving out here?
- How often will you visit?
- Who cleans and checks the gear?
- Will you train our staff?

If the answers are vague, keep looking.

## Talk to us

We work across the Pilbara, Kimberley, Goldfields and Mid West. We also work in the Northern Territory. And Perth, of course.

[Tell us](/contact) where your sites are, what internet you have now, and what breaks most often. We will give you a straight answer. That includes telling you when satellite is the wrong tool.



With growing cybersecurity issues surrounding hacking and phishing, password security has never been more important.

Here are 6 ways to ensure your passwords stay safe and protected.

1. Never, ever give out your password via e-mail or phone. We recommend having a company policy that ensures that IT never ask for your employees’ passwords via these communication methods, to help minimise your passwords being compromised by people pretending to be from your company.

2. Don’t use passwords tied to something on your desk. if you have a picture of your dog on your desk, don’t use their name as the password. The convenience of incrementing passwords can make it simple for hackers to guess your passwords and any variations you may have.

3. Passphrases are GREAT. They are much more difficult to crack and much more simple for us to remember – it’s a win-win situation.

4. Don’t leave your computer unlocked. Attackers can easily gain control of your computer (and a whole system) if it remains unlocked. There are 2 simple ways to lock your Windows computer without closing any applications. Hit Ctrl+alt+del and click Lock this computer, or hit the “Windows button”+L; the Windows button is that button between Ctrl and Alt. Then all you have to do is open your computer and enter your password/phrase!

5. If you need to write down a password, keep it on you at all times. We recommend making sure that you don’t have random notes lying around containing your passwords – which can be easily lost or stolen.

6. Do not use your company password in your other networks. As it’s difficult to guarantee the safety of a password in another location, we always recommend keeping these separate.

Keep your passwords safe and secure and you’ll be adding an extra barrier of protection to both personal and company accounts.


<LinkedInPost url="https://www.linkedin.com/posts/samuel-wyndham-172416115_racgp-generalpractice-ai-ugcPost-7500357462835744768-xjNg/" title="The RACGP's new standards include a criterion on AI" height="700" />

The RACGP's 6th edition Standards for general practices are out, and for the first time artificial intelligence is named in them.

If you use an AI scribe, an AI triage tool, or anything that touches patient information and produces an answer, this is now part of what your practice is expected to have thought about.

**One thing on timing before anything else.** At the time of writing, accreditation assessments are still being run against the 5th edition, and no transition date has been published. That is a gift, not a reprieve. You have a window to get this in order before it is being assessed rather than after. Confirm the current position with your accrediting body rather than taking my word for it — this is exactly the kind of detail that moves.

Here is what the AI criteria actually ask, in plain English.

## Informed consent and transparency

Tell patients how AI tools use their health information. Not buried in a form nobody reads — actually tell them.

The part practices underestimate is what happens when a patient says no. They can withdraw at any time, and when they do, you have to:

- **document it**, so it is visible to whoever sees them next
- **stop using AI in their care**, unless it is clinically necessary and they have re-authorised it
- **offer an alternative pathway**, which means the alternative has to exist before you need it
- **explain the implications respectfully** — what changes for them, without making it sound like a punishment for asking

That last one matters more than it looks. A patient who withdraws consent and gets treated as a nuisance tells other patients.

## Privacy Act 1988 and the Australian Privacy Principles

This is the one that catches practices out, and it is worth being blunt about it: a lot of tools sitting on desks in Australian practices right now do not clear this bar.

The usual failure is data residency. The information does not stay in Australia. It goes to a server somewhere else, under someone else's law, and in a lot of cases nobody in the practice has ever checked.

Grammarly is the example I use, because it is so ordinary that it never gets audited. It is a US company running on US infrastructure. Paste a patient's history into it to tidy up the wording, and that history has left the country. Nobody thinks of it as a clinical system. That is exactly why it is a problem.

The question to ask about every tool is the same: **where does the data physically live, and who can reach it?**

## Accountability

Governance and risk management, which in practice means: someone's name is against this.

Accountability always sits with a person, never with the tool. "The AI suggested it" has never been a defence and it is not becoming one. If a decision was made with AI in the loop, a clinician owns that decision.

## Third parties

Patients have to be informed about external providers handling their data.

Most AI tools are a stack, not a product. The scribe you bought may run on a model hosted by someone else, in an environment run by a third party again. You cannot inform patients about a chain you have not mapped, so map it — ask the vendor directly, in writing, and keep the answer.

## Questioning the output

AI is probabilistic. It is **probably right, not definitely right**, and those are very different things in a clinical setting.

The requirement is that you have a way to interrogate why you got the answer you got. If a tool produces a summary, a code, or a suggestion and there is no way to see what it was working from, you cannot review it — you can only accept it or reject it on vibes. That is not clinical oversight.

## Cultural safety and Indigenous data sovereignty

Two questions, and they are not the same question.

Is the tool appropriate and relevant to the population it is being used on? A model trained on one population can be quietly worse on another, and "quietly" is the dangerous part — it does not announce a lower accuracy rate, it just gets more things wrong for some patients than others.

And who owns the data, and where does it live? Indigenous data sovereignty is a specific principle with specific expectations, not a subheading under privacy. If your practice serves Aboriginal and Torres Strait Islander communities, this needs a real answer, not a vendor brochure.

## Monitoring and review

Not set and forget.

A tool that was appropriate at install can drift — the vendor changes the model underneath you, the population you serve changes, the way your staff use it changes. Someone has to look at it on a schedule and be willing to turn it off.

## Regulation

If a tool meets the definition of a medical device, it needs to be on the ARTG and comply with TGA guidance.

Plenty of software vendors are careful to describe their product in language that stays clear of that definition. Whether they are right is a question worth asking them directly, and worth asking before you deploy rather than during an assessment.

## Where to start

If you do nothing else this month, do these four things.

1. **Write down every tool in the practice that touches patient information and produces an answer.** Include the ones nobody thinks of as clinical systems. That is where the surprises are.
2. **For each one, find out where the data is stored and processed.** In writing, from the vendor.
3. **Draft the consent wording and the alternative pathway.** You need both before a patient asks, not after.
4. **Put a name against each tool.** One person who owns it, reviews it, and can switch it off.

None of that requires a project. It requires an afternoon and a willingness to hear an answer you do not like about a tool you already paid for.

This is a general walkthrough of what the criteria ask, not legal or clinical advice, and it is not a substitute for reading the Standards or talking to your accrediting body.

If you want a hand working out which of your tools clear the bar and which do not, [come and have a chat with us](/contact) — we do this work with [health providers across WA](/industries/health). Or [get this kind of thinking weekly](/newsletter).



Our Sign365 software is tailored to help you navigate your data entry, facilitating seamless transfer of information between locations and systems.

By streamlining the process for your forms to be created, filled out, and transferred to your business management systems, Sign365 saves your admin staff on average 2 hours per person, per day, meaning that you and your team can focus on more important tasks.

At Biz365, we’re all about return on investment (ROI). Given the hours saved by your hard-working admin team, at around 500 hours per person, per year – Sign365 will have an immediate positive impact on your business outcomes.

We strive to create continuous value for our clients through high-quality technology and software services – Sign365 epitomises this concept.


<LinkedInPost url="https://www.linkedin.com/feed/update/urn:li:activity:7497853090318995457/" title="$80,000 a year saved with AI" height="640" />

Five million in revenue. Sixty staff. Eighty thousand dollars a year back on the bottom line.

That is not a headline number by enterprise standards, and I like it for exactly that reason. It is the size of result an ordinary Australian business can actually get, on a budget it can actually approve, in a timeframe short enough that the person who signed it off is still in the job when it lands.

There was no platform involved. No transformation programme. Five steps, and none of them are clever.

## One: the workshop

Everyone in one room, and one question on the whiteboard.

**What do we do that is repeatable and happens on a computer?**

That is the whole brief. Repeatable, because a thing that happens once is not worth automating. On a computer, because if it is not already digital you have a different project on your hands first.

The part that makes or breaks the workshop is the homework. A week beforehand, everyone writes down what they actually do — not their job description, their week. The tasks, in order, with a rough sense of how long each one takes.

Ask people to recall their own work cold in a meeting and you get the interesting parts, because those are the parts they remember. The waste is invisible from the inside. Nobody thinks to mention the twenty minutes every morning spent copying yesterday's numbers into a spreadsheet, because it is not a task to them. It is just what starting work looks like.

Get everyone in the room, too. Not the managers with a summary. The person doing the job knows where the process actually breaks, and they know which step everyone quietly skips.

## Two: the roadmap

You come out of that workshop with a long list. Most of it is not worth doing. The roadmap is how you work out which parts are.

Score each task three ways.

**Time spent.** How many hours a week does this eat across everyone who touches it? A ten-minute job done by fifteen people every day is a bigger prize than a two-hour job done by one person monthly.

**Human risk.** What happens if this gets done wrong and nobody notices? An invoice going out with the wrong number is one thing. A clinical or safety record being wrong is another. High risk does not mean do not automate it — it means the checking step has to be designed properly, and that costs more, so it needs to earn its place.

**Human enjoyment.** This one matters more than people expect. If you automate the part of someone's job they actually like, you will get resistance and you will deserve it. If you automate the part everyone dreads, you get an internal champion for free. The best first project is almost always the one somebody will thank you for.

Then weigh it up: value on the top — hours returned and quality gained — over risk on the bottom, meaning how badly a mistake hurts and how hard the process is to pin down in the first place. Highest value, lowest risk, first.

And a simple rule that saves a lot of money: if it only happens once a year, skip it. The build cost is the same and the return arrives twelve months later.

## Three: the timeline

Write one down, commit to it, and make it honest.

The honest part means working around the business as it actually runs. Every business has a season where nobody has a spare hour — end of financial year, the busy quarter, the audit, the shutdown. Scheduling a rollout into that window does not compress the work. It just guarantees the project gets ignored and then blamed.

A timeline that admits the team has other priorities is a timeline that survives contact with the team.

## Four: choose a developer, not a vibe

This business looked at three options: an AI coding tool, an agency, and an actual software developer.

They went with the developer, and I think that was the single decision that made the rest of it work.

Here is the reasoning. AI coding tools are genuinely good at producing something that runs. They are much less good at producing something that keeps running — that handles the input nobody anticipated, that fails loudly instead of quietly, that someone can pick up and change in eighteen months. A developer has spent years being on the receiving end of software that does not do those things. They have worked with quality assurance. They know what a test is for, and they know that the interesting part of any system is what it does when something goes wrong.

That discipline is the whole ballgame in automation, because an automation that is quietly wrong is worse than no automation at all. The failure mode is not a crash. It is a number that has been slightly off for six weeks. I have [written before about the ways an AI project goes wrong](/blog/why-95-percent-of-enterprise-ai-fails), and nearly all of them come back to nobody owning the checking.

Use the AI tools. We do, heavily. Just have someone in the chair who knows what good looks like.

## Five: collect the cheque

Here is where the eighty thousand came from, and it is not what people assume.

Nobody was made redundant. The saving came from one observation: the most valuable person in the business was spending about half their time on work that did not need a person at all. Moving information between systems. Rekeying. Chasing.

That is the pattern I see in nearly every business I walk into. The better someone is, the more of that work ends up on their desk, because they are the one who gets it right. You end up paying a premium salary for data entry and calling it seniority.

Half of one high-value person's week, back. That is the line item. Say it out loud and it sounds modest. Put it on a five-million-dollar cost base, every year, and it is not modest at all.

## What this does not prove

It does not prove AI works. It proves that a specific, repeatable, well-understood process was worth automating in a business that was willing to be honest about where its time went.

Every step above is a place it could have gone wrong. Skip the homework and the workshop surfaces the wrong tasks. Skip the scoring and you build the impressive thing instead of the valuable one. Skip the developer and you get something that works in the demo. I have [made a fairly complete list of those mistakes elsewhere](/blog/how-to-build-a-bad-ai-agent), and it is not a theoretical list.

But the shape is repeatable, and it is not expensive to start. The workshop is a morning. The roadmap is an afternoon. You will know inside a week whether there is eighty thousand dollars sitting in your business, and in most businesses this size, there is.

Your competitors already know that. Time is money, and right now a lot of yours is being spent on work that stopped needing a person some time ago.

If you want to run that morning in your own business, [come and have a chat with us](/contact) — or [get this kind of thinking weekly](/newsletter).



There is a classic line from the IT crowd - Have you tried turning it off and on again? When I first entered the IT world, I thought there would be no way that would actually work.

Surprise, surprise, step 1 in troubleshooting any issue is normally to turn it off and turn it on. There are many issues we have solved with a classic reboot.

Unlike magicians, IT people do reveal their secrets, so go and reboot away, my friends. Here's how you can do it: 

1. **Save Your Work**: Before restarting, ensure that all your work is saved. Close any open applications to prevent data loss.

2. **Close Applications**: Exit all running programs. This helps in ensuring that the restart process is smooth and no unsaved data is lost.

3. **Restart Your Computer**: 
   - On Windows: Click on the "Start" menu, select the "Power" button, and then choose "Restart."
   - On Mac: Click on the Apple menu in the top-left corner and select "Restart."

4. **Wait for the System to Reboot**: Allow your computer to shut down and start up again. This process might take a few minutes.

5. **Log Back In**: Once the system has restarted, log back into your user account.

6. **Check for Improvements**: After logging in, check if the issue persists. Often, a simple restart can resolve many common problems.

By following these steps, you can effectively restart your machine and potentially resolve the issue at hand. Happy troubleshooting!

[THE CLASSIC](https://www.youtube.com/watch?v=nn2FB1P_Mn8)


I focus better online now because I have upgraded the most important tool online - my web browser.

If you have spent any time researching a topic online your browser will probably be full of open tabs. Now imagine that you just finished searching for your chosen topic and have walked away from your computer with 100 tabs left open. The next time you come back to your computer likely for a different task you will be greeted by those 100 distractions which will likely leave you forgetting what you are doing, delay the next thing you need to do and leave you feeling exhausted before you have even started

[![Watch the video](https://img.youtube.com/vi/sKUdS1LUzhs/0.jpg)](https://www.youtube.com/watch?v=sKUdS1LUzhs)

This is the problem Arc solves with spaces and tabs that close themselves between sessions. It works like this: say I work in IT and I want to have a space only for things that are work related. I would create a space in Arc just for those things and before I start my browsing switch to that space to do with that thing. Now when I finish work I can move into another space and have things to do with entertainment. This is the power of Arc (if you are still not getting it watch the video).

[WATCH THE VIDEO](https://www.youtube.com/watch?v=sKUdS1LUzhs)



Every cyber-insurance renewal is quietly turning into an exam. Insurers have stopped asking what industry you're in or how much revenue you make. They ask whether MFA is on every account. Whether you patch within 14 days. Whether you back up offline. Whether you actually restrict admin privileges, or just say you do.

They're asking the eight things the **Australian Signals Directorate** has been calling the **Essential 8** for years. And if you're in the WA health sector, the controls are no longer optional — they're the price of being insurable.

## The 40% problem

Coalition's **2024 Cyber Claims Report** puts the average claim-denial rate at around **40%**. The single largest reason claims get denied isn't fraud or arson or sabotage. It's misrepresented MFA. Businesses signed an application saying they had multi-factor authentication everywhere. Then a breach happened, the insurer's forensic team checked, and MFA was missing on the one account that mattered.

The cheque didn't come. The business absorbed the full breach cost.

Marsh Australia's 2024 market trends report puts it plainly: *"Insurers are shifting their focus away from revenue and industry type, and more towards the internal controls of a business."* Sector and revenue used to be the underwriting lens. Now it's controls. Specifically, the eight strategies the Essential 8 prescribes.

## The regulators agree

If insurance pressure isn't enough, regulators are catching up.

The **Aged Care Act 2024** came into effect on **1 November 2025**. The Aged Care Quality and Safety Commission's Technology and Cyber Security Topic Guide explicitly references **Essential 8 Maturity Level 1** as the compliance floor for residential aged care providers. Governing bodies must actively oversee technology and cyber risk. Providers must demonstrate E8 controls at quality audits.

The **WA Government Cyber Security Policy 2024** mandates Essential 8 ML1 across all WA Government entities. That includes WA Health. And it flows through to anyone contracted to deliver health services to WA Government — so if a clinic is on a state-funded program, the controls are already in scope by extension.

The **Privacy and Other Legislation Amendment Act 2024** strengthened OAIC enforcement powers and introduced infringement notices up to $66,000 per contravention. A statutory cause of action for serious privacy invasion is on the way. Health businesses are squarely in scope regardless of turnover, because the Privacy Act covers any organisation holding health information.

## Health is already the #1 target

The data caught up to clinic leadership a long time ago.

The **OAIC Notifiable Data Breaches Report** for the first half of 2025 puts health at **18% of all data-breach notifications** — the largest single sector, and the largest sector in every six-month reporting period since the scheme launched in 2018. The most-breached industry in Australia. Year after year.

The **ASD Annual Cyber Threat Report 2024–25** is bleaker still. Ransomware incidents against the health sector **doubled** year-on-year. And when attackers targeted health, they succeeded **95% of the time** — versus 52% across all sectors.

Health has the most valuable data and the lightest defences. The only question is whether your clinic gets to Essential 8 before the next attack, or after.

## What "ahead of the curve" actually buys you

Three concrete things change when you're already at ML1 before the deadline:

1. **Insurance renewal becomes simple.** You answer the controls questionnaire honestly and get a real quote. Premiums in 2024 dropped 0–10% for businesses with documented controls; in 2026, S&P Global is forecasting 15–20% increases as the market hardens. Being able to say *yes* to the MFA question is worth real money on every renewal for the next five years.

2. **Audits stop being events.** When a funder, accreditor, or regulator asks for evidence, you hand over a Board-ready ICT Risk Report and a citeable list of E8 controls. No scrambling, no last-minute remediation, no consultant rate cards.

3. **You stop carrying the worry.** Heads of Corporate Services already hold most of the unpaid risk in health-clinic operations. Knowing the controls are running — and that someone else is on the hook to keep them running — is the part that doesn't show up on a P&L but makes the job sustainable.

## The gamble

The phrase *"we'll deal with it when we have to"* used to be a defensible strategy. Cyber felt slow-moving. Insurance was generous. Regulators were polite.

Not any more. Insurers have stopped writing cheques to businesses that misrepresented their controls. The Aged Care Act has teeth. The WA Cyber Security Policy is operational. The OAIC has issued more notifications in the last 12 months than ever before.

So the question is the same one any gambler has to answer: how much are you willing to lose if it goes sideways once?

Essential 8 isn't a wall against every attack. Nothing is. But it's the lowest-cost, highest-credibility set of controls Australian regulators and insurers all agree on. Getting there now — on your terms, on your timetable, with a partner — is materially cheaper than getting there under pressure.

If your clinic is heading into a funder review, an accreditation cycle, or just a CEO question you can't currently answer, [book a 30-minute Essential 8 Readiness Call](/solutions/essential-8-health). We'll map your blindspots live on the call and tell you exactly where you sit against ML1 — even if you don't sign with us.

[Book a meeting with Sam directly](https://tidycal.com/mnp06p3/15-minute-meeting).

---

**Sources cited:** Marsh Australia, *Cyber Insurance Market Trends 2024*. Coalition Inc., *2024 Cyber Claims Report* (US/global, illustrative). Aged Care Act 2024 + ACQSC *Technology and Cyber Security Topic Guide*. WA Government *Cyber Security Policy 2024*. OAIC *Notifiable Data Breaches Report*, January–June 2025. ASD/ACSC *Annual Cyber Threat Report 2024–25*. Privacy and Other Legislation Amendment Act 2024 (Cth).



<LinkedInPost url="https://www.linkedin.com/feed/update/urn:li:activity:7496461687777087488/" title="Three steps to using AI safely" height="640" />

Here is the uncomfortable starting position for most Perth businesses I walk into: AI is already in use. It is on personal accounts, on phones, in browser tabs, with no policy and no record. Nobody signed off on it and nobody can tell you what has been pasted into it.

You do not get to decide whether your business uses AI. You get to decide whether it uses AI *safely*. Three steps, and the order matters.

## Step one: choose one provider

One. Not a shortlist, not a trial of four, not "whatever people prefer."

The moment you have three AI tools in the business you have three sets of terms, three places your data might live, three billing relationships and no way to answer the question *what did we send to whom*. Consolidating is the single largest safety improvement available to most businesses, and it costs nothing but a decision.

The three that come up in nearly every conversation:

- **Copilot** — the obvious pick if you are already deep in Microsoft. It sits inside the tools people already have open, which does more for adoption than any training session will, and your data stays inside a tenancy you already govern.
- **Claude** — where I would go if raw quality of thinking is the priority, particularly for anything involving writing, analysis or working through a problem properly.
- **ChatGPT** — the balanced option, and the enterprise subscription is worth the money specifically because it changes how your data is handled.

That last point applies across all three and it is the one to hold onto: **the enterprise or business subscription is not an upsell, it is the control**. Free and personal tiers are a different product with different data handling. If your staff are using AI on personal accounts today, the fix is not a ban. It is giving them a business account so the same behaviour happens somewhere you can see it.

## Step two: write the policy

Short. One page. Written so a person can read it once and know what to do.

The mistake is writing a policy that only says no. A policy of pure prohibition gets ignored on day two, and now you have shadow AI *and* a document that proves you knew about it.

Say clearly what is fine:

- Drafting reports, letters and proposals
- Summarising a long document you already have
- First-pass checking of work a person will review
- Rewriting something for a different audience

And say clearly what is not, with the reason attached:

- **No clinical diagnosis or clinical decision-making.** For anyone in health, this is the line. AI can draft the letter about the patient; it does not decide about the patient.
- **No recording or transcribing a conversation without consent.** This one catches people out constantly. The meeting-notes tools are excellent and they are also, in the wrong room, a privacy problem you have created for yourself.
- **No pasting client, patient or personal information into a tool that is not the approved one.** Which is only enforceable because you did step one.

If you handle health information, the Privacy Act applies to you regardless of turnover, and "an employee pasted it into a chatbot" is not a defence anybody has successfully run. Write the policy accordingly.

## Step three: train people individually, not corporately

This is the step that gets skipped, and it is the one that decides whether the other two hold.

Start by finding out what is actually happening. Ask people what they are already using and what for. You will get a more honest answer than you expect, provided the question is genuinely curious rather than an audit — and what you learn tells you exactly where the risk is and where the value is.

Then frame the training around one question: **how can we make your job easier?**

Not how we make the business more efficient. Nobody has ever been motivated by that sentence. The person in front of you cares about the report that takes them until 6pm on a Thursday, and if AI takes that to twenty minutes, they will use it correctly and enthusiastically for the rest of their career.

This matters most for later-career staff, who are frequently written off in these conversations and should not be. They are not resistant to the technology. They are resistant to being told their experience is now a rounding error — which is what "efficiency" sounds like from where they are sitting. Show them the tedious part of their own job disappearing and the resistance goes with it. They also tend to be the people who spot a wrong AI answer fastest, because they know what right looks like.

## The order is the point

Choose the tool, so there is one place to govern. Write the policy, so people know the edges. Train individually, so the policy is followed by people who want to follow it rather than people who have been told to.

Do it in the other order and you get a policy about tools you have not picked, taught to people who already had their own workaround.

If you want help getting this in place — the tool decision, the one-page policy, and training that people actually turn up to — [come and have a chat with us](/contact). Or [get this kind of thinking weekly](/newsletter).



<LinkedInPost url="https://www.linkedin.com/feed/update/urn:li:activity:7493849407897919489/" title="Three ways I cut costs with AI" height="640" />

Everyone wants to talk about what AI *could* do. I would rather talk about what it actually did to our own cost base, because we ran the experiment on ourselves before we ran it on anybody else.

Three places it landed. None of them were the places I expected when we started.

## One: outsourcing became AI agents

We used offshore virtual assistants. Plenty of Australian businesses do, and for a long time the maths was obvious — the hourly rate was lower, so the work went overseas.

Here is the part people miss. That hourly rate is not going down. It has not gone down for years, and there is no reason to expect it to. Meanwhile the cost of a capable AI subscription keeps falling and the capability keeps climbing. The two lines crossed.

We replaced that VA work with agents and it came out ahead on both axes — cost *and* quality. The quality part surprised me more than the cost part. An agent does not have a bad day, does not need the same instruction re-explained on Monday, and does not quietly stop doing the bit of the process it never understood.

What it does need is a documented process and someone checking the output. That is not free. It is just cheaper than the alternative, and you own it afterwards.

## Two: staffing changed shape

This is the one people get nervous about, so let me be precise about what happened.

The roles that went were the roles whose actual job was moving information between parts of the business. Take a thing out of one system, reformat it, put it into another system. Chase the person who has not sent the form. Retype the numbers into the report.

That is not a career. It is a queue.

Those roles are gone, and the budget went into engineering and design instead — people building things rather than shuffling things. The staff doing that work retrained into the new roles. That mattered to me. If your AI story ends with "and then we made people redundant," you have taken the cost out and thrown the knowledge away with it. The person who spent two years moving information between your systems understands your business better than almost anyone. Put them somewhere that uses it.

## Three: the two kinds of waste

This is where most of the money actually was, and neither of them has a line item in your accounts.

### Translation waste

Translation is the work of taking something that already exists and saying it again in a different format for a different audience.

A conversation with a client becomes a scope. The scope becomes a proposal. The proposal becomes a quote. The quote becomes a project plan. The project plan becomes an agenda. Every one of those is the same information wearing a different hat, and every one of them used to cost a person an hour or three.

We run that off Teams transcripts and templates now. The transcript is already there. The template already encodes what a good proposal looks like. The gap between them is exactly the kind of work AI is genuinely good at — no judgement call, no new information, just faithful reformatting.

### Verification waste

Verification is checking that something is right before it goes out the door. Code review. Test results. Compliance checks. Documentation.

We put an AI pass in *front* of the human pass. The agent does the first sweep, the human reviews what it found and what it missed.

This is the one I would point to if you only take one thing from this article, because it is the only one where **the quality goes up, not just the cost down**. A tired human reviewing the fortieth document of the week misses things. A first-pass agent does not get tired, and the human it hands to is now reviewing a shortlist instead of a haystack. We catch more, not less, and it takes less time.

## What this does not mean

It does not mean point an agent at your business and wait.

Every one of these three worked because the process underneath was already documented, already repeatable, and already had a human over the output. The two that did not have that — the ones I have not written about here — went nowhere and cost me time. I have [written separately about how to build a genuinely bad AI agent](/blog/how-to-build-a-bad-ai-agent), and every item on that list is something I have done.

Start with the translation waste. It is the least risky, the easiest to measure, and it is sitting in every business I walk into.

If you want to work out where yours is, [come and have a chat with us](/contact) — or [get this kind of thinking weekly](/newsletter).



<YoutubeVideo url="https://www.youtube.com/watch?v=wwUFjVcf6gU" title="Transformation Is a People Problem" />

The Financial Times ran a headline recently: seventy per cent of transformation projects fail, and everyone is ignoring the same fix.

I want to start somewhere else, because "transformation" is a nearly useless word on its own. Anything can be a transformation. Moving a mailbox is a transformation. The only question that matters is what you are transforming *to*.

Everyone is talking about AI right now. Almost nobody is saying where they are actually taking the business. And if you cannot answer that, AI is not an accelerant upwards. It is an accelerant downwards.

## A room full of customers who saw no value

I was at an event recently that made this concrete.

A business stood up in front of a room of its own customers and talked about the great things it was doing with AI. Customer experiences improved. Everything faster.

The customers' response was blunt. *We do not see any value in the transformation you are doing. Yes, you are going faster. Going faster does not mean anything for us.*

That is the whole failure mode, in one room, in one sentence.

It is a classic misunderstanding of your customers. And saying the words "it is not about the tech, it is about the people" does not make it true. That was the other thing being said in that room — it is not about the tech, it is all about the people, we want to provide value to our shareholders and stakeholders. But if you are not providing value, plugging in AI and announcing that you are going faster does not mean anything.

The fix was available the entire time, and it was free. Have a conversation with your customers.

## A human understands humans better than AI does

We would all love to make our lives easier by automating things. But some things are simply better done manually, and a customer conversation is top of that list. A human can understand humans better than an AI can understand a human.

If those people had just had a customer conversation, the whole thing would have been so much easier.

## Are you even doing the basics right?

The second half of this is cost. AI and technology cost time and money — so before you spend either, have you got the manual process down?

A good example from my own work: how do I go out and get leads? There are plenty of AI platforms and tools I could use for that. But the reality is I have to do a brain dump into the tool first, and that is a real time investment. Then the outreach it produces is impersonal and cold. So it does not even end up working.

It was actively worse, and a bigger waste of my time, than doing the thing manually the way I was supposed to.

## The biggest transformation we ever ran had nothing to do with technology

We are going down a data science route as a society, and data is great. But data about people is not the same as understanding people — as an angry room of customers at a networking event will tell you for free.

The largest transformation we have had in our own business was the change with people. It has literally changed everything. We changed our people processes, and the result is that people work harder and, more importantly, they work on the right problems.

When we talk about transformation using technology, yes, we could replace all of those processes with AI. But what does that actually look like in terms of outcome?

## Nobody cares that you put AI in your business

Transformation is just a change. Nobody cares that you added AI. They care about the outcome.

Microsoft's Copilot is the clearest example I can give you. When Microsoft first talked about Copilot, the messaging was all about AI, and it was not about capability. It landed flat. When they started saying *use it to do your Excel spreadsheets, use it to create your PowerPoints* — that is when people got hooked, because they could finally see the time saved.

Not talking about the technology. Showing what it can do.

In transformation projects, people do not get interested when we talk about how good AI is. They do not even get interested when we talk about how AI needs to be people-first. They get interested when we start with the people and work backwards.

Better than talking about how good AI is, talk about what is changing for the people. What is actually getting better for them.

And getting better does not mean getting faster at doing the wrong things. Better means a genuine shift towards value — for your customers, and for your people.

One more thing I took from that event: never talk about how good your business is in front of your customers. They do not care. They care about what is changing for them.

## Where to start

If you are considering a transformation project, this is what I would recommend:

- Look hard at your process before you touch the technology.
- Have real conversations with your people, and write down what you hear.
- Define what is changing for your customers, not what is changing in your stack.
- Only then ask what technology actually serves that.

This is where transformation really hits the road, and it is how we work: we help businesses start with people and start with process before we even look at the technology. I think that is a big differential.

If you would like a conversation about data and transformation, [come and have a chat with us](/contact). We would be happy to help.



Your latest employee has decided to use the company credit card to place some bets online. You know they have done it but you are in evidence collecting mode. You contact your IT company and say. Can you please tell me what Ms. Fortune has been doing on her computer. Here is the problem - your IT company hasn't been told they need to monitor web activities on the network (it is too creepy for most). You now have no hard evidence to say that they have made bets (other than a bank statement maybe?).

As you scale in size you lose track of what is going on with the information in your organisation. You expose yourself to more and more risk of situations of a similiar nature to the above. As Biz365 has been at the coalface of seeing our clients grow we have seen needs change. Many clients implement corporate policies in order to govern information in their organisations - but sometimes it isnt enough.

There are solutions out there now that allow for complete monitoring of the network so you can understand if people on your network are performing criminal, or non work related activities but if you have not engaged your IT company to use them you will not have access to them. We believe in just enough security and just enough privacy at Biz365 - however for certain organisations where there are these concerns there may be a need to implement something more extreme in order to prevent further violations at work.

Not convinced? It is a lot and each organisation has a line for where they draw monitoring at work. We think that preparing for the worst and expecting the best is a good strategy when there is precedence for this sort of behaviour. If you wish to see how this is possible please reach out to us at Biz365 on info@biz365.com.au

❤️ SJ


<LinkedInPost url="https://www.linkedin.com/feed/update/urn:li:activity:7497464890048286720/" title="Why 95% of enterprise AI fails" height="640" />

The figure doing the rounds is that 95% of enterprise AI projects fail. It comes from MIT Project NANDA's *The GenAI Divide: State of AI in Business 2025*, and the finding underneath it is more specific than the headline: across some $30–40 billion of enterprise spend, 95% of generative AI pilots produced **no measurable P&L impact**. Only 5% were extracting real value.

Not that they broke. Not that the technology did not work. That nothing showed up in the numbers.

I think there are three reasons, and none of them are technical.

## One: AI removes the thinking and hands back the checking

This is the big one and it is almost never scoped for.

The pitch is that AI does the work. What actually happens is that AI does the *thinking* part of the work and then quietly transfers a new obligation to you — checking whether it was right.

That checking is not free. On any task where being wrong matters, someone has to read the output with enough attention to catch a confident mistake, which is a harder kind of reading than writing it yourself would have been.

Run the honest sum on a lot of enterprise deployments and the promised time saving comes out around 15% of what was projected. The rest went into verification. Nobody put verification in the business case, so the business case was wrong before anyone typed a prompt.

You can get that number back up. But you get it back by designing the checking step deliberately — deciding who checks, how, against what, and where an agent can do the first pass — not by pretending it does not exist.

## Two: the self-improvement story is not true yet

There is a persistent claim that these systems get better on their own once they are running. Point it at your process, let it learn, walk away.

I have not seen it. What I have seen is a manual checking loop that never ends, run by someone whose job it quietly became.

Systems do improve, but the improvement comes from a human noticing a failure pattern and changing the instructions, the process document, or the data the thing is working from. That is a real job with a real cost, and if nobody owns it, the deployment does not get better — it just accumulates unexamined errors until someone loses confidence in it and stops using it. Which is what most "failed" AI projects actually look like from the inside. Not a crash. A quiet abandonment.

## Three: it was oversold, so it could only disappoint

The promise was unlimited productivity. Anything less than unlimited then reads as failure, even when the delivered result is genuinely good.

I have watched a deployment that saved real money get written up as a disappointment, purely because the original pitch had been unbounded. If you promise the moon and deliver a very good bridge, you have still failed against the brief you set.

The vendors did this. Plenty of consultants did this. It is the single easiest of the three to fix, because it costs nothing but honesty at the start.

## What careful adoption actually looks like

The projects I have seen work all share a shape, and it is unglamorous. They are scoped as a sentence:

> **Reduce time on X to get Y, without Z.**

- **X** is one named process. Not "our operations." A specific, repeatable thing that happens weekly, that someone can describe start to finish.
- **Y** is the outcome you are buying with the time — capacity for a person to do something better, a faster turnaround the customer actually notices, a queue that stops backing up.
- **Z** is what you are not willing to trade. Accuracy below a threshold. Client data leaving the tenancy. A human disappearing from a decision that needs one.

Every part of that sentence does work. X keeps the scope small enough to finish. Y stops you celebrating a time saving that went nowhere. Z is the one people leave off, and it is the one that keeps you out of trouble.

Here is the scale that succeeds, honestly stated: on a recent piece of work for a large enterprise, the result was roughly **half a full-time employee's worth of time returned**. Not a department. Half a person.

That is not a disappointing number. On an enterprise cost base it is substantial, it recurs every year, and it was delivered on a scope small enough that we could prove it. Ten of those is five people. Nobody gets ten of those by starting with a project that tries to be all ten at once.

## The real lesson

AI succeeds on limited, specific problems, in businesses honest enough to measure the result against a promise that was reasonable in the first place.

The 95% is not a story about the technology being bad. It is a story about scope being infinite, checking being invisible, and expectations being set by people who were not going to be there at the end.

If you would like a scope written as an actual sentence — with the X, the Y and the Z in it — [come and have a chat with us](/contact). Or [get this kind of thinking weekly](/newsletter).


IT and data platforms for engineering firms in WA

Systems that do the repetitive work

What clients got

Case studies you can read

Problems we hear most

What changes

Why work with us

Want your tech to be working for you?

Want to see how you can upgrade your IT and be even more productive?