
I thought that, since it was a Tuesday afternoon and I had nothing better to do, I would look at writing an article about my thoughts on the Australian Government.

No, not about whether I like the government or not. I wanted to look at the document they are using as their standard for building with AI.

Released in June, the policy update comes with the exciting and engaging title *Agentic AI addendum to the AI technical standard for Australian Government*. From now on, we can just call it "the addendum".

The first thing to consider when thinking about AI is how quickly the industry has changed.

In 2026 alone, there have been three major switch-ups: the emergence of agent harnesses and frameworks such as OpenClaw and its more attractive cousin, Hermes; the release of Fable 5, and its restricted twin Mythos 5 — the same model with the cyber safeguards taken off, handed only to the people the vendor decided had a good enough reason; and the emergence of cheaper and smarter Chinese models such as Kimi K3.

Among all of these changes, the government has decided to create a framework for how these systems should be built.

## Why now?

The adoption of AI systems, especially generative AI, has accelerated at an unprecedented pace.

Stanford's 2025 AI Index reports that organisational AI use rose from 55 per cent to 78 per cent in just one year. Eurostat has EU businesses with ten or more staff going from 13.5 per cent to 20.0 per cent between 2024 and 2025. Six and a half points in a year.

There had to be some kind of technical standard in place. I am not arguing with the premise of the standard. I will, however, argue with the way parts of it have been written.

## The bad: the definition of an AI agent

The technical standard spends a lot of time explaining what an AI agent is. The problem is that the definition it gives could easily apply to many software systems that are not agents.

The addendum defines an AI agent as:

> A software-based system that perceives inputs from its environment, maintains or updates an internal state, and selects and executes actions using APIs or other tools to achieve defined goals within assigned permissions and constraints. It may plan, learn from feedback when permitted, and self-monitor its behaviour to improve performance over time, while operating within defined governance, oversight, and control mechanisms.

Let's break down that first sentence.

<DefinitionAutopsy />

Now, the second sentence is where the interesting words live. Plan. Learn from feedback. Self-monitor.

Except every one of them is sitting behind the word *may*.

Optional. So the part of the definition that separates an agent from a thermostat is the part you are allowed to skip.

So, without sitting in the cheap seats just heckling — the addendum does say the thing I want. It says it about four hundred words later, in the background section, in a list of common methods and technologies.

Put it in the definition. The definition is the line people will paste into a procurement document.

## The "Control Tower"

Now that we have got that out of the way, there is another term in the addendum that even someone like me, who has been building these systems since ChatGPT was released, had not heard before.

They call it a "Control Tower".

The addendum defines it as:

> A centralised architectural governance layer that monitors, manages, and ensures secure agentic AI operations. A control tower can be used by business, system owners, and governance teams to monitor what agents are running, risks, security, costs, and compliance with regulations.

The idea itself is sensible.

In software engineering, we already have something similar. It is usually called observability. Production software needs monitoring because, when something goes wrong, you need to know what happened and who or what was responsible.

A Control Tower is broader than that. It is not just about whether the system is working. It also covers risk, security, cost and compliance.

For an AI system, that means capturing every step of a run. That happens to be the same list you need for an audit trail, so rather than write it out twice, it is further down.

So, while I think "Control Tower" is a slightly silly name, the idea behind it makes sense.

## Graceful recovery needs more detail

There is also a lot of discussion about graceful recovery in the addendum.

That is all well and good, but there does not seem to be much practical guidance around what graceful recovery should actually look like.

If a system fails, it has about five options. The addendum does not tell you how to choose between them.

<RecoveryMatrix />

Pick one before you go live. The default is worse than all five: the agent fails quietly, and your team finds out from the client.

Maybe I am nitpicking, but parts of the recovery guidance land at roughly the altitude of *make sure the system does not fail*.

That is a reasonable goal. It does not explain what an organisation should actually do when the system does fail.

## The good: use agents where they make sense

The addendum talks about narrowing the scope of where AI is allowed to make decisions. I think this is a good practice.

Why use an agent where it will "probably work" when you can use programming to create rules so it will "definitely work"?

Ultimately, an LLM is still a probability engine. It predicts the most likely response based on the information it has been given. That means its output can vary, and that variation creates risk in a business environment.

Ninety-seven per cent accurate is a great demo and a terrible referral process. The three per cent is a patient record with someone else's name on it, and you will not hear about it from the agent.

Traditional software can still have bugs, of course, but it is generally more predictable. If the same rules and inputs are used, you normally expect the same result.

Here is the neat part, though: you can use AI to build these traditional systems anyway. Most of what we ship is exactly that. An agent did the building, and what runs in production is boring, deterministic code that does the same thing every Tuesday.

So, hot tip: do not pick an agent when a programmed system can do the job, particularly if consistency is important.

There are also situations where a little randomness is not a major problem. Content generation is a good example. You are often tweaking the system anyway, and if it gets something wrong a small percentage of the time, you can review the result and ask it to try again.

That approach would not be suitable for every task. You probably do not want an AI agent randomly deciding how much money to pay an employee or whether a customer should receive access to an important system.

## Audit trails are essential

Under the silly name, the addendum also mentions that audit trails are essential.

I agree with that.

After ten years of building production software, I have found that it is rarely the obvious bugs that cause the biggest problems. It is usually the subtle ones.

Imagine that you are building a lead-finding agent. The agent finds a genuine sales lead but gets the company name wrong. That mistake may be difficult to notice among the hundreds of messages and records the system has created.

Swap the industry and the shape is identical. An intake agent that summarises a referral perfectly and files it against the wrong patient looks like a success in the log and a problem in the audit.

So this is what you want captured for every single run:

<AgentTrace />

In other words, it shows you the crime scene in detail.

That may sound dramatic, but when something goes wrong in a large system, you need evidence. Without an audit trail, you are left trying to work out what happened from the end result.

## Verification loops

The addendum also talks about feedback and verification loops that allow systems to improve over time.

This is becoming a necessity rather than a nice-to-have for agentic systems.

A verification loop can be as simple as telling the system:

> Make sure you verify "X" by doing "Y".

For example, an agent could be told to confirm a company name against a trusted database before sending a message.

However, checking a result and improving a system are not exactly the same thing. A verification loop checks whether the current result is correct. A feedback loop records what happened and uses that information to improve the system later.

That improvement might involve changing the prompt, adding a new rule, updating a tool or replacing the model.

None of it is exotic. It is refusing to let a machine act on something it has not checked.

## Final thoughts

It is probably a little early for the government to create a complete standard for building AI systems. Many people are still figuring out what building with AI looks like and what capabilities these systems can provide.

However, the addendum does include some sensible software practices that businesses should start using now:

- Keep AI decisions within a narrow scope.
- Use programmed rules where consistency matters.
- Monitor performance, cost and risk.
- Keep detailed audit trails.
- Verify important information before taking action.
- Decide in advance what a failure should do — retry, fall back, hand it to a human, or stop and say so.

So, while I think the addendum's definition of an AI agent is too broad and its advice on graceful recovery needs more detail, there are some useful ideas in it.

I will be using the name "Control Tower" in place of observability from now on.

Sorry, government. That one is sticking.

---

We design and build agentic systems for Western Australian businesses, and everything in that trace diagram is captured in ours. Not because a standard told us to, but because the alternative is guessing.

If you cannot answer *which model did this, what it was given, and who signed off* for a run that went wrong last Tuesday, you do not have a Control Tower. You have a hope.

[Book a 15-minute call](https://tidycal.com/mnp06p3/15-minute-meeting) and I will tell you which of the six you are missing, even if you never work with us.

**Sources cited:** Digital Transformation Agency, *Agentic AI addendum to the AI technical standard* — [digital.gov.au/policy/ai/agentic-ai-addendum](https://www.digital.gov.au/policy/ai/agentic-ai-addendum). The AI agent definition and the passage on language models are quoted from its *Background* page; the Control Tower definition is Criterion AGT.8.2 in its Monitor lifecycle statements. Stanford HAI, *AI Index Report 2025* (organisational AI use, 55 to 78 per cent). Eurostat, *Use of artificial intelligence in enterprises*, released 11 December 2025 (EU enterprises with 10 or more employees: 13.5 per cent in 2024 to 20.0 per cent in 2025). Anthropic, *Claude Fable 5 and Claude Mythos 5*.



We're excited to announce that Biz365 has officially partnered with the **Australian Signals Directorate (ASD)** as a registered **Cyber Security Business Partner**.

For those unfamiliar, the ASD is Australia's leading authority on cyber security and signals intelligence. Through their **Australian Cyber Security Centre (ACSC)**, they provide critical guidance, threat intelligence, and advisory services to help Australian organisations defend against the ever-growing landscape of cyber threats.

## What does this mean for our clients?

As an ASD Cyber Security Business Partner, Biz365 now receives:

- **Monthly newsletters** containing the latest news, publications, and security advisories direct from the ASD
- **ACSC Alert Service** subscription, giving us early warnings on emerging threats and vulnerabilities
- **Targeted guidance** and relevant cyber security information tailored to businesses like ours—and yours
- **Invitations to events** presented by the ACSC, keeping us at the forefront of cyber security developments in Australia

This means we're not just reacting to threats—we're staying ahead of them. The intelligence and resources we receive through this partnership flow directly into how we protect and advise our clients.

## Why this matters

Cyber attacks on Australian businesses are on the rise, and staying informed is half the battle. By partnering directly with the ASD, we have access to the same threat intelligence and guidance that protects Australia's critical infrastructure. We're bringing that level of protection to small and medium businesses right here in Western Australia.

This partnership complements our existing work implementing the **Essential Eight** framework and reinforces our position as a trusted partner for businesses that take their cyber security seriously.

## Staying protected

We encourage all of our clients to take cyber security seriously. If you'd like to learn more about how this partnership benefits your business, or if you want to discuss your current security posture, we'd love to chat.

For more information on the ASD's Cyber Security Partnership Program, visit [cyber.gov.au](https://www.cyber.gov.au/partnershipprogram).

[Book A Meeting](https://tidycal.com/mnp06p3/15-minute-meeting)



Your business has no insurance, your premise has no locks, your banking passwords are written on every sticky note you can get your hands on. You decided today that you are going to go to the casino and put it all on black.

The risk appetite of someone who does this is huge—and you might be thinking to yourself, how can someone live with so much risk? Well, many businesses here in Western Australia are in the same boat. There's been an alarming increase in cyber attacks on WA businesses over the last 5 years, with ransomware, data breaches, and credential theft leading to major disruptions—some companies failing to meet payroll or even closing up shop entirely.

It's a huge risk, and while many businesses know they should keep backups, there's often a lack of awareness about what actually works against today's threats—from kids using ChatGPT to whip up malicious scripts, right through to professional cybercriminals who make a living ransoming data and extorting payments.

But here's the good news: you don't have to figure it out alone. The Australian Signals Directorate (ASD), in partnership with the government, has released the **Essential Eight** framework—a straightforward, prioritized set of mitigation strategies that dramatically reduces your exposure to the most common attack techniques.

The **Essential Eight** gets businesses protected fast and effectively, and the neat part? Biz365 is already rolling out many of these controls in the background for our clients, handling the heavy lifting so you can focus on running your business.

That said, some of the most impactful controls—like **application control** (which blocks unauthorized software and executables from running) and **disabling or restricting Microsoft Office macros** (to stop hidden malicious code in documents)—can feel disruptive at first. They might block certain legacy processes or require whitelisting approved apps/macros, which is exactly why we want to work closely with you.

We'd love to jump on a quick call to discuss your specific setup, understand any potential friction points, and help tailor these controls so they protect you without grinding operations to a halt. Many clients find that once implemented properly (with our guidance), these measures become seamless—and they sleep a lot better knowing they're aligned with ASD's recommended baseline.

Ready to chat about getting these protections in place? Let's schedule a time—your peace of mind (and your business's future) is worth it.

[Book A Meeting](https://tidycal.com/mnp06p3/15-minute-meeting)



How important is securing your personal information and data?

At Biz 365, it’s one of our top priorities to ensure that our staff and clients are protected from data theft – so we think it’s pretty important!

We have the right to our own data and information being safe and secure. That being said, hackers and businesses often have other ideas, stealing data, to be manipulated or used to take advantage of us.

Data collection, particularly by other countries can be incredibly unsafe from an identity and security perspective, so we ensure that we shut-off access from a number of countries to prevent our data from falling into the wrong hands and being used for harm.

We pride ourselves on ensuring our staff and clients are able to work and live with the security of knowing that their private data is safe.


Sometimes when you are in a toxic relationship, after trying to reconcile over and over again without any progress you just have to end it.

That's kinda like what is happening right now on the internet. There are toxic countries that are constantly trying to steal your credentials, steal information, steal money and generally make your day infinitly worse.

Setting up a country block for your business is kinda like blocking that toxic friend who drains your energy and causes unnecessary drama. Just like cutting ties with them creates space for healthier relationships, blocking a country helps protect your business from negative influences and distractions, allowing you to focus on growth and positivity.

Think about it - would you keep letting someone into your house if they kept trying to steal your stuff? Of course not! The same goes for your digital space. These malicious actors from certain countries are like unwanted houseguests who keep showing up with bad intentions.

According to [IT Pro](https://www.itpro.com/security/state-sponsored-cyber-crime-is-officially-out-of-control), state-sponsored cybercrime has reached unprecedented levels, making it more important than ever to protect your business from malicious actors. We're talking about sophisticated attacks that can drain bank accounts, steal sensitive customer data, or even hold your entire system hostage with ransomware.

The scary part? These aren't just random hackers in basements anymore. Many of these attacks are state-sponsored, meaning they have serious resources and technology behind them. It's like dealing with a toxic ex who suddenly got super rich and hired private investigators to mess with you - not fun!

But here's the good news - you can take control. Just like you'd change the locks on your doors to keep out unwanted visitors, you can "change the locks" on your digital doors too. Country blocking is one of the most effective ways to do this.

If you are with Biz we have already done the work for you stepping in like a good friend and telling the toxic ones to get lost - only FVEY countries Canada, Aus, NZ, UK and US are on your allowed lists. Think of us as your digital bouncer, keeping the troublemakers out while letting the good guys in.

Remember, in both relationships and cybersecurity, sometimes the best defense is simply not letting the toxic elements anywhere near you in the first place. Stay safe out there!


Have you heard of Starlink?

We have recently began testing this high-speed, low-orbit satellite technology, with plans to potentially bring this into our services for those in regional WA.

Starlink’s technology enables people and businesses to access great internet in isolated locations, gaining opportunities for education, health services and essential communications in areas that were once completely blocked-off.

As we’re always looking to provide the best service and value for our clients, we are constantly growing our service options, in order to ensure the best quality. Starlink is a great example of this, and we are excited to be able to start offering this as an option for you!


Having a slow computer can inhibit your productivity and be an all-around frustration, no one wants that, especially when it impacts your business’ operations.

So, here are 5 reasons why your computer might be slow – keep them in mind and do your best to avoid them.

Full Disc
Storage problems can slow your computer down a huge amount. To avoid this, remove old files and documents by emptying your bin and removing old downloads. Also, look at reducing storage issues by frequently moving files onto an external hard drive or the cloud.

2. Too many things open!
Be sure to close down any apps, files or software that aren’t in use. The clearer your screen, often the better.

3. Running Powerful Software
This often occurs with older computers; new software may be too large and require to much memory for your computer to run comfortably. So, make sure you always have up to date tech and software that allows you to do everything you need.

4. Viruses
Viruses can dramatically slow down your computer and reduce performance. Often, this isn’t the reason behind a slow computer, but it is important to check frequently. Also do your best to avoid clicking on pop ups or unreliable links.

5. Anti-Virus Software
Whilst being great for preventing viruses from attacking your computer, anti-virus software can decrease your computer’s performance. So, make sure to find one that’s right for your computer.

Keeping these ideas in the back of your mind will save you time, frustration and ultimately money!

Looking for more tips to ensure that your computers and IT systems are working at their best? Make sure to jump onboard and follow along.

And as always, if you have any questions, don’t hesitate to send us a message!



With growing cybersecurity issues surrounding hacking and phishing, password security has never been more important.

Here are 6 ways to ensure your passwords stay safe and protected.

1. Never, ever give out your password via e-mail or phone. We recommend having a company policy that ensures that IT never ask for your employees’ passwords via these communication methods, to help minimise your passwords being compromised by people pretending to be from your company.

2. Don’t use passwords tied to something on your desk. if you have a picture of your dog on your desk, don’t use their name as the password. The convenience of incrementing passwords can make it simple for hackers to guess your passwords and any variations you may have.

3. Passphrases are GREAT. They are much more difficult to crack and much more simple for us to remember – it’s a win-win situation.

4. Don’t leave your computer unlocked. Attackers can easily gain control of your computer (and a whole system) if it remains unlocked. There are 2 simple ways to lock your Windows computer without closing any applications. Hit Ctrl+alt+del and click Lock this computer, or hit the “Windows button”+L; the Windows button is that button between Ctrl and Alt. Then all you have to do is open your computer and enter your password/phrase!

5. If you need to write down a password, keep it on you at all times. We recommend making sure that you don’t have random notes lying around containing your passwords – which can be easily lost or stolen.

6. Do not use your company password in your other networks. As it’s difficult to guarantee the safety of a password in another location, we always recommend keeping these separate.

Keep your passwords safe and secure and you’ll be adding an extra barrier of protection to both personal and company accounts.


Our Sign365 software is tailored to help you navigate your data entry, facilitating seamless transfer of information between locations and systems.

By streamlining the process for your forms to be created, filled out, and transferred to your business management systems, Sign365 saves your admin staff on average 2 hours per person, per day, meaning that you and your team can focus on more important tasks.

At Biz365, we’re all about return on investment (ROI). Given the hours saved by your hard-working admin team, at around 500 hours per person, per year – Sign365 will have an immediate positive impact on your business outcomes.

We strive to create continuous value for our clients through high-quality technology and software services – Sign365 epitomises this concept.


There is a classic line from the IT crowd - Have you tried turning it off and on again? When I first entered the IT world, I thought there would be no way that would actually work.

Surprise, surprise, step 1 in troubleshooting any issue is normally to turn it off and turn it on. There are many issues we have solved with a classic reboot.

Unlike magicians, IT people do reveal their secrets, so go and reboot away, my friends. Here's how you can do it: 

1. **Save Your Work**: Before restarting, ensure that all your work is saved. Close any open applications to prevent data loss.

2. **Close Applications**: Exit all running programs. This helps in ensuring that the restart process is smooth and no unsaved data is lost.

3. **Restart Your Computer**: 
   - On Windows: Click on the "Start" menu, select the "Power" button, and then choose "Restart."
   - On Mac: Click on the Apple menu in the top-left corner and select "Restart."

4. **Wait for the System to Reboot**: Allow your computer to shut down and start up again. This process might take a few minutes.

5. **Log Back In**: Once the system has restarted, log back into your user account.

6. **Check for Improvements**: After logging in, check if the issue persists. Often, a simple restart can resolve many common problems.

By following these steps, you can effectively restart your machine and potentially resolve the issue at hand. Happy troubleshooting!

[THE CLASSIC](https://www.youtube.com/watch?v=nn2FB1P_Mn8)


I focus better online now because I have upgraded the most important tool online - my web browser.

If you have spent any time researching a topic online your browser will probably be full of open tabs. Now imagine that you just finished searching for your chosen topic and have walked away from your computer with 100 tabs left open. The next time you come back to your computer likely for a different task you will be greeted by those 100 distractions which will likely leave you forgetting what you are doing, delay the next thing you need to do and leave you feeling exhausted before you have even started

[![Watch the video](https://img.youtube.com/vi/sKUdS1LUzhs/0.jpg)](https://www.youtube.com/watch?v=sKUdS1LUzhs)

This is the problem Arc solves with spaces and tabs that close themselves between sessions. It works like this: say I work in IT and I want to have a space only for things that are work related. I would create a space in Arc just for those things and before I start my browsing switch to that space to do with that thing. Now when I finish work I can move into another space and have things to do with entertainment. This is the power of Arc (if you are still not getting it watch the video).

[WATCH THE VIDEO](https://www.youtube.com/watch?v=sKUdS1LUzhs)



Every cyber-insurance renewal is quietly turning into an exam. Insurers have stopped asking what industry you're in or how much revenue you make. They ask whether MFA is on every account. Whether you patch within 14 days. Whether you back up offline. Whether you actually restrict admin privileges, or just say you do.

They're asking the eight things the **Australian Signals Directorate** has been calling the **Essential 8** for years. And if you're in the WA health sector, the controls are no longer optional — they're the price of being insurable.

## The 40% problem

Coalition's **2024 Cyber Claims Report** puts the average claim-denial rate at around **40%**. The single largest reason claims get denied isn't fraud or arson or sabotage. It's misrepresented MFA. Businesses signed an application saying they had multi-factor authentication everywhere. Then a breach happened, the insurer's forensic team checked, and MFA was missing on the one account that mattered.

The cheque didn't come. The business absorbed the full breach cost.

Marsh Australia's 2024 market trends report puts it plainly: *"Insurers are shifting their focus away from revenue and industry type, and more towards the internal controls of a business."* Sector and revenue used to be the underwriting lens. Now it's controls. Specifically, the eight strategies the Essential 8 prescribes.

## The regulators agree

If insurance pressure isn't enough, regulators are catching up.

The **Aged Care Act 2024** came into effect on **1 November 2025**. The Aged Care Quality and Safety Commission's Technology and Cyber Security Topic Guide explicitly references **Essential 8 Maturity Level 1** as the compliance floor for residential aged care providers. Governing bodies must actively oversee technology and cyber risk. Providers must demonstrate E8 controls at quality audits.

The **WA Government Cyber Security Policy 2024** mandates Essential 8 ML1 across all WA Government entities. That includes WA Health. And it flows through to anyone contracted to deliver health services to WA Government — so if a clinic is on a state-funded program, the controls are already in scope by extension.

The **Privacy and Other Legislation Amendment Act 2024** strengthened OAIC enforcement powers and introduced infringement notices up to $66,000 per contravention. A statutory cause of action for serious privacy invasion is on the way. Health businesses are squarely in scope regardless of turnover, because the Privacy Act covers any organisation holding health information.

## Health is already the #1 target

The data caught up to clinic leadership a long time ago.

The **OAIC Notifiable Data Breaches Report** for the first half of 2025 puts health at **18% of all data-breach notifications** — the largest single sector, and the largest sector in every six-month reporting period since the scheme launched in 2018. The most-breached industry in Australia. Year after year.

The **ASD Annual Cyber Threat Report 2024–25** is bleaker still. Ransomware incidents against the health sector **doubled** year-on-year. And when attackers targeted health, they succeeded **95% of the time** — versus 52% across all sectors.

Health has the most valuable data and the lightest defences. The only question is whether your clinic gets to Essential 8 before the next attack, or after.

## What "ahead of the curve" actually buys you

Three concrete things change when you're already at ML1 before the deadline:

1. **Insurance renewal becomes simple.** You answer the controls questionnaire honestly and get a real quote. Premiums in 2024 dropped 0–10% for businesses with documented controls; in 2026, S&P Global is forecasting 15–20% increases as the market hardens. Being able to say *yes* to the MFA question is worth real money on every renewal for the next five years.

2. **Audits stop being events.** When a funder, accreditor, or regulator asks for evidence, you hand over a Board-ready ICT Risk Report and a citeable list of E8 controls. No scrambling, no last-minute remediation, no consultant rate cards.

3. **You stop carrying the worry.** Heads of Corporate Services already hold most of the unpaid risk in health-clinic operations. Knowing the controls are running — and that someone else is on the hook to keep them running — is the part that doesn't show up on a P&L but makes the job sustainable.

## The gamble

The phrase *"we'll deal with it when we have to"* used to be a defensible strategy. Cyber felt slow-moving. Insurance was generous. Regulators were polite.

Not any more. Insurers have stopped writing cheques to businesses that misrepresented their controls. The Aged Care Act has teeth. The WA Cyber Security Policy is operational. The OAIC has issued more notifications in the last 12 months than ever before.

So the question is the same one any gambler has to answer: how much are you willing to lose if it goes sideways once?

Essential 8 isn't a wall against every attack. Nothing is. But it's the lowest-cost, highest-credibility set of controls Australian regulators and insurers all agree on. Getting there now — on your terms, on your timetable, with a partner — is materially cheaper than getting there under pressure.

If your clinic is heading into a funder review, an accreditation cycle, or just a CEO question you can't currently answer, [book a 30-minute Essential 8 Readiness Call](/solutions/essential-8-health). We'll map your blindspots live on the call and tell you exactly where you sit against ML1 — even if you don't sign with us.

[Book a meeting with Sam directly](https://tidycal.com/mnp06p3/15-minute-meeting).

---

**Sources cited:** Marsh Australia, *Cyber Insurance Market Trends 2024*. Coalition Inc., *2024 Cyber Claims Report* (US/global, illustrative). Aged Care Act 2024 + ACQSC *Technology and Cyber Security Topic Guide*. WA Government *Cyber Security Policy 2024*. OAIC *Notifiable Data Breaches Report*, January–June 2025. ASD/ACSC *Annual Cyber Threat Report 2024–25*. Privacy and Other Legislation Amendment Act 2024 (Cth).



<YoutubeVideo url="https://www.youtube.com/watch?v=wwUFjVcf6gU" title="Transformation Is a People Problem" />

The Financial Times ran a headline recently: seventy per cent of transformation projects fail, and everyone is ignoring the same fix.

I want to start somewhere else, because "transformation" is a nearly useless word on its own. Anything can be a transformation. Moving a mailbox is a transformation. The only question that matters is what you are transforming *to*.

Everyone is talking about AI right now. Almost nobody is saying where they are actually taking the business. And if you cannot answer that, AI is not an accelerant upwards. It is an accelerant downwards.

## A room full of customers who saw no value

I was at an event recently that made this concrete.

A business stood up in front of a room of its own customers and talked about the great things it was doing with AI. Customer experiences improved. Everything faster.

The customers' response was blunt. *We do not see any value in the transformation you are doing. Yes, you are going faster. Going faster does not mean anything for us.*

That is the whole failure mode, in one room, in one sentence.

It is a classic misunderstanding of your customers. And saying the words "it is not about the tech, it is about the people" does not make it true. That was the other thing being said in that room — it is not about the tech, it is all about the people, we want to provide value to our shareholders and stakeholders. But if you are not providing value, plugging in AI and announcing that you are going faster does not mean anything.

The fix was available the entire time, and it was free. Have a conversation with your customers.

## A human understands humans better than AI does

We would all love to make our lives easier by automating things. But some things are simply better done manually, and a customer conversation is top of that list. A human can understand humans better than an AI can understand a human.

If those people had just had a customer conversation, the whole thing would have been so much easier.

## Are you even doing the basics right?

The second half of this is cost. AI and technology cost time and money — so before you spend either, have you got the manual process down?

A good example from my own work: how do I go out and get leads? There are plenty of AI platforms and tools I could use for that. But the reality is I have to do a brain dump into the tool first, and that is a real time investment. Then the outreach it produces is impersonal and cold. So it does not even end up working.

It was actively worse, and a bigger waste of my time, than doing the thing manually the way I was supposed to.

## The biggest transformation we ever ran had nothing to do with technology

We are going down a data science route as a society, and data is great. But data about people is not the same as understanding people — as an angry room of customers at a networking event will tell you for free.

The largest transformation we have had in our own business was the change with people. It has literally changed everything. We changed our people processes, and the result is that people work harder and, more importantly, they work on the right problems.

When we talk about transformation using technology, yes, we could replace all of those processes with AI. But what does that actually look like in terms of outcome?

## Nobody cares that you put AI in your business

Transformation is just a change. Nobody cares that you added AI. They care about the outcome.

Microsoft's Copilot is the clearest example I can give you. When Microsoft first talked about Copilot, the messaging was all about AI, and it was not about capability. It landed flat. When they started saying *use it to do your Excel spreadsheets, use it to create your PowerPoints* — that is when people got hooked, because they could finally see the time saved.

Not talking about the technology. Showing what it can do.

In transformation projects, people do not get interested when we talk about how good AI is. They do not even get interested when we talk about how AI needs to be people-first. They get interested when we start with the people and work backwards.

Better than talking about how good AI is, talk about what is changing for the people. What is actually getting better for them.

And getting better does not mean getting faster at doing the wrong things. Better means a genuine shift towards value — for your customers, and for your people.

One more thing I took from that event: never talk about how good your business is in front of your customers. They do not care. They care about what is changing for them.

## Where to start

If you are considering a transformation project, this is what I would recommend:

- Look hard at your process before you touch the technology.
- Have real conversations with your people, and write down what you hear.
- Define what is changing for your customers, not what is changing in your stack.
- Only then ask what technology actually serves that.

This is where transformation really hits the road, and it is how we work: we help businesses start with people and start with process before we even look at the technology. I think that is a big differential.

If you would like a conversation about data and transformation, [come and have a chat with us](/contact). We would be happy to help.



Your latest employee has decided to use the company credit card to place some bets online. You know they have done it but you are in evidence collecting mode. You contact your IT company and say. Can you please tell me what Ms. Fortune has been doing on her computer. Here is the problem - your IT company hasn't been told they need to monitor web activities on the network (it is too creepy for most). You now have no hard evidence to say that they have made bets (other than a bank statement maybe?).

As you scale in size you lose track of what is going on with the information in your organisation. You expose yourself to more and more risk of situations of a similiar nature to the above. As Biz365 has been at the coalface of seeing our clients grow we have seen needs change. Many clients implement corporate policies in order to govern information in their organisations - but sometimes it isnt enough.

There are solutions out there now that allow for complete monitoring of the network so you can understand if people on your network are performing criminal, or non work related activities but if you have not engaged your IT company to use them you will not have access to them. We believe in just enough security and just enough privacy at Biz365 - however for certain organisations where there are these concerns there may be a need to implement something more extreme in order to prevent further violations at work.

Not convinced? It is a lot and each organisation has a line for where they draw monitoring at work. We think that preparing for the worst and expecting the best is a good strategy when there is precedence for this sort of behaviour. If you wish to see how this is possible please reach out to us at Biz365 on info@biz365.com.au

❤️ SJ

Build Your App in 30 Days or Your Money Back

trusted by

Build Your App in 30 Days

Client Success Stories

Online Stores and Ordering Platforms

Overcoming Challenges

Visualize Your Success

Why Choose Us?