The frontier-AI threat is here now, the cyber fundamentals must be evidenced, and the board owns it.
Commissioner Constant's letter does three things at once. It tells AFS licensees and market participants that frontier AI is materially changing the threat environment, not by creating new risks but by intensifying existing ones. It re-asserts that the legal standard for cyber risk management is proportionality to the size, nature and complexity of the business, anchored in the recent FIIG Securities judgment. And it puts accountable individuals on notice that boards and senior executives are expected to be able to evidence their cyber position, not merely assert it.
"ASIC's message is straightforward: do not wait for perfect clarity to address the threat posed by new AI models. Instead, act now, and act with discipline, to strengthen the cyber resilience fundamentals that underpin your business."
Simone Constant, ASIC Commissioner · Open letter 26-092MR, 8 May 2026
The instruction that follows the headline is explicit. The letter is to be tabled and discussed at the ultimate board and risk governance committees. ASIC does not ask for a written response, but the letter is now a regulatory artefact. The next time ASIC engages with your entity, on a licence review, a supervisory visit, a breach notification, or an enforcement matter, your response to 26-092MR is part of the record.
What ASIC is not asking for is novelty. The letter explicitly states "these are not new expectations". What has changed is the environment they operate in, and the regulator's tolerance for entities that cannot evidence consistent execution of well-established controls.
The first Australian court-tested standard for proportionate cyber risk management.
ASIC's letter cites its own enforcement action against FIIG Securities (26-021MR) as the legal benchmark for cyber risk management going forward. This is the first time an Australian court has applied a specific cyber-risk test to an AFS licensee, and the court's framing is now the framing ASIC will use.
Cyber risk management "must be demonstrably effective and proportionate to the size, nature and complexity of a business".
Court judgment, ASIC v FIIG Securities Limited · cited in 26-092MR
Three words in that sentence carry the weight of the new standard. Demonstrably: assertions and self-assessments are insufficient; the entity must be able to show, with evidence, that controls are operating. Effective: controls must achieve their intended risk reduction, not just exist on paper. Proportionate: the test is calibrated to the entity's size, nature and complexity, not a uniform industry standard.
The practical effect for AFS licensees and market participants is that "we have policies" is not a defence. The bar is whether your information security programme is demonstrably effective and proportionate, and whether you can produce the artefacts that prove it. For larger entities, that means richer evidence of independent testing, third-party assurance, board-level oversight, and incident readiness. For smaller entities, the standard is not lower in principle, but the depth of evidence is proportionate to their footprint.
This is also the doctrine that underwrites the rest of the ASIC letter. Every one of the 12 actions and four governance expectations sits inside the FIIG frame. The question ASIC will ask, when it next engages with your entity, is not "did you do X" but "can you demonstrate that X is effective and proportionate to your business".
What ASIC wants entities to do now, with the practitioner translation.
The letter sets out twelve specific actions for entities to take. The actions are reproduced verbatim here, alongside the practical translation: what the action looks like when implemented in a way that a regulator, a court, or an auditor would accept as evidence.
None of these actions is novel in isolation. What is new is the cumulative weight: ASIC is telling AFS licensees that the regulator now expects evidence of all twelve, calibrated to the entity's size, nature and complexity, and presented to the board with appropriate challenge. The cost of inaction is no longer hypothetical. The FIIG judgment, the imminent enforcement programme, and the explicit linkage of these actions to board accountability set the new floor.
What ASIC expects from boards and senior executives, in practice.
The letter sets four governance expectations directed at boards and senior executives. These are the questions a director should be able to answer with evidence at any board meeting from May 2026 onwards.
"Governance should not rely only on assurances. It should be supported by evidence: test results, audit findings, lessons from incidents, and independent validation, supported by appropriate capability and resourcing."
26-092MR, governance and accountability section
The phrase "evidence, not assurances" is the line directors should commit to memory. ASIC is signalling that the next supervisory question will not be "are you satisfied with cyber" but "what evidence supports your satisfaction". The answers that survive scrutiny are those grounded in independent testing, audit findings, real incident lessons (including near-misses), and assurance from external specialists who have no incentive to report green.
The headline is AI. The substance is the speed and scale of pressure on existing controls.
ASIC is careful with its framing on AI. The letter is explicit that frontier AI does not create entirely new categories of risk. It does, however, mean existing controls "are more likely to be tested, more often, and under greater pressure". For practitioners, the useful exercise is to identify which existing controls are most affected and by how much.
| Control area | How frontier AI shifts the pressure | What changes in practice |
|---|---|---|
| Phishing and social engineering | Content quality, personalisation, and language fluency converge with native-speaker quality. Voice and video deepfakes are now within reach of low-skill actors. | Awareness training must update past "look for poor English". Verification protocols for unusual financial requests must be technical, not behavioural. |
| Vulnerability discovery | Time-to-exploit on disclosed vulnerabilities is collapsing. AI-assisted exploitation lowers the skill floor for attackers. | Patch SLAs need to compress for internet-exposed and business-critical systems. Expect a window of hours-to-days, not weeks, for critical patches. |
| Lateral movement and post-exploitation | AI lowers the cost of mapping internal environments, identifying high-value targets, and chaining low-severity weaknesses. | Segmentation, identity controls, and detection logic for lateral movement become higher leverage. A flat network is a higher-cost design than it was. |
| Shadow AI and data exposure | Staff using public AI tools without governance expose sensitive data into systems the entity does not control. | Acceptable use policy, sanctioned tooling, and DLP controls for AI prompts. Train staff on what cannot leave the corporate boundary. |
| Supply-chain AI risk | Vendors are embedding AI into their products. The entity inherits the AI risk of every supplier that uses AI to deliver the service. | Third-party assurance questionnaires must update to ask explicitly about AI use, model providers, data flows, and human-in-the-loop controls. |
Importantly, the letter also endorses defensive AI use. Cliffside has documented its position on this in the secure-AI-adoption guidance: AI in the defensive stack is appropriate where it materially improves outcomes, is governed by a documented risk-based approach, and is subject to the same control testing as any other security capability. The board test ASIC will apply is whether the entity is aware of, governing, and where appropriate using AI on both sides of the equation.
A pragmatic sequencing of the response, designed for a Q3 26 board cycle.
The letter is dated 8 May 2026. Most boards will table it at the next ultimate board or risk governance committee meeting, typically within four to six weeks. The right work, sequenced honestly, looks like this.
- →Week 1. Table the letter at the next board meeting alongside a one-page management response that maps the 12 actions and four governance expectations to the entity's current state. Be honest about gaps; do not green-wash.
- →Weeks 2 to 4. Commission an independent assessment against the 12 actions, calibrated to your size and complexity. Cliffside calls this a Lighthouse Assessment; the principle is the same regardless of provider. The output is a transferable evidence pack the board can rely on at the next meeting.
- →Weeks 4 to 8. Refresh the asset register, exercise the incident response plan, and complete a privileged-access review. These are the three actions with the highest probability of being asked about in any subsequent regulatory interaction.
- →Weeks 8 to 12. Update board reporting to evidence end-to-end control effectiveness, not activity. Replace red-amber-green dashboards with control-coverage and effectiveness scoring, signed off by independent assurance.
- →Continuous from week 12. Embed quarterly evidence cycles: control testing, third-party assurance refresh, threat-environment recalibration, and AI-risk position statement. Make the response to 26-092MR a programme, not an event.
The risk to manage is over-reaction as much as under-reaction. ASIC is explicit that this is "not calling for panic or reactive overreach". A board that approves a large novel tool spend in response to the letter, without first evidencing fundamentals, is responding to the wrong signal. The fundamentals are the work.
Independent, evidence-led response work for AFS licensees and market participants.
Cliffside has worked with APRA-regulated and ASIC-regulated entities since 2014. We are ISO 27001 certified, hold Microsoft Partner status, and our practitioners are CREST and OSCP qualified on the offensive side and SABSA, CISSP and ISO 27001 Lead Auditor qualified on the defensive side. We do not sell software; we sell judgement.
- →26-092MR readiness assessment. An independent assessment against the 12 actions and four governance expectations, calibrated to your size and complexity, producing a transferable evidence pack for the board.
- →Security architecture review. Assume-breach assessment against your current network, identity, cloud, endpoint and detection architecture, with a risk-ranked remediation roadmap. Direct fit for actions 5, 6 and 9.
- →Security governance build. Board reporting, risk frameworks, and policy uplift that evidences control effectiveness rather than activity. Direct fit for the four governance expectations.
- →Tabletop exercises and breach simulations. Scenario-based incident response exercising, with realistic AI-enabled threat injects. Direct fit for action 10.
- →Third-party risk assessment. Vendor and concentration risk programme design and execution, including fourth-party mapping. Direct fit for action 11.
- →Penetration testing and red team. Independent control testing, including AI-system testing for entities adopting defensive or productive AI. Direct fit for actions 4 and 12.
- →Virtual CISO. Senior security leadership available on a fractional basis, where the entity needs continuous board-level engagement without a full-time hire. Direct fit for the governance expectations as an ongoing capability.
Our engagement model is assessment-first. We start with a free consultation, scope the work to your actual position, and deliver transferable outputs you can use with our team, take to a competing provider, or present to ASIC. There is no lock-in. There are no margin-driven tool recommendations. The advice you receive is the advice we would give if your business depended on it, because, for our regulated clients, it does.