I joined NSB Cyber a few months ago, just before we turned three. I remember when my children turned three, they suddenly seemed like independent people who had opinions and could hold a great conversation in a café. It felt like a very significant milestone of development. Three is also a significant milestone for a startup, given ABS stats show only around half of new Australian businesses are still trading a few years in.
When I joined, NSB Cyber had grown from a few people around a dining table to a thriving team across Australia. Our clients’ needs were growing and changing, in a cyber landscape with more sophisticated threat actors and the pace and unknowns of AI. We had processes and team rituals and a great vibe, but things were starting to evolve.
When I first met both of our founders, one of their top priorities for this phase was taking care of NSB Cyber’s culture. Culture is fragile and it can be one of the first things that breaks when things grow or change. We needed to think about how to protect the best bits as we grow, and how to foster new things that will help us continue to succeed. Our values (Client, Quality and Culture) are the anchor for both.
I’ve found that culture in a startup is more immediately obvious than in a large organisation. The everyday behaviours are more visible to everyone, the symbols of what’s important to us are up on the walls and the shelves, the Teams chats are pinging with gifs, and we know each other more as people rather than big abstract teams. There’s also a lot of laughter, which feels especially important to protect when our work is so serious. But growth introduces new people, more demands on founders’ time, more expected of leaders as their teams get bigger. You need to start being more intentional about the kind of culture you want and how you’ll support it.
In the early days, I prioritised running our first employee survey. It was a good chance to see where everyone was at, look at what we were doing well and what was needing more focus as we grew. After recovering from the shock of one of the highest engagement scores I’ve ever seen, I also saw something else really interesting – all the areas to focus on were things we already knew. Nothing was a surprise to our founders or our team. Unlike a three-year-old child who thinks they’re amazing at everything, we knew where we needed to do some work.
Some of the things we’ve been working on from a People & Culture perspective are refreshing our operating rhythm and thinking about how we communicate and share information across our leadership and teams, refreshing some of our foundational policies (I wouldn’t say I’ve always found policies to be the most exciting work but I’m seeing how they set the baseline for our culture – and we’ve just launched a great new parental leave policy!), and looking at role clarity, leadership and career pathways as things evolve.
A huge bonus for us is that cybersecurity is a really exciting industry – not a day goes by when I don’t read something new about cyber. It’s great being able to have interesting conversations with the team about where we’re heading and how we can help our clients have confidence in the face of change.
This week, I’ve been reading about the Binance breach which is interesting from both a cyber and HR perspective. Attackers posed as recruiters, ran fake job interviews with a Binance engineer, and persuaded him to download an ‘interview assignment’ onto his work laptop. It contained malware that opened the door to one of the biggest crypto attacks on record. With this and AI, it’s a good reminder that security is more important than ever now, on both sides of an interview.
Three years in for NSB Cyber and three months for me. Three is when kids start to work out more about who they are and that’s what we’re doing too, with purpose.
What we read this week
Hacker Claims Access to NSW Health Server; Authorities Say No Patient Data Affected - A threat actor posting as “bytetobreach” claimed on an underground forum to have taken roughly 70 GB (about 100,000 documents) from an NSW Health server after exploiting a misconfigured subdomain. Cyber Security NSW confirmed a limited breach of an isolated server and stated that no patient data has been impacted or is currently at risk. NSW Police’s Cybercrime Squad opened an investigation under Strike Force Civic and is working with NSW Health and Cyber Security NSW. Organisations should continue to harden internet-facing systems, review subdomain and asset inventories, and treat claims of large document theft with caution until independently verified.
Ivanti Connect Secure Zero-Days Chained and Added to CISA KEV - CISA has added further Ivanti Connect Secure vulnerabilities (including CVE-2026-111357 and CVE-2026-118527) to its Known Exploited Vulnerabilities catalogue after evidence that attackers chained them with an earlier flaw for unauthenticated root-level code execution on enterprise VPN appliances. Organisations that applied only the first October patches must verify exact build numbers and investigate for compromise independently of Integrity Checker results. Immediate priority is to apply the latest vendor fixes, reduce internet exposure of the appliances, and review logs for anomalous activity dating back at least to early October.
WordPress Core Race-Condition Flaw Actively Exploited; CISA Adds to KEV - CISA added a WordPress Core race-condition vulnerability (CVE-2026-119977) to the KEV catalogue on 3 November after attackers began exploiting it within hours of the fix in WordPress 7.1.4. The unauthenticated timing window during the core update process can lead to remote code execution. Federal agencies have a short remediation deadline (around 6 November). Site owners should ensure they are running the patched version, restrict unnecessary update-related paths where possible, and monitor for suspicious activity around the upgrade process.
Binance Reports ~$6.3 Billion Hot-Wallet Theft Attributed to North Korea - Binance disclosed that attackers moved approximately $6.3–6.4 billion from its hot wallets. The FBI has attributed the theft to North Korea’s TraderTraitor activity; later reporting confirmed a fake job-interview social-engineering vector that led to malware on an employee device and ultimately unauthorised withdrawals. Binance has begun restoring withdrawals, states it will cover losses, and reports that a substantial portion of the assets has been frozen or recovered. The incident reinforces the need for strict separation of high-privilege operational systems, hardware-backed authentication for critical actions, and rigorous vetting of remote-access and interview processes.
Google and Mandiant Warn of LLMjacking Campaigns Costing Organisations Hundreds of Thousands per Day - Google Threat Intelligence Group and Mandiant documented a surge in LLMjacking, in which stolen cloud credentials and API keys are used to hijack enterprise access to large language models and resell the compute via underground “LLM mixers.” Individual organisations have incurred more than $100,000 per day in fraudulent charges, with some cumulative losses reaching $1 million before detection. Defenders should prioritise monitoring of anomalous AI/API spend, enforce least-privilege and short-lived credentials for cloud AI services, and review access logs for unexpected model usage.