Cyber resilience puts security partnerships in the spotlight

Security partners will need to adapt their capabilities as organisations face changing risks.

Security services spending in Australia will grow by almost 7 percent to reach more than $3.7 billion in 2026, according to Gartner estimates.

The research firm said the critical need for AI-literate security practitioners is adding to the ongoing talent shortage. As a result, organisations are turning to MSSPs to fill the gaps and strengthen their security capabilities.

While Gartner notes that AI is increasingly being embedded in security products, professional and managed security services will need to operate across the entire organisation.

One of the biggest gaps, however, is end-to-end accountability across internal teams, cloud providers, MSPs, MSSPs and other specialist partners, according to Leighton Freene, MD, federal government, defence and national security at Kinetic IT.

The problem is that while each provider may perform its individual role well, cyber incidents rarely respect contractual or technology boundaries. “Problems emerge when no one has sufficient visibility across the environment or clarity about who coordinates the response,” said Freene.

Freene recommends organisations adopt a threat-informed approach, changing the conversation with MSPs, MSSPs and other technology partners.

His advice to partners is to understand the organisation’s operating environment, critical assets, relevant threat actors and attack techniques. The goal is to deliver more than baseline security controls.

“The question becomes less about whether a partner can deliver a standard security catalogue and more about whether it can adapt those capabilities to the risks the customer actually faces,” he said.

“This requires ongoing intelligence sharing, regular testing and a willingness to adjust priorities as both the organisation and the threat landscape change,” he added.

Building resilient partnerships

As Australia’s cybersecurity matures, organisations are putting more emphasis on trusted partnerships as well as resilience and sovereign capability, according to Kinetic IT's Sovereign Technology report.

But resilience is about more than simply achieving a maturity score. It brings together governance, leadership and recovery, Freene noted, and includes board-level conversations about resilience.

In this environment, organisations are asking broader questions of technology partners. “Technical capability and compliance remain important; however, organisations need confidence in how a partner will support operational resilience,” he said.

“This means examining governance, accountability, incident response capability, threat intelligence, sovereign capability, and how providers work with other partners across the environment,” he added.

To achieve resilience, roles, processes and communication channels need to be established and tested well before an incident. “During disruption, there shouldn’t be confusion about who has authority, which services must be restored first, or how different providers will work together.”

For example, in a well-prepared multi-provider environment, a security partner may identify and contain a threat while infrastructure and service management teams isolate affected systems, maintain critical services and coordinate recovery priorities.

“The important factor isn’t any single technology. It’s preparation, shared visibility, rehearsed decision-making and the ability of partners to coordinate quickly around the organisation’s operational priorities,” he explained.

“Resilience depends on individual capabilities as well as on how effectively the entire ecosystem can respond as one,” he told CRN Australia.