Cybersecurity’s foundations are not obsolete. They must be enforceable

Cybersecurity has a peculiar habit of rediscovering its foundations whenever a new technology appears. An Inc. article published on 29 September 2026 presented familiar measures such as rapid patching, restricted privileges, stronger identity, monitoring and recovery planning as responses to AI-accelerated cyber risk.

That list is sensible. Treating familiar controls as a return to the past, however, risks confusing durable principles with adequate implementation. AI does not invalidate established security controls, but neither can organisations simply repeat familiar advice and declare themselves ready. The systems using those controls are changing, the time available to defenders may shrink, and software agents can exercise delegated authority that once belonged mainly to people.

The useful distinction is not between old controls and new controls. It is between controls that exist in policy and controls that remain enforceable under faster attacks and autonomous action. That requires three layers: foundational cyber hygiene, agent-specific limits on authority, and rehearsed containment and recovery.

AI changes the clock

The UK National Cyber Security Centre assesses that AI will almost certainly make cyber intrusion operations more effective and efficient through 2027. Its judgement is that AI will mostly enhance existing tactics rather than create entirely novel threat vectors, although it also warns that technical surprise is likely.

That is a more useful starting point than either extreme in the AI security debate. AI is neither irrelevant automation nor proof that every existing defence has become obsolete. Its most immediate effect may be to compress time.

The NCSC expects AI-enabled tooling to increase attackers’ ability to exploit known vulnerabilities and probably shorten the interval between disclosure and exploitation. This is a forecast, not evidence that every intrusion already involves AI. But it identifies a consequential possibility. If offensive tooling becomes faster while asset discovery, patching and mitigation remain slow, organisations could become more exposed even though the underlying weakness is thoroughly conventional.

In that environment, rapid patching is not nostalgic advice. It is a race condition. Logging is not merely a compliance requirement. It is the evidence needed to understand activity before the investigation window closes. Least privilege is not a slogan about cautious administration. It determines how far a fast-moving failure or intrusion can travel.

A framework is not an outcome

Australia’s Essential Eight remains a strong expression of the foundational layer. It covers application and operating system patching, multifactor authentication, restrictions on administrative privileges, application control, macro restrictions, user application hardening and regular backups.

Yet naming a baseline does not prove that it works consistently. ASD reported that only 22 per cent of surveyed Commonwealth entities achieved Essential Eight Maturity Level 2 or higher across all eight strategies in 2025. It also found that 59 per cent said legacy technology affected implementation, with funding and the absence of a viable replacement among the principal constraints.

Those figures describe Commonwealth entities, not Australian organisations generally. They should not be stretched into a private-sector survey. They nevertheless demonstrate a narrower and important point: even in governed environments with a recognised framework, familiar controls can remain difficult to implement coherently.

This is why telling leaders to focus on the basics can become an evasion. Which systems are covered? How quickly are vulnerabilities identified and treated? Where do privileged accounts persist? Can backups actually support recovery? Who owns the exceptions created for legacy technology? Without measurable answers, a framework can provide the language of resilience without the result.

Limited funding and ageing systems make this demanding. A board cannot wish away a platform for which no viable replacement exists. But constraints strengthen the case for measurement rather than weaken it. Leaders need to know where the baseline fails, what risk they are accepting and which dependency prevents improvement. A comforting checklist conceals those decisions.

Agents turn access into action

The second layer begins when AI can use tools, make external requests or act on organisational systems. At that point, conventional identity and access principles must extend to a non-human actor operating on delegated authority.

Joint guidance published in May 2026 by ASD’s Australian Cyber Security Centre, CISA, NSA and international partners recommends integrating agentic AI into existing security models. It advises organisations to avoid broad or unrestricted access and to begin with low-risk, non-sensitive work. It also calls for clear ownership, continuous runtime authentication, central policy decisions for actions, and tested procedures to detect, contain and recover from agent compromise.

ASD’s September 2026 Information Security Manual controls make the implementation issue more concrete. They require agentic applications to use only the minimum tools and permissions, with authorisation scoped both to the user and the task. They also require central logging of tool invocations, external requests and outputs, and controls that prevent external content from overriding security controls.

This is least privilege redesigned for delegated software. An employee’s permission to access a system should not automatically become an agent’s authority to perform every available action within it. The relevant question is not merely who initiated the task, but what the agent may do, with which tool, for what purpose and under which conditions.

Prompt instructions cannot carry that burden. ASD’s guidance on agentic AI harnesses says prompt injection has no fully reliable technical mitigation. It therefore recommends enforcing restrictions in the harness and surrounding infrastructure, including constrained access and human approval for sensitive or high-impact actions.

The distinction matters. A request inside a prompt is guidance to a model. A policy enforced outside the model is a boundary. Organisations that confuse the two may possess detailed instructions without having dependable control.

Human approval can also fail

There is a reasonable counterargument. Narrow permissions and repeated approvals may reduce the productivity that justified deploying agents. If every routine action stops for consent, the system becomes cumbersome and users may learn to approve requests reflexively.

NIST has warned that excessive human approval prompts can create consent fatigue, undermining the accountability that human involvement is supposed to provide. No supplied evidence establishes a universal threshold for too many prompts, so there is no simple formula. The design principle is still clear: reserve approval gates for consequential actions and give the reviewer enough context to make a meaningful decision.

Human oversight is not effective merely because a person clicked a button. If approvals are frequent, poorly differentiated and rewarded mainly for speed, oversight could become consent theatre. Low-risk activity should operate within tightly enforced limits. High-impact activity should trigger a deliberate decision. That balance preserves utility without treating convenience as a reason for unrestricted authority.

Recovery is a control, not an admission of defeat

The third layer is operational resilience. Security leaders often invoke an assume-breach posture, but the phrase should not be turned into fatalism or a claim that every organisation will inevitably be compromised. Its value lies in engineering for containment, investigation and recovery when prevention fails.

For agents, that means being able to identify ownership, withdraw authority, preserve reliable logs and contain activity without disabling an entire organisation. For the wider environment, it means tested response procedures and backups that support restoration. None of these measures guarantees correct agent behaviour or prevents every manipulation. They can, however, reduce the blast radius and improve the chance of understanding what happened.

A board therefore needs an execution test, not another collection of security tips. How long does it take to discover and address an exposed vulnerability? Which privileged access remains, and why? Does every deployed agent have an owner and a distinct identity? Are permissions limited to a defined task? Which actions require approval? Are tool calls and external requests centrally recorded? When was containment and recovery last exercised?

These questions do not ask whether the organisation has bought an AI-labelled defence. They ask whether policy survives contact with systems that move faster and act with delegated power.

The fundamentals remain fundamental. But their age is not the interesting fact. What matters is whether patching can beat a shrinking response window, whether least privilege governs agents as well as people, whether approval represents judgement rather than habit, and whether recovery has been practised rather than promised. The divide that matters is not old-school security versus AI security. It is stated intention versus enforceable architecture.

Distinguishing a written rule from a boundary that actually constrains access calls for solid knowledge of networks and core security principles. Examine those foundations with The Hack Academy’s online cybersecurity training programme, where self-paced study in networking and cybersecurity fundamentals combines theory with practical exercises.