The Australian Signals Directorate (ASD) recently announced the retirement of the Essential Eight, a move that has sent ripples through the cybersecurity community. But let’s be honest—this shouldn’t come as a shock. Personally, I think this decision is long overdue. The Essential Eight, while a solid starting point, was always a product of its time, designed for on-premises IT in an era before cloud computing and generative AI became mainstream. What makes this particularly fascinating is how it highlights the gap between compliance and genuine resilience. Many organizations treated the Essential Eight as a checklist, a box to tick rather than a foundation for robust cybersecurity. In my opinion, this mindset is precisely why so many companies remain vulnerable despite being 'compliant.'
One thing that immediately stands out is ASD’s shift from prescriptive, technology-specific controls to a focus on outcomes and intent. This isn’t just a semantic change—it’s a philosophical one. What this really suggests is that cybersecurity is no longer about following a rigid playbook but about understanding and mitigating your unique risks. From my perspective, this is a much-needed evolution. The old framework’s fixed maturity ladder often created a false sense of security, with organizations appearing to regress whenever the framework was updated. What many people don’t realize is that this new approach forces companies to think critically about their risk profile, rather than blindly adhering to a one-size-fits-all model.
If you take a step back and think about it, the retirement of the Essential Eight is a wake-up call for organizations to move beyond compliance theater. The framework never addressed critical areas like governance, third-party risk, or data classification—issues that are often the root cause of breaches. This raises a deeper question: Why did so many companies stop at the Essential Eight instead of using it as a starting point? In my view, it’s because compliance is easier to measure than resilience. But as ASD’s move confirms, the landscape is too dynamic to rely on static frameworks.
So, what should organizations do now? First, don’t panic. The foundational controls like patching, multi-factor authentication, and backups aren’t going anywhere. What’s changing is the context and scope. A detail that I find especially interesting is ASD’s emphasis on agentic AI as a future domain. Most organizations are woefully unprepared for AI-related risks, such as prompt injection attacks or non-person identities. This isn’t a problem for tomorrow—it’s a gap that needs addressing today.
Here’s my advice: Treat this transition as a governance shift, not a procurement exercise. The new Essentials series will prioritize demonstrating why your controls are appropriate for your risk profile, not just whether you’ve implemented them. This means involving leadership and risk teams, not just IT. It also means getting an honest baseline of your current exposure, independent of any framework. Organizations that were already looking beyond the Essential Eight—focusing on governance, supply chain risk, and data classification—will find this transition far smoother.
What this moment underscores is that resilience is about understanding your actual risk, not ticking boxes. The Essential Eight was never the endgame; it was a starting line. ASD’s decision is a reminder that cybersecurity is a journey, not a destination. Personally, I’m excited to see how this shift pushes organizations to think more critically about their defenses. Because, at the end of the day, compliance doesn’t stop breaches—resilience does.
