ACS Industry Insights. Beyond IT: Why cybersecurity is now everyone's business
Industry Insights is a long-running event series from ACS. It hosts leaders from across the tech sector who share their invaluable insights and knowledge from behind the scenes.
This month, as part of our Cyber-strong Australia campaign, where we are discussing what it takes to build Australia’s world-class cybersecurity profession, we were delighted to host Christopher Neal, Group Chief Information Security Officer at Ramsay Health Care.
Chris’s career stretches over 20 years and includes roles at Qantas, Telstra and the Ministry of Health Cybersecurity Advisory Panel in Singapore. As Group CISO at Ramsay, Chris leads security operations across Australia and nine international markets, driving group-wide adoption of frameworks, technologies and governance structures.
For Industry Insights, Chris was in conversation with David Norris, MACS Snr CP, Chair of ACS’s Technical Advisory Board – Cybersecurity Committee. In a wide-ranging interview that explored the changing nature of cybersecurity and the opportunities and risks of AI, Chris explained why protecting organisations takes more than technology, and why people, culture and curiosity matter more than ever.
Here are five insights from the conversation:
1. People are at the heart of cyber resilience
Cybersecurity may be driven by technology, but it's people who ultimately determine how resilient an organisation really is.
As Chris explains, "Organisational resilience cannot just be a technology problem. It has to be technology and culture."
Even the most sophisticated security systems are only as effective as the people who manage them, the decisions they make and the organisational culture that supports them.
Building resilience means developing a workforce with the skills, knowledge and confidence to identify risks, respond to threats and keep essential services running when systems fail.
This perspective reinforces the importance of investing in people alongside technology. As cyber threats evolve and organisations become increasingly connected, developing capable, accountable technology professionals is critical to protecting businesses, communities and Australia.
Ultimately, it's people who make the difference between having cybersecurity systems and being cyber resilient.
2. Resilience is a cultural challenge, not just a technical one
Organisations invest heavily in security technology, but Chris argues that technology alone cannot guarantee resilience. "We need to get better at patching, but if we were going to patch our way out of this problem, we would have sorted that 20 years ago."
Instead, organisations need to prepare for the possibility that systems will fail, attacks will succeed, and operations will be disrupted. That means building business continuity into everyday processes and ensuring people understand what to do when technology isn't available.
"Organisational resilience cannot just be a technology problem. It has to be technology and culture,” adds Chris.
For technology professionals, the lesson is clear: cybersecurity maturity isn't simply measured by the strength of your systems. It's also reflected in how well your people and processes respond when those systems fail.
3. AI's greatest risk might be how much we trust it
AI offers enormous opportunities for healthcare, from supporting clinical decisions to reducing the administrative burden on doctors and nurses. But Chris raises a fascinating paradox: as AI becomes more accurate, people may become less vigilant.
He describes a scenario in which clinicians carefully review AI-generated transcripts when they're only 75% accurate. But when accuracy reaches 95%, human nature may lead them to scrutinise the results less closely.
In a clinical setting, even a small error can have serious consequences. Confusing milligrams with micrograms in a medication record, for example, could create a significant patient safety risk.
It's a compelling illustration of the relationship between technological capability and human accountability.
Chris also challenges the tendency to attribute every emerging security concern to AI. When AI tools expose information that employees already have permission to access, the underlying issue may be poor access management rather than AI itself. "That's not an AI problem. That's an access control problem."
As organisations accelerate AI adoption, getting the fundamentals right remains essential.
4. Cybersecurity shouldn't be the handbrake
For Chris, effective cybersecurity is about enabling an organisation to operate safely, not preventing it from getting things done. "I never want to be the handbrake to happiness," he says.
It's a memorable philosophy with serious implications. When security controls make people's jobs unnecessarily difficult, employees may find ways around them, potentially introducing even greater risks.
Nowhere is this tension more apparent than in healthcare.
Isolating a compromised laptop might be a straightforward security decision. But what if the compromised device is being used during heart surgery?
The answer requires more than technical expertise. It demands an understanding of clinical workflows, operational priorities and the consequences of security decisions.
It's a powerful reminder that good cybersecurity must work with the business, not against it.
5. The best cybersecurity professionals never stop learning
Beyond the technology and organisational challenges, Chris offers valuable advice for ACS members building careers in cybersecurity.
His perspective challenges the assumption that cybersecurity must be someone's first technology specialisation. "I don't necessarily know cybersecurity is the first career in technology," he says.
Experience in systems administration, networking, programming and other technical disciplines can provide a valuable foundation for understanding how systems operate and how they can be compromised.
But technical experience is only part of the equation. Chris emphasises curiosity, experimentation and continuous learning as essential qualities for anyone hoping to succeed in a field that never stands still.
For emerging professionals and experienced practitioners alike, Chris’s message is important: building a successful cybersecurity career is as much about developing the way you think as expanding what you know.
Watch the full conversation
From the operating theatre to the boardroom, Christopher Neal's insights reveal how cybersecurity is evolving into a discipline that demands technical expertise, business understanding and strong leadership.
Chris and David’s conversation explores what it takes to protect increasingly connected organisations, how to balance innovation with risk, and why trust, transparency and continuous learning are fundamental to success.
Whether you're a cybersecurity specialist, technology leader or professional looking to broaden your expertise, this ACS Industry Insights interview offers practical perspectives from the frontline of enterprise cybersecurity.
Watch the ACS Industry Insights interview with Christopher Neal and discover what it takes to protect the connected enterprise.