ACSC Cyber Security Awareness Month 2025: Key Themes for Australian Businesses

Week 1: Event Logging

Event log management is one of the most powerful tools in cyber defence. Reliable logs provide two crucial benefits:

• Forensic capability – Incident responders can’t reconstruct an attack chain without trusted logs. If attackers delete or alter log files, your ability to respond and prevent recurrence is limited.
• Threat hunting – A Security Information and Event Management (SIEM) platform collects data across devices, enabling proactive detection of threats before ransomware or phishing attacks fully unfold.

For First Focus clients on F-Protect S3 and above, this capability is already included through CW SIEM (our SIEM + SOC service in the F-Protect S4 catalogue).

Week 2: Legacy Technology

It’s no coincidence that this theme lands the same week Windows 10 reaches official end of life. Attackers exploit outdated systems that organisations can’t or won’t replace — creating open doors for breaches that require little technical skill.

In fact, a full quarter of the Essential Eight mitigation strategies is dedicated to vulnerability management for this reason. If your business relies on legacy, internet-facing systems, now is the time to act:

• Replace or upgrade where possible.
• Isolate legacy systems if replacement isn’t viable.
• Implement compensating controls and formal risk treatment plans.

Leaving outdated technology in the “too hard” basket only increases risk. It’s a prime opportunity for consulting and remediation.

Week 3: Supply Chain

From SolarWinds and Kaseya to Log4J, recent history is full of supply chain attacks that caused widespread disruption. The lesson? Even if your internal systems are secure, third-party software and vendors can be your weakest link.

Every organisation should have a repeatable process for supply chain risk management, including:

• Conducting and updating risk assessments for critical vendors and SaaS providers.
• Monitoring supplier announcements and vulnerability feeds.
• Ensuring cost-effectiveness is balanced with security and compliance requirements.

This isn’t just an IT exercise — it’s a business continuity issue. Without structured oversight, your organisation may face cyber incidents through no fault of your own.

Week 4: Quantum Readiness

Looking further ahead, the ACSC expects post-quantum cryptography (PQC) to be a standard requirement for secure ICT environments by 2030. While quantum threats may feel distant, preparation starts now.

The most practical first step? Develop a Cryptographic Control Policy that:

• Discourages or bans proprietary encryption without approval.
• Documents what encryption algorithms are used within your business.
• Ensures only current, secure standards are deployed.

By getting policies in place today, businesses will have a smoother transition to PQC in the years ahead.

Turning Awareness Into Action

Cyber Security Awareness Month isn’t just about posters and reminders — it’s about driving change. Here’s how different roles can put these themes into practice:

• Technology Account Managers (TAMs): Use this month to reopen conversations with clients about outdated systems or risk areas.
• Service Desk teams: If you see legacy software or unsupported devices during day-to-day support, escalate them — don’t let them linger.
• Technical staff: Ensure vulnerability data feeds are in place for the products you manage. If a supplier pushes out a critical alert, you need to know immediately.

Every team has a part to play. Whether it’s raising opportunities, pushing for upgrades, or monitoring risks, small steps add up to stronger security outcomes.

Conclusion: Building Resilience Through Awareness

Cyber Security Awareness Month 2025 highlights both immediate risks and future challenges. From securing logs and replacing outdated tech to managing supply chain partners and preparing for quantum threats, the themes from ACSC provide a clear roadmap for action.

👉 Mid-sized Australian businesses that take proactive steps now won’t just reduce cyber risk — they’ll build a foundation of resilience that lasts well beyond October.