In Sydney last month, Orro and Splunk sat down with security and technology leaders from banking, utilities and logistics. Nobody argued against bringing IT, OT, security and operations together. The real conversation was about how to do it, and how to pay for it.
By Stu Long, Chief Technology Officer, Orro
On 21 October, I co-hosted a lunch in Sydney with Craig Magee, Chief Technology Officer for Splunk in Asia Pacific. Around the table were senior technology and security leaders from banking, utilities and logistics, several of them in the thick of joining up their IT and operational technology (OT) environments. It was a guided discussion rather than a presentation, and it produced some of the most candid conversation I have heard this year.
I expected to spend time making the case for convergence. I didn’t need to. Nobody in the room argued against it. Joining up IT and OT environments is only part of the picture: the teams that build, run and secure them, across DevOps, SecOps and NetOps, have to converge too. That case has been made. What people wanted to talk about was how to do it, and how to do it within the budgets they actually have.
Three themes kept coming back, and each connects to a much broader shift in the market.
Fighting AI with AI is now an operating requirement
The strongest consensus of the afternoon was that the cyber teams and processes most organisations run today were not built for AI-driven attack chains. Several leaders described the same problem from different angles. Attackers now move from reconnaissance to access to lateral movement faster than a human-paced process can follow, and adding analysts does not close that gap.
The national picture says the same. ASD’s latest Annual Cyber Threat Report describes AI as “the defining force in the cyber threat landscape” over the past 12 months (ASD, cited in Cyber Daily, 2026). Cisco’s Relentless Defense research found that 93% of Australian organisations suffered a material cyber incident in the past year, and more than 37% of those incidents involved an AI-enhanced attack (Cisco, cited in SecurityBrief Australia, 2026).
“Attackers are using AI to compress work that used to take weeks into hours, and they don’t need permission to experiment. Defenders can’t answer that by hiring their way out. What we’re seeing across Asia Pacific is that the organisations getting ahead put AI to work on the volume, so their people can spend their time on the judgement calls that actually need a human.” Craig Magee, Chief Technology Officer, Splunk APAC
Yet the gap between agreement and action is wide. Splunk’s CISO Report 2026 found that only 6% of the 650 CISOs surveyed had fully deployed agentic AI in security operations (Splunk, cited in SecurityBrief, 2026). That matched the room. Everyone agreed AI has to meet AI. Far fewer were confident they knew where to start.
Leaders want AI clarity, not AI theatre
That uncertainty fed the second theme. The leaders around the table wanted an honest view of what AI actually delivers against what it costs: not projections, but productivity gains they could defend to a CFO.
Their caution is well founded. Gartner has predicted that over 40% of agentic AI projects could be cancelled by the end of 2027 because of escalating costs, unclear business value or inadequate risk controls (Gartner, cited in New Electronics, 2025). Splunk’s State of Observability 2026 report, released the day before our lunch, found that 55% of organisations say they cannot control AI costs, and 57% say their telemetry costs have eclipsed the cost of the infrastructure being monitored (Splunk, 2026).
When the conversation turned to agentic AI, the interest was firmly in practical value. The questions were about which workflows to hand over first, how to keep a person accountable for the decisions that matter, and how to measure the result. My view is that the most defensible starting point is the work your people already dislike: alert triage, evidence gathering and the repetitive correlation that consumes an analyst’s day. Those tasks are measurable, the baseline is known, and success frees up skilled people rather than replacing their judgement.
A second point came through clearly. An agent is only as good as the data it can see. If telemetry from the network, the plant and the security stack sits in separate places, an agent will make decisions with half the picture. Cisco’s research found that 42% of Australian organisations say critical insights are missed because data sits out of reach (Cisco, cited in SecurityBrief Australia, 2026). Getting the data foundation right is the unglamorous work that decides whether agentic AI pays off.
Mature on paper is not the same as mature in practice
The third theme is the one I keep coming back to. Several leaders were frank that their policy maturity and their operational maturity are two different things. The framework documents look strong. What would actually happen at 2am on a bad night is less certain. The first job, the room agreed, is to define that gap honestly and decide what to close first.
This landed hardest with the utilities, for whom the SOCI Act is front of mind. It was echoed the following week, when Orro hosted a roundtable of operators from water, telecommunications, airports and food production at the Cyber Resilience Summit NSW. Patching dominated that discussion, but the more consequential gaps sat underneath it. Participants described an incomplete understanding of their OT environments, even where discovery tools were already in place. They described experienced engineers retiring and taking hard-won knowledge with them. One operator had tested how long it could run manually and found the answer was three days. Others doubted they could do better, but had never tested it.
Set that against ASD’s revised CI Fortify guidance, which sets a three-month target for how long an operator should be able to run its essential services completely disconnected from other systems and the internet (iTnews, 2026). Whether that horizon applies to a particular organisation depends on its assets and its obligations under the SOCI Act, and should be confirmed with legal advisers. The direction, though, is clear. Regulators increasingly want evidence that resilience works, not documents saying it should. Orro looked at that shift earlier this year in what the SOCI reforms’ “relevant operator” concept means.
The maturity gap shows up in the boardroom too. Cisco found that 40% of Australian organisations say the security metrics they track are too technical to persuade executives (Cisco, cited in SecurityBrief Australia, 2026). A dashboard can show patch completion improving while a critical service still cannot be recovered by the team on shift. Closing the gap means reporting what has been demonstrated, not just what has been deployed.
The budget answer was hiding in operations
That brings me back to the argument about money, and to the moment in the lunch I found most useful. One large organisation described the gains it was already seeing from observability with security layered over the top, and said it wanted to go further. Others picked it up quickly, and the tone of the conversation changed.
The insight was that observability drives business outcomes as much as security outcomes. Most of the value came from integrating with the operational side of the business, in IT operations and OT operations, rather than sitting with the security team alone. When network, operations and security teams work from the same data, they find faults faster, avoid outages and make better investment decisions. Security still benefits, but it is no longer carrying the business case on its own.
The research supports this. Splunk’s State of Observability 2026 found that 77% of respondents now troubleshoot alongside security teams, up from 62% a year earlier, and data sharing between the two has risen from 74% to 84% (Splunk, 2026). Among the most mature organisations, 54% say observability has yielded at least $5 million in annual business revenue, compared with 28% of the rest (Splunk, 2026). Closer to home, Cisco found that only 46% of Australian organisations say their security, networking and IT teams operate as one team with shared visibility and tools (Cisco, cited in SecurityBrief Australia, 2026). That is the opportunity, in plain terms.
“What struck me in that room was how quickly the conversation moved from security to operations. When the network, operations and security teams are looking at the same data, you find problems faster, and you find the business case too. More often than not it shows up in uptime and better decisions before it ever shows up in a security report.” Craig Magee, Chief Technology Officer, Splunk APAC
That is the thinking behind pairing Cisco networking with Splunk data intelligence as a foundation for visibility from the plant floor to the boardroom. The point is not another security tool. It is one view of how the business is actually running, which security, operations and leadership can all act on. The costliest problems tend to sit between the platforms, not inside any one of them.
Where a practical path starts
Few organisations have the budget or headcount for a multi-year transformation programme, and most don’t need one. From what I heard, and from what we see across Orro’s work, a practical path has four steps. None of them starts with a purchase.
Start by measuring the gap between policy and practice on one critical service. Test a fallback, time a recovery, and record what was demonstrated rather than what is documented. Then pick one high-toil workflow, such as alert triage, and apply AI there with a clear baseline and a known cost, so the productivity conversation rests on your own numbers. Next, bring network, operations and security data together around a shared outcome like uptime, and let the operational value help fund the security value. Finally, design your data and telemetry for the agents you will eventually run, because they will only ever be as good as what they can see.
Convergence is no longer the question. Doing it in an order your organisation can afford is.
My thanks to Craig and the Splunk team for co-hosting, and to everyone at the table for their time and their candour.
If your organisation is regulated under the SOCI Act, Orro’s short SOCI survey takes a few minutes and tells you who to bring into a conversation with us, and what to check beforehand so the time is well spent. If you’re working through IT/OT convergence and want to compare notes on where to start, book a conversation with Orro.
Sources & Further Reading
- Orro. (2026). The Blind Spots Live Between the Platforms.
- Orro. (2026). Beyond the Responsible Entity: What SOCI’s ‘Relevant Operator’ Concept Means for You.
- Australian Signals Directorate. (2026). Annual Cyber Threat Report 2025–26.
- Cyber Daily. (2026). Report: Aussie cyber agency received more than 82,000 cybercrime reports in 12 months. (free registration may be required)
- Splunk. (2026). State of Observability 2026: Avoiding the Hidden Costs of AI Agents.
- SecurityBrief Australia. (2026). Australian firms hit by cyber incidents as AI threats rise.
- Cisco. (2026). Relentless Defense Report.
- iTnews. (2026). ASD to critical infrastructure ops: be ready to isolate systems for three months.
- Australian Signals Directorate. (2026). CI Fortify: Advice for isolating vital systems.
- SecurityBrief. (2026). CISOs cautious as agentic AI adoption in security lags.
- Splunk. (2026). The CISO Report 2026. (registration required; listed without link)
- Australian Signals Directorate. (2025). CI Fortify: Guidance for Australian critical infrastructure service continuity and resilience.
- New Electronics. (2025). Over 40% of agentic AI projects could be cancelled by 2027.
- Gartner. (2025). Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027. (listed without link per house rule)