CyberCon 2026: The Biggest Cybersecurity Lessons Weren’t About Technology

By Louise Ridlen, Founder and CEO, Peppermint iT · 23 October 2026

The key takeaway: Cybersecurity depends on people as much as technology. These ten lessons explore trust, AI, human judgement and reporting without shame, with practical priorities for Australian businesses.

Three days at CyberCon 2026 in Melbourne, and after more than 30 years in IT, I’m still amazed by how much there is to learn!

Anisha and I headed to CyberCon to explore the latest developments in cybersecurity, discover new technologies and bring fresh ideas back to our clients at Peppermint iT. And we certainly did that.

But what surprised me was how many of my biggest takeaways weren’t really about technology at all.

They were about people. How we think, how we make decisions, how criminals manipulate trust, why victims sometimes stay silent and how curiosity can help us navigate an increasingly complicated digital world.

From Sir Tim Berners-Lee, the inventor of the World Wide Web, to Geoff White’s extraordinary investigations into Russian-linked cybercrime gangs, there were some fascinating stories. Here are the ten lessons I’m bringing home.

AISA’s Australian Cyber Conference took place at the Melbourne Convention & Exhibition Centre on 14–16 October 2026. Explore the official programme.

1. Sir Tim Berners-Lee: the web was built to connect us. Now we have to protect it.

One of the absolute highlights was hearing Sir Tim Berners-Lee, who invented the World Wide Web in 1989 while working at CERN.

Imagine creating something that fundamentally changed the way the entire world communicates, learns, works and connects!

What I find fascinating isn’t simply the technology he created. It’s the vision behind it. The web was designed around sharing information and making connections possible.

Today we have AI, cloud computing, digital identities and technologies that would have seemed unimaginable when the web began. But we’ve also created new opportunities for criminals and new challenges around privacy and trust.

It made me think about our responsibility as technology professionals. It’s not enough to make technology more powerful. We have to make it safer, more accessible and more trustworthy.

2. Geoff White: inside the extraordinary world of Russian-linked cybercrime gangs

This was one of the most fascinating sessions of the conference!

Geoff White is an investigative journalist and author who has spent years getting inside the world of organised cybercrime. His work includes The Lazarus Heist, investigating North Korean cybercrime, and the BBC’s Cyber Hack: The Conti Files.

What makes Geoff’s reporting extraordinary is that he goes beyond the technology to understand the people behind these criminal operations. And they’re not always what you might imagine.

These aren’t necessarily isolated hackers sitting alone in dark rooms. They’re organised criminal enterprises with structures, management, financial incentives and internal politics.

In 2022, internal communications from Conti, a Russian-linked ransomware group, were leaked following divisions over Russia’s invasion of Ukraine. The messages offered an extraordinary view of how the gang operated.

There were workplace conversations, disagreements, internal relationships and the sorts of organisational problems you’d expect to find in an ordinary business. Except this business was built around stealing information, extorting victims and disrupting organisations. Research analysing the leaked chats examines Conti’s operations as a business, including recruitment, roles and profit structures.

It’s an uncomfortable reminder that cybercrime has become an industry. And like any industry, it evolves. The criminals collaborate, specialise, share tools and adapt their business models.

My biggest takeaway? We need to understand the people and motivations behind cybercrime, as well as the technology they use. Because when we understand how criminals think and operate, we can make better decisions about protecting our businesses.

For anyone interested in this extraordinary world, look for Geoff’s BBC podcast Cyber Hack: The Conti Files. There’s also a Darknet Diaries conversation with Geoff about Conti, with links to the BBC series.

3. Cybercrime, shame and the people who suffer in silence

Another session really stayed with me. We heard about the shame surrounding cybercrime and how that shame can stop people from reporting what’s happened. Some people may wait a long time before telling anyone.

And this becomes particularly heartbreaking when we’re talking about children and young people experiencing sextortion.

Imagine being a teenager who has been manipulated or blackmailed online. The fear isn’t necessarily just about the criminal. It’s about what your parents might think. What your friends might say. Whether someone will blame you.

So you stay silent. And that silence can give criminals even more power.

Australia’s eSafety Commissioner provides guidance on sexual extortion, including reassurance that it is not the victim’s fault and practical ways to get help.

It made me think about how we approach cybersecurity education. We spend so much time telling people what not to click, what not to share and how not to make mistakes. But perhaps we need to spend just as much time telling them something else:

If something goes wrong, tell someone. You will be supported, not judged.

The same principle applies in business. If an employee clicks a phishing link or accidentally shares information, we need them to report it immediately. We want them to feel safe asking for help.

This has inspired something I’m particularly passionate about exploring further: Cybersecurity Without Shame. Because protecting people isn’t just about preventing incidents. It’s also about how we respond when something goes wrong.

4. Tané Hunter: better meetings can challenge our biases

Another brilliant session came from Tané Hunter of Future Crunch, a scientist, author and former cancer researcher with experience building AI and machine learning models.

My notes from his session centred on cognitive bias, adaptability, curiosity and how our own thinking can sometimes be our biggest limitation. Three practical techniques really stood out.

Change who speaks first

If the most senior person shares their opinion first, how likely is everyone else to challenge it?

Price the default

We often consider the cost of making a change, but what’s the cost of doing nothing? In cybersecurity, sticking with outdated systems or inadequate protection is still a decision.

Assign the argument against

Give someone the responsibility of challenging the preferred option. Better decisions come from considering different perspectives.

I love how practical these ideas are. They’re relevant to cybersecurity, leadership, innovation and everyday business decisions.

Another concept that resonated was holding strong opinions lightly. Have confidence in your thinking, but be willing to change your mind when new evidence appears. Sometimes our biggest risk is what we’re absolutely certain we know.

5. AI has the data. Humans make the meaning.

Of course, AI was a huge topic throughout CyberCon. And rightly so.

AI is transforming both sides of cybersecurity. It offers defenders new ways to analyse information and detect unusual behaviour. ASD’s 2024–25 threat report assesses that AI almost certainly helps malicious actors operate faster and at greater scale.

One message particularly resonated with me: AI has the data; humans make the meaning.

I love that. Because information alone doesn’t necessarily lead to good decisions. We still need context, experience, judgement and empathy.

I’ve seen enormous technological change throughout my career. Every generation of technology has changed how we work. AI is another extraordinary chapter. I’m curious about what we can achieve with it.

6. Intelligent optimism: understand the risks without fearing the future

This might be one of my favourite concepts from the entire conference: intelligent optimism.

To me, that means understanding the challenges, examining the evidence and choosing to approach the future with curiosity and confidence.

Technology will keep changing. Cybercriminals will keep adapting. And some of the things we believe today will need to be reconsidered tomorrow.

That means we need to keep learning, challenging our assumptions and adapting.

For me, optimism and good cybersecurity go hand in hand. You recognise the risks, prepare for them and create the confidence to move forward.

7. Serious play: why curiosity matters

Another theme I loved was the importance of play, experimentation and curiosity.

Somewhere along the way, we seem to have decided that being professional means always being serious. But play is how we explore possibilities, experiment with ideas and learn without having all the answers.

What if we approached more challenges with a “Yes, and” mindset? What could happen if we tried something different? What assumptions might we challenge?

Cybersecurity requires creative thinking because threats evolve constantly. We need people who are willing to ask questions and explore unfamiliar territory.

And I think there’s room for a little more fun in the process! At Peppermint iT, making technology approachable is a big part of what we do.

8. The cybercrime numbers every Australian business should understand

While the human stories were among my strongest takeaways, the numbers reinforce why cybersecurity must remain a business priority.

According to the Australian Signals Directorate’s Annual Cyber Threat Report 2024–25:

• ReportCyber received more than 84,700 cybercrime reports, equivalent to approximately one every six minutes.
• The average self-reported cost of cybercrime per report was $56,600 for small businesses.
• For medium businesses, the average self-reported cost per report was $97,200.

These are figures for the 2024–25 financial year, based on reporting to ASD’s ACSC. They do not capture every cybercrime in Australia, and an average cost per report is not the cost experienced by every business.

For a small business, a serious cyber incident can affect far more than the bank balance. It can disrupt operations, compromise client information, damage relationships and take enormous amounts of time to recover from.

Cybersecurity is about protecting your business’s ability to keep operating, serving customers and growing.

9. Keren Elazari: think like a hacker to build stronger defences

Another highlight was Keren Elazari, known as The Friendly Hacker. She is a senior researcher at Tel Aviv University’s Blavatnik Interdisciplinary Cyber Research Center and the founder of BSidesTLV and Leading Cyber Ladies.

Her keynote, Confessions of a Friendly Hacker: Why Attacker Thinking Is Our Best Defense in the AI Era, explored the value of a hacker’s mindset as AI makes attacks faster, cheaper and more accessible. Drawing on real breaches and international cases, she challenged the idea that more automation alone will solve the problem.

The practical lesson for business owners is to look at your systems from an attacker’s perspective. Where are the assumptions? Which account has more access than it needs? Could an urgent payment request bypass your usual checks?

For us at Peppermint iT, that means making time to test those assumptions, welcome questions and turn what we learn into stronger protection. It connects beautifully with the wider theme of this conference: human curiosity and judgement remain essential as technology evolves.

10. What we’re bringing back to Peppermint iT

After three days of learning, exploring new technologies and having plenty of laughs with Anisha, I came home with a notebook full of ideas. But five priorities stand out for our clients.

• Make cybersecurity part of everyday business. Discuss it regularly, with clear responsibilities and practical next steps.
• Create a culture where people report incidents early. No blame, no shame. Just clear processes and support.
• Use AI thoughtfully. Embrace the opportunities while understanding the risks and maintaining human oversight.
• Challenge your assumptions. Don’t assume your business is secure simply because you use Microsoft 365, Google Workspace or Apple devices. How your environment is managed, monitored and protected matters.
• Keep learning and improving. Cybersecurity is something you continually strengthen.

ASD’s small-business how-to guides offer practical starting points: multi-factor authentication, strong unique passwords, updates and regular backups.

At Peppermint iT, our goal is to help business owners understand where they stand, what matters and what practical steps they can take next. Explore our business cybersecurity support.

The biggest takeaway? Technology is still about people.

When I think back over CyberCon, it’s interesting how the different sessions connected.

Sir Tim Berners-Lee reminded us why the web was created. Geoff White showed us the very human world behind organised cybercrime. The conversations about shame reminded us that victims need compassion. Tané Hunter challenged us to question our own thinking. Keren Elazari showed why an attacker’s perspective can strengthen our defences. And the discussions about AI reinforced the importance of human judgement.

Different speakers. Different perspectives. One common thread.

Technology keeps changing. The importance of people doesn’t.

We need technical expertise to protect our systems. Curiosity to challenge our assumptions. Good judgement to use AI responsibly. And compassion to support people when things go wrong.

The future of cybersecurity is about building more confident, informed and resilient people and businesses, alongside stronger defences.

And after more than 30 years in IT, that still makes me excited about what comes next.

How cyber-ready is your business?

Not sure how well your business is protected? Peppermint iT’s Cyber Framework Protect approach helps businesses identify security gaps, understand their risks and take practical steps towards better protection.

Take the PROTECT security check

Prefer a conversation? Talk to Peppermint iT.

Good cybersecurity should give you confidence, not create confusion.

Peppermint iT | Tech infused with care.

Frequently asked questions

What were Peppermint iT’s biggest lessons from CyberCon 2026?

The strongest themes were trust, human judgement, curiosity, responsible AI and making it safe to report cyber incidents. Technical protection and a supportive culture work together.

What does cybersecurity without shame mean?

It means helping people report concerns early by responding calmly, offering support and following clear processes. Accountability and learning remain part of the response.

How much does cybercrime cost Australian small businesses?

ASD’s Annual Cyber Threat Report 2024–25 gives an average self-reported cost of $56,600 per small-business report. This describes the 2024–25 reporting period and is not the loss experienced by every business.

Where should a business start?

Identify who to contact about a concern, enable multi-factor authentication, keep software updated and check that important data can be recovered from backups. Review AI use and payment verification processes with your team.

Further reading

• AISA CyberCon 2026 official programme
• Geoff White on Conti, with links to BBC’s Cyber Hack: The Conti Files
• Money Over Morals: a research analysis of Conti’s business operations
• ASD Annual Cyber Threat Report 2024–25
• eSafety: sexual extortion advice and support

This is a personal reflection on conference themes, rather than a transcript. Keynote notes are presented as Louise’s takeaways. Speaker details and ASD figures were checked on 23 October 2026.

About the author

Louise Ridlen is Founder and CEO of Peppermint iT. After more than 30 years in IT, she remains passionate about helping people feel confident with technology. Meet the people behind the care.

CyberCon in pictures

‍

‍