War with Iran: alerts for Australia's critical infrastructure operators and Australian society
In Australia’s National Interest - Security of Critical InfrastructureShow Notes
Pentagram Advisory Pty Ltd invites you to watch and / or listen this recording of our recent article about the risks that war with Iran poses to Australia's critical infrastructure entities.
Whilst critical infrastructure entity attack surfaces span a myriad of threat vectors, including cyber attacks, Pentagram's article focuses on the people component - those people employed within Australia's critical infrastructure entities as possible sources of harm.
Iranian expatriates in Australia are of course especially vulnerable to Iranian government interference, coercion, and espionage. Australia, as a compassionate pluralist society, will see our first instinct be to offer assistance and protection to this group. But we must also appreciate that there is a risk, likely from a very few Iranians, that there could be insider threats, either coerced of volunteering to undertake acts of harm against Australia's critical infrastructure.
We also must appreciate that Khamenei was not just head of the Iran theocracy, but was a global Shia leader and sponsor of terror. On that basis, non-Iranian Shia and anti-Westerners may also be aggrieved by Khamenei's assassination at the beginning of the war, and by the ongoing war. Such people may also be coerced or volunteer to cause harm in Australia.
This is a challenging topic, rife for rendering by some people as a dog whistle for discrimination based on religious or ethnic affiliation. That can be one way to view this matter.
Another way to view discussion about this threat is to admit to the reality that we have evidence of Iranian government acts that have, and continue to, intimidate Iranian expatriates living in Australia. Further, the Iranian Government has sponsored violence in Australia. And that was before the war!
Do we ignore reality, and the increased likelihood of Iranian Government action against Australia (there are reports of increased cyber attacks from Iranian sources), or do we shy away from known and potential harms to Australia for fear of offending a small group of people?
Remember, vanishingly few people will evolve to become pro-Iranian insider threats, more are likely to be coerced to act or volunteer to act. Either way, the harm is the same. To protect Australia's critical infrastructure, a key foundation of Australia's national security, leaders need to understand the reality of the threats we face and that requires the courage to engage with difficult challenges as explored in the article.
More from In Australia’s National Interest - Security of Critical Infrastructure
This video explores the Albanese Labor Government's agenda, from 2023 to 2026, to change the discussion about superannuation funds holdings from compulsory investments that must deliver maximum financial benefit to the fund holders to be used as a source of capital to use, in the 'national interest', to fund the Labor Government's policies and ideological programs. This is tantamount to nationalising those superannuation funds.
What does “suitable” really mean for a critical worker under section 9A of the Enhanced CIRMP Rules 2026? In this episode, Marina Shteinberg and Tim Slattery explore who makes the suitability decision, who owns the risk, and how ongoing assurance should work in practice. We examine the three pathways to critical component access — AusCheck plus the responsible entity’s suitability assessment, a relevant NV1+ security clearance, and the CIRMP risk-managed pathway — and explain what each pathway establishes, who makes the key decisions, and what responsibility remains with the organisation. We also look at ongoing suitability, the relationship with insider threat capability, and practical implementation outcomes for organisations preparing for the enhanced personnel security requirements under section 9A.
Oztopia: Academia explores the behaviour of some Australian academics and higher learning institutions who choose to collaborate with academia hostile states including China, Russia and Iran.
In this episode, Tim Slattery and Marina Shteinberg, Co-Founders and Directors of Pentagram Advisory, unpack the personnel security implications of section 9A of the Enhanced CIRMP Rules 2026 and what responsible entities should prioritise ahead of the 10 June 2027 and 10 June 2028 implementation milestones. They explore how section 9A strengthens expectations around access management, critical worker identification and suitability, ongoing personnel assurance and workforce lifecycle security. The discussion also looks at why implementation should begin with risk, how to think about the two layers of access — to the critical infrastructure asset and to critical components — and why organisations need to connect people, roles, access, suitability and assurance within a coherent enterprise personnel security architecture. The episode concludes with a broader question of trust: how organisations can build appropriate assurance around the trust they grant to employees, contractors and third parties with access to their most critical assets, systems and information — their organisational “crown jewels”.
How much of what we judge to be a material security risk is driven by evidence — and how much by what we can most easily remember? In this episode, Tim Slattery and Marina Shteinberg of Pentagram Advisory explore the availability heuristic and what behavioural science can teach us about security risk management and decision making under uncertainty. In an era of heightened uncertainty, Boards, executives and security leaders are required to make consequential decisions with information that may be incomplete, uneven or constantly changing. Recent incidents, personal experience and highly visible threats can quickly dominate attention — while less familiar but potentially material risks remain outside the spotlight. Tim and Marina examine how availability bias can influence security risk assessment, risk prioritisation and investment decisions, and why a formal risk management framework does not remove human judgement — it structures where that judgement is exercised. They also consider practical ways to strengthen decision-making through broader evidence, structured challenge and greater transparency around the reasoning behind risk ratings. Because what is memorable is not necessarily what is material. And unfamiliarity is not evidence of safety.