Chloe Harpley and Dr Huon Curtis 
Last month, Anthropic released Claude Mythos – an AI model capable of discovering zero-day vulnerabilities at scale, across every major operating system, faster than any human team. The physics of cyber threats have changed again, and the gap between attacker capability and defender readiness is widening faster than any legislative framework anticipated.
The Security of Critical Infrastructure Act (SOCI Act) was written in that earlier world, and it shows.
Dr Jill Slay AM’s independent review of the SOCI Act makes uncomfortable reading for those working across critical infrastructure and cyber security. Approximately 70 per cent of the sentiment expressed across more than 600 town hall participants was negative. Operators aren’t rejecting the act’s purpose. In fact, respondents widely support the need for the framework. What they’re rejecting is its execution: it’s too reactive, too slow, and structurally unable to keep pace with a threat environment that has changed beyond recognition since 2018.
The culture problem is as serious as the legislative one
One of the review’s most striking findings isn’t about law, but rather the attitude of people deeply embedded in SOCI compliance. The review concluded that the majority of people in these roles have no meaningful emotional connection to the national security purpose of the work. Penalties, when they exist at all, are widely seen as easier to pay than to comply with. Boards, respondents noted, simply don’t care. The result is a sector optimising for attestation cycles and audit readiness, not for the adversary.
That’s the wrong target.
Mandatory sharing: the sector has spoken
For years, the debate around cyber threat intelligence (CTI) sharing has been framed as a question of appetite: do operators actually want to share? The Slay Review answers that definitively. Mentimeter data from more than 460 town hall attendees shows a majority favour mandatory over incentivised CTI sharing. This is no longer a matter of preference. The question has shifted to implementation: how do we build the institutional architecture that mandatory sharing requires?
The answer matters enormously because not all architectures are equal.
Reporting up isn’t sharing
Recommendation 6A calls for mandatory bidirectional threat information exchange between government and operators, modelled explicitly on the United States Cybersecurity and Infrastructure Security Agency’s (CISA) framework. This is one of the review’s most important structural findings, because it names the asymmetry that has frustrated operators for years: you report up, but little of operational value comes back.
That asymmetry isn’t a minor service gap. The review treats it as a structural deficiency requiring legislative remedy. The government must share what it knows with the sector, and not just receive what the sector reports.
The CISA model is worth examining honestly
The review cites CISA as the international benchmark, but the comparison requires candour. The Cybersecurity Information Sharing Act of 2015, which underpins voluntary US private-sector sharing and its liability protections, expired in September 2025. It has survived only through short-term congressional extensions. Significant components of CISA’s operational capability have effectively been switched off by recent budget decisions.
A national intelligence capability that exists only as long as a funding line is protected isn’t a sovereign capability. It’s contingent capability. Australia has historically drawn on CISA’s frameworks, tooling, and threat intelligence outputs. Where that pipeline narrows, the gap doesn’t fill itself.
This is precisely why Australia is building that capability on different terms: industry-led, cross-sector, and not contingent on the rhythms of another country’s budget cycle; one that persists through geopolitical disruption, budget volatility, and changes in government because it is not dependent on any of them.
The window is open now
The government has accepted all six of the review’s recommendations in principle. Tranche 1 consultation closed 1 May 2026. Tranche 2, where the information-sharing mandate and legislative architecture will actually be determined, is the critical window. The drafting is where the detail and risk both coincide.
Operators who stay on the sidelines during that process will live with the result.
The review’s call to clarify the protected information framework in Part 4 of the SOCI Act is equally urgent. Legal uncertainty has been a genuine barrier to participation for years. Some operators avoid sharing due to real legal exposure; others avoid it due to uncertainty about what the law actually permits. Both are legitimate concerns, and both deserve resolution before Tranche 2 drafting is complete.
What good looks like
Done well, CTI sharing transforms security from a reactive compliance function into shared situational awareness: a community of defenders who collectively see more than any of them could alone, and who act on that knowledge before the attack rather than after it.
The Slay Review has given Australia the clearest policy signal yet that this is the direction of travel. The reform process now needs to match the ambition of the diagnosis, rather than producing another compliance layer that operators work around. We have the opportunity here to build a genuine intelligence-sharing culture with the institutional architecture to sustain it.
The physics of the problem have changed. The framework needs to change with them.
CI-ISAC Australia is the nation’s only cross-sector critical infrastructure cyber intelligence-sharing organisation. If you’d like to learn more, book a briefing here.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.