COOPER, Ms Heidi, Chief Executive Officer, Business Chamber Queensland [by video link] HARFORD, Mr Gregory, Chief Executive, Canberra Business Chamber [by video link] CHAIR: The committee will now resume its public hearing for its inquiry into cybersecurity for small to medium businesses and organisations. Welcome. This hearing is a legal proceeding of the parliament. The giving of false or misleading evidence is a serious matter and may be regarded as a contempt of parliament. The evidence given today will be recorded by Hansard and attracts parliamentary privilege. I now invite you to make a brief opening statement before we proceed with questions. Ms Cooper : Thank you, Chair and members of the committee, for the opportunity to appear before you today. My name is Heidi Cooper, and I'm the Chief Executive Officer of Business Chamber Queensland, the state's peak business body and representative for businesses of all sizes, industries and every part of Queensland. For more than 158 years, the Queensland chamber has worked alongside thousands of Queensland businesses, helping them navigate challenges, build capability and contribute to a stronger economy. Today, when we speak with our businesses across Queensland, we are told consistently that one of the most significant challenges facing SMEs is cybersecurity, digital adoption and preparedness for the emerging technologies, such as artificial intelligence, and how this can be adopted in their businesses. It is for this reason that we welcome this inquiry, and we're very pleased to be here today. The challenge facing small and medium businesses is not primarily one of awareness. They know about cyber issues and they know about the opportunity that AI presents, but, for many businesses, whilst they understand this, they understand the risks are growing, and they know that there is a real challenge, the biggest issue that presents is capability, cost and complexity. For many businesses, they do not have dedicated cybersecurity or digital teams. They don't have specialist staff, and they do not have the capacity to continuously monitor an increasingly complex threat landscape. For many SMEs, cybersecurity is just one of the many competing priorities that they have within their businesses. They are already managing workforce challenges, HR and workplace regulation obligations, rising cost issues, skills and training requirements, supply chain pressures, regulatory obligations, and the day-to-day of running a business. Additional cybersecurity requirements and concerns and risks associated with that add another layer of complexity and administrative burden to businesses that are already stretched and stressed from a time and resource perspective. In order to understand this better, alongside our regular business sentiment research, our submission is informed by engagement with businesses across the state, including a dedicated survey of more than 265 Queensland businesses, employing more than 12,000 workers. What we heard from these businesses was very clear. More than half of Queensland businesses operate at lower levels of cybersecurity. Only one in four meet all six AI maturity essentials identified by the National AI Centre, and nearly three quarters identified staff training as being the major issue when they're trying to manage cybersecurity, including one of the most significant risks in their business. That's why the central recommendation in our submission is a skills led approach to implementing the government's cybersecurity strategy. Awareness alone does not change behaviour, and it does not support the ongoing capability uplift of businesses. Businesses need practical training, coaching, trusted support networks, peer-to-peer learning and implementation assistance that helps them build capability over time and that is business focused. Any future measures should be designed to build capability rather than simply increase regulation. Success should be measured by the uplift in capability and resilience across the business community not on the volume of new compliance requirements. Businesses consistently identify regulatory burden as one of the most significant challenges and are wary of additional compliance obligations that add complexity, cost and administrative burden. We also believe that any future accreditation or procurement requirements, including those proposed by the CyberSmart program, should be accompanied by practical support. Without that support, there is a significant risk that capable small businesses will be excluded from supply chain and procurement opportunities at a time when participation in major projects and economic growth opportunities is so important. Of the businesses we spoke to, while 80 per cent of them reported that they had not yet been affected by cybersecurity requirements in their supply chains or procurement opportunities, this is likely to change rapidly, as proposed government mandates from larger contractors are flowing through to smaller businesses. And we hear this from both the small business community as well as our large corporate partners. Our findings highlight a significant preparedness gap, with many otherwise capable businesses needing support now to be able to meet future requirements with confidence. Finally, we encourage the committee to consider cybersecurity and artificial intelligence together. Businesses are embracing AI because it offers one of the most promising opportunities to improve productivity, drive innovation and support growth at a time when many are facing significant cost pressures and regulatory burden. However, many are doing so without a full understanding of the cybersecurity, privacy and governance implications and how to implement these emerging opportunities in a safe way within their businesses. As AI becomes more embedded in business operations, strong cyber resilience will be essential to ensuring businesses can adopt these technologies safely, confidently and at scale and see the benefit from them. Drawing on more than a decade of experience, we believe the effective approach is one that builds capability first, strengthens cyber foundations and supports continued investment in technology and investment. Business Chamber Queensland can play an important role in addressing these challenges. We have extensive experience supporting businesses to build capability. We have been doing this for over a decade with capability programs across a range of issues, and we strongly believe that SMEs benefit most effectively from skills led approaches. Through capability programs, advisory services, peer-to-peer learning and networks and direct engagement, we help businesses on a day-to-day basis translate government policy, emerging economic opportunities and possible threats into practical action within their business. We're very pleased to be working with the committee and with the Australian government on this important and critical issue for SMEs, and I thank you again for the opportunity to contribute to this important inquiry. I look forward to discussing our submission and recommendations. We will provide a copy of this statement to the secretariat, and we would be very pleased to provide any other information through questions and at other times. Thank you again for the opportunity. CHAIR: Thanks, Ms Cooper. I now invite Mr Harford to provide an opening statement. Mr Harford : I'd just like to echo much of what Heidi has just told you. There are real issues with cybersecurity. It's a huge threat to the operations of small and medium sized businesses. But there's also a real mix of experience and knowledge out there in the community. We surveyed our members in preparation for making our submission. About half of them said they think they've got the protections in place that they need. But there are real gaps in other parts of the market. About 20 per cent say they don't think they're on top of it, and about 30 per cent don't know. And I think the real challenge for small business is: how do you get the surety that you are on top of cybersecurity issues and can manage your businesses properly? It's not as simple as saying, 'Well, we need more regulation,' as Heidi was just alluding to. The biggest issue I see probably is not so much a lack of knowledge. People know there is an issue, but it is about capacity. The people who are running small businesses are incredibly busy. They're facing compliance requirements from the federal government, from state and territory governments and from their insurance companies, in many cases, and trying to grapple with running teams of people as well. There's a real bandwidth issue, I'd suggest, that is impacting the ability of small businesses to really grapple with understanding exactly how they can put in place the safety systems that they need, to keep their businesses safe. We did find that about two-thirds of our members, or at least those who responded to the survey, said they do train their teams in cybersecurity. So that's good. But, of course, the real challenge with that is you've got to provide a really high level of awareness to your teams about being careful and cautious of things that you're clicking on. It only takes one false click to cause real problems for your business. We think more can be done in that space and that more awareness of solutions is really required. As I've been talking to members about this, one of the other issues that's come up is around hardware and the cost of replacing hardware. The advice from the experts seems to be that you need to keep your technology up to date. Often, that is a low priority if something's still working but may have security vulnerabilities exposed to it. That is something that is problematic for small businesses—things like the instant asset write off, where the government has now formalised help, but that perhaps doesn't go far enough. Otherwise, we'll just echo everything that Heidi said. Thank you. CHAIR: Great. Thanks very much both. I really appreciate the fact that you have gone out to your members to survey them ahead of the public hearing and submissions. I'll kick off with a few questions and then invite my colleagues to ask some questions as well. There obviously is this tension between the carrot and the stick approaches to trying to get cybersecurity uplift, the stick approach being regulation and making sure that businesses comply. Most of the submissions are very much against that, which is totally understandable, given that small businesses have so much that they've got to comply with already. That leaves us with the carrot approach: the incentivisation of small businesses to train their staff—but consistently, not just once off—and also to invest in trying to make their systems more secure. What do you think is needed to convince a small-business owner to invest in cybersecurity protection from a hardware and software perspective but also from a training-your-staff perspective, if we want to steer clear of the stick approach? Ms Cooper : Greg, did you want to go first? I know you've got some data on this, and then I'm happy to continue. Mr Harford : Yes. I think I think for me, the biggest opportunity perhaps is around translating that awareness into action. That's where organisations like the Canberra Business Chamber and the chamber network more generally can help. We've got good tentacles that reach out into the business community and a good way of cascading information down. It is around encouraging businesses to see this as urgent. It is about constant communication, and it's about making those messages really simple. I think one of the challenges sometimes that small businesses face is that the training options for staff are often something you might do as part of an induction process or a one-off, so you've really got to incentivise them to do that more often. I do think business owners do typically really want to focus on their business. And, with all due respect, the more we can reduce other compliance requirements, the more that frees up time that allows that to happen. But I do think there's real merit, potentially, in providing additional, practical advice and practical sessions where you can get people along. The other complexity, of course, is that staff turnover has an impact. You can train your people up, but, as they go, you repeat your cost as new people come into your business. And in a volume recruitment business, that's potentially quite a large cost. Again, any kind of support that can be offered from a grant or a tax incentive point of view to encourage that I think would be very welcome. Ms Cooper : I agree with Greg's comments. Obviously, we work closely as a chamber network to support businesses across Australia. What I would add to Greg's comments is that businesses are motivated in this space to do things—they want to do what's right for their business—and this is one of the most significant risks that's facing businesses at the moment. The engagement we've had with businesses, both from the survey we conducted specifically in relation to this hearing and also generally when we speak with businesses, shows that they see digital adoption, both from an opportunity perspective and a risk perspective, as the most significant thing for their business at this point in time. Where the gap is, and where the challenge is, is about how they can do that and how they can do it with the complexity of the business environment that they're operating in today. We've seen this before in other areas when regulation has come in. For example, in the sustainability space, we've worked with Queensland businesses in a program called ecoBiz, which is about lifting their capability so that they know how to respond to the standards that are changing, or to the regulation in that area, rather than it being imposed upon them first. In my opinion, the most important thing is that, rather than coming in saying, 'Here are some standards, and now this is another thing that you need to try and work out and do on top of everything else that you're doing,' it's about lifting the capability of businesses so that they can do it and they can continue to do it. You made the point about, 'How do we get businesses thinking about training on a regular basis?' As maturity lifts, we see that this becomes part of a business's day-to-day operations. Again, we have seen this through the programs that we have already developed and have been doing for over a decade. When you build maturity and you lift capability, what ends up happening is that this becomes a way of operating rather than something that's happening to the business. One of the challenges we've seen to date in this space is that it was more about imposing things onto a business, rather than saying, 'How do we work with you as a business to uplift your business so that you can make your business stronger and more resilient?' This is something that businesses will do; they just don't know how to do it at the moment, and that's where the gap is. CHAIR: I want to pick up on your point that they just don't know how to do it at the moment, because that capability gap that you spoke about is something that has come up very clearly in all of the submissions. How do we go about getting businesses to lift their cybersecurity maturity level? There are programs, training courses, certifications and standards out there, but, for that small-business owner, how do we get through to them that this is the path that they can walk down? Ms Cooper : It's a really important question. I do want to acknowledge the work that has been done by the government and by your dedicated areas in this space. Your NAIC, I know, has done a lot of work in this area as well as your own cybersecurity and communication areas. I think what's most important is, again, that concept of not doing something to businesses but sitting with them and helping them through this process. What we hear from businesses is that what has been available to them to date is information—courses to learn about AI, static reports and static websites—that's not about actual behavioural change, shifting capability and enabling businesses to learn, from a business perspective, what is right for their business. That's the fundamental difference. I referred to our ecoBiz program previously, which is one of the capability programs that we've been running for some time. We hear through that program that they don't want another report; they don't want another taskforce; they don't want another checklist. What they want is a program so that they can understand where they're at, and that meets their business where they're at, so they're not overwhelmed by a whole heap of information. One of the challenges at the moment is: where does a business start? Even if they find the right place, there's a chance it's a website that's static, with a whole heap of links on it that don't necessarily relate to their business. What we need to ensure is that we curate this process for businesses. Through the programs we deliver in Queensland and through the chamber network as a whole, we know how to work one on one with businesses and how to provide them with that consistent program that enables them to have that uplift. This is just one example from some of the feedback we've had. In one of our programs, one called Workforce Evolve, the feedback we had from a business owner was that it was like having a business mentor in their back pocket. That's what they're looking for. They're looking for programs that meet them where they're at. It doesn't overwhelm them by potentially speaking to them at a stage that they're not at, but it shows them a curated pathway of how it is that they can get there. It meets businesses. It talks to businesses. It enables businesses to learn from each other as well. That's something that comes through time and time again. We see peer-to-peer learning as being one of the most important things, because you hear from another business what they've done and what's possible, and all of a sudden you think that's something that's possible for you as well. CHAIR: I thought that word 'trusted' was very interesting. I think it is increasingly very clear—where do small businesses go for that expert advice? What we've heard so far is that they will go to their business adviser, be it their mortgage broker or their business banker. How do we feed the information to small businesses through trusted sources? My other question is about the standards to which small businesses should be trying to lift themselves up. This goes back to the comment I made earlier about the carrot-and-stick approach, where the carrot approach would be the cybersecurity trust mark as something that is aspirational for businesses to get and to achieve. What do you think should be part of what a small business would need to go through to get that trust mark? Would it be recognised accreditation and certificates that they should be meeting? Should it be as prescriptive as that? Ms Cooper : Do you want me to go first, Greg? Mr Harford : Yes, sure. Ms Cooper : No, you go. Off you go. Mr Harford : I was going to say I think there's a place for those kinds of accredited programs—there absolutely is—but that the only businesses that will be able to make good use of those are those that are already of a reasonable scale and have corporate capability to drive the implementation of them. I think, for the great majority of smaller businesses, you're simply not going to get the buy-in to something that says, 'Oh, we have to go out and run this kind of rigorous accreditation process.' I think those businesses are much more looking for peer-to-peer learning. They're looking for advice from the business chamber or their local business organisation, and they want to be able to trust local people and their local networks. There's a continuum there, of course, because you want people to start on the right track and then ultimately build up and potentially get accredited as they go, but I don't think the focus should be on accreditation. You need to start with that kind of cascading of messaging at a community level and keep those messages really, really simple. Ms Cooper : Chair, I think there were two elements to your question: (1) that trust piece, but then also what's the role of standards or accreditation. I might address that trust element first. I cannot stress enough how important that is. Again, we've seen that from other work that we've done with the business community. It's really important. Particularly with something that's got such a high risk profile as cyber and digital, working with trusted intermediaries is absolutely essential. Your research is consistent with what we have seen. We've asked our businesses: where do you get information and how do you work? Yes, there is an element of working with professionals or practitioners, but we also see time and time again that they are working with the business community—so working with chambers and industry associations. We've been doing this for centuries now, and, because of that, we're seen as a very trusted intermediary. What's really important is that, when we work with businesses and we provide them with advice, recommendations and support, it's not vested in any way. The only purpose that we have is to support businesses and to enable them to thrive into the future. Because of that, businesses come to us in a way that is very much coming from the position that they can be vulnerable because they know that we're there to support them, but they also know that any recommendation or support that we provide comes from their perspective and is trying to support them. So I would really encourage that. We have also seen in the past, in different areas, that moving straight to, for example, a grants program isn't an effective way to (1) achieve outcomes or (2) develop that trust in this, because the challenge is that it leaves businesses that haven't built their capability floundering a little bit. They're not sure where to go and not sure who to go to, whereas what we see as being very effective, both for the business community—that capability uplift and outcome side of things—and as an ROI from a government's perspective, is that, if you work with businesses first to build their capability, they're in a much stronger position. They understand themselves and what they need but also where their vulnerabilities are before they start trying to engage with areas that may be a little bit challenging or that they don't have that experience in. So I'm really pleased to hear you talking about trust. I couldn't stress more how important that will be, particularly going forward, because this is something that is important to businesses. It's also really important to support them through this process in a trusted way. To speak directly to the standards piece, you spoke about the carrot and the stick previously; I actually think there's a continuum in thinking about standards. To Greg's point, we can't give businesses more red tape or more burden that they need to be trying to address, but I do think there is an opportunity to be providing businesses with a way to demonstrate to their tender opportunities, to their supply chain opportunities, to their customers and to their employees that they have addressed this issue and that they're taking it seriously. Our experience is that businesses want to be able to do that. We have seen that in both our sustainability program, ecoBiz, and our workforce program, called Workforce Evolve. We have businesses that do actually work towards verification. They can receive a star partner verification. Businesses do want to do that so that they can show the business community as a whole and also their customers and employees that they have committed to this area and that they have built their capability in that. I think what's important is finding that balance. What's also really important, if there are standards that are considered, is the level of compliance—how onerous it is to achieve and what support will be available to businesses to achieve it—and also consistency. We can't have multiple standards out there, which is the situation at the moment. I would strongly encourage this committee to think about how it is that they could work with organisations like the chambers to have a think about how regulatory requirements, or regulatory objectives, could be met at the same time as business objectives and to find a pathway that is beneficial to businesses in meeting those standards rather than it being a 'stick' approach. CHAIR: Great, thank you. I'll pass over to my colleague, Ms Clutterham. Ms CLUTTERHAM: Thanks to both of you for being here and for the work that you did with respect to liaising with small businesses and your respective jurisdictions. We're really grateful for that. Most of my questions are probably for Ms Cooper, but, Mr Harford, please do chime in if you've got any comments or observations to make. The bottom of page 2 of your submission, Ms Cooper, talks about the most critical factors for successful technology adoption being financial support and the affordability of technology services and equipment. What sort of tech were you talking about there? I think maybe you, Mr Harford, mentioned the instant asset write-off. Would the tech requirements that small businesses need to facilitate cybersecurity benefit from being included in the small business instant asset write-off? There are two parts to that question. Ms Cooper : I think what's really important is—there is a direct cost that businesses are seeing with this, but there's also an indirect cost. When businesses talk about the cost of this, there's also an element of 'I don't know what to do', and, because they don't know what to do, there's a whole heap of uncertainty and ambiguity about where they need to go with that. The reality for a lot of businesses, though, is that there is a cost associated with transforming their systems, looking at training, looking at moving into the AI space or moving into the digital adaptation side of things. What we heard from the business community is that they do see this as another cost, but, as I mentioned before in one of my previous responses, what we see is that going straight to purchasing software of some sort or a digital expert, whether that's a resource, ends up being probably one of the most ineffective ways for businesses to deal with this issue. One of the concerns that we heard from businesses through this survey and through the work that we've been doing with them—we've been running workshops and so forth, as I know Greg has as well—is that it's effectively the missteps: 'I tried this, and I didn't think it was going to cost me this much, but it ended up being this,' or, 'I've tried something else, and it didn't achieve what it was supposed to achieve.' There's an element around cost which is not as clearly defined as the ticket price of purchasing software as opposed to 'I don't really know what to do, and I'm trying some things, and it's just continuing to add cost onto that space'. Does that make sense? Ms CLUTTERHAM: Yes, it does. My sense is that the cost of trial and error of different products that might be suitable for business A but not business B can be quite prohibitive, so people try and then it's a sunk cost which is lost or they don't try, which leaves the capability gap. Would that be fair? Ms Cooper : Absolutely, and there's also an opportunity gap as well. That's the other issue. In not trying, you're not advancing your business and looking at those innovation spaces or the risk spaces as well, and the opportunity cost in that is huge, so that is definitely what we hear. I used this example before. We saw that very clearly when we first started the ecoBiz program 13 years ago. When we were meeting with businesses, coaching and doing that direct one on one support with them, we heard so many stories about 'I bought XYZ, and it's sitting in the garage.' Your point about sunk cost is the real issue. There's a real reticence from businesses about having that experience, or, alternatively, they give it a go and then potentially get burnt. That's the reason why I made the comment previously that, looking specifically at capability uplift first and the peer-to-peer learning—I can't stress enough how important that is (1) to give businesses confidence, because they say, 'If you did it, then potentially that means I could do it' and (2) to also hear examples and ideas and recommendations. That network and the ecosystem that can be created from a business based program is really important to managing some of these cost issues. Ms CLUTTERHAM: That's great feedback. The business based program to be facilitated by chambers of commerce et cetera as opposed to—and I don't think you're suggesting that advice from government should be products A, B, and C are the gold standard and you go and have a look at it, because obviously there are risk issues with that as well if that turns out not to be the case. It really is kind of that peer-to-peer, business-to-business networking and education that you can get from those sorts of relationships and finding out what worked in business A—and maybe it will work in business B. Ms Cooper : Absolutely. I'm using these examples of programs that we have seen because we've got a lot of experience and a lot of data around what has worked. If I use that example, we have businesses in our ecoBiz work programs where they just say, 'I just didn't know that was possible,' and they've heard it from another business. I am in no way—I think that government and industry should work hand in hand. Government should be the enabler in this and then allow us to take the role that we can in supporting businesses in a practical and direct way but, at the same time, achieving the outcomes that government's trying to achieve. We saw that work really well from a sustainability perspective. Because of that, the ROI is quite extraordinary, and we can share all of that information, if it is helpful. The bit about it being business—meeting a business where they're at is absolutely critical, because trying to put an overall 'we think you should do this' or 'here's a recommendation' won't necessarily apply. But, as an enabler, government could have a look at, overall, what needs to be met and where things are looking at but then allow intermediaries like the chambers to be able to actually apply that to a business sense. Ms CLUTTERHAM: The excellent example of that working in practice is actually your submission and the fact that you went out to 256 businesses, got responses, had an uptake and were able to craft a submission off the back of that. Quickly, before I ask Mr Harford about the instant asset write-off, Ms Cooper, if Queensland were to put on—I don't know—a breakfast seminar or whatever it is that you do in relation to the technology aspect of cybersecurity and what products are out there, would you expect there to be a good uptake? Would people attend? Sometimes in SA our business chamber puts on stuff and might get 10 people rock up. We had a small-business forum in my electorate recently. We really advertised and we personally invited and then the uptake was okay. You hear a lot of small businesses crying out for assistance, but then it's offered and the uptake is not where you'd expect it to be. Do you have that experience as well? Ms Cooper : Trying to prioritise is the biggest challenge for businesses. When you said, 'Do you think that people would respond?' the words that came to mind were, 'We would be inundated.' That's definitely been our experience to date. We are already running some workshops in this space because, to be very frank with the committee, I see this as one of the most significant issues that are impacting businesses. Because of that, because of who we are as chambers, it's our purpose and our responsibility to be supporting businesses. So we are already doing some work in this space, and we are being completely overrun by them at this point in time. But what I would say is that we sorted through the data from the specific survey that we ran. We also did some generalised market research about six months ago to look at what businesses were needing overall. It didn't come at it from a cyber or a digital perspective; it came at it from a 'what's going on in your business?' perspective, and this came up as the most significant issue. In fact, over 78 per cent of businesses said that they saw cyber and digital adoption as the most pressing issue facing their businesses at this point in time. The third element I would add to it is that what's really important—and this is what we can do well—is that you need to talk to businesses about what's important to them right now. Telling them what we think we want to say—there's a new cyber X, Y or Z—may not necessarily resonate with businesses. They may not hear it, and they may not necessarily give up their time to be a part of it. But I can use some examples from the other areas that we've been looking at. There's the sustainability element as well as the workforce element. When we talk about sustainability—we have multiple different messages depending on which part of the business community we're talking to—one of the things we talk to them about is 'do you want to save money on your energy, waste and water bills?' Straightaway, businesses say, 'Yes, I want to know about that.' We then start talking to them about that element, but it also means that we can then talk about 'here are these standards that are coming and here are the implications for procurement; this is what it could mean for you'. We talk about the issue from a business perspective. Similarly, in our Workforce Evolve Program—we've just hit a thousand businesses going through the program—we talk to businesses about what their challenge was, which is about accessing a workforce and accessing a skilled workforce. Say to businesses: 'Do you need support in this area? We can help you.' That's the entry point to then have a broader conversation about what's happening with some workforce areas. We've been working with our partners on this as well. We work with NBN Co and Microsoft on some of the programs that we've been delivering. We also have several business partners who are really active in supporting the business community. We make sure that we know business, and then we make sure that we've got experts standing next to us who can support the business community. Ms CLUTTERHAM: That's really helpful evidence. Mr Harford, I'll quickly get your thoughts on the instant asset write-off that you mentioned earlier. I think you mentioned hardware but possibly software as well. Would you recommend that be considered? Mr Harford : Potentially, yes. The instant asset write-off, I think, is a good thing because the threshold is now $20,000 per asset. Essentially, it does give quite a lot of flexibility. One of the challenges many small businesses will have is, of course, cash flow, not just the tax write-off. You've got to make sure you've got the cash coming in to be able to fund those purchases. That is sometimes where it can get a little bit tricky as well. Ms CLUTTERHAM: I have perhaps two more for Ms Cooper. On, I think, page 9 of your submission, you talk about the Cyber Wardens program, and then you say it would be good to link cyber and AI together because they go hand in glove. If Cyber Wardens were to be re-enlivened and kicked off again, would you see that as a place to talk to business, educate them about what could go wrong with AI from that cybersecurity perspective and look at the opportunities that AI might provide to a business—the bad bits and, at the same time, what you could achieve and what might be open to you, the benefits and opportunities of AI, if you've got all your ducks in a row? Ms Cooper : I think it's really important for us to be talking about cyber and AI together, because businesses definitely think about it in that way, so thinking about it in isolation is not going to achieve the outcomes that are needed. AI is the opportunity, but, at the same time, it's really easy to step into the risk space. If we think about the way that business thinks about this, they think about it together, so we need to be thinking about it together. Obviously, we're aware of programs that have been developed to date. As I said at the beginning, I've been really pleased that the government has had a focus on these areas, but we've heard very clearly from the business community that the programs to date haven't met what they're looking for, so I would caution against simply reinvigorating what has already been done to date and would suggest that there's a different way to think about this. I suggest thinking about it in a way that would definitely achieve better outcomes for both business and government. In response to your question, I do think that it is essential that we think about cyber and AI together, because that's the way that business thinks about it. The second part of your question is around programs that have existed to date, and the clear feedback we've had is that they haven't met business needs. So I would encourage the government not to see that as not needing to do something but rather to say, 'Let's work together and create something that would be more effective.' Ms CLUTTERHAM: Absolutely. What would a couple of pieces of low-hanging fruit be? What would meet business expectations in that cyber AI space, noting that the previous iterations didn't? Ms Cooper : We've already done a lot of work in this space, and we'd be really pleased to share that with the committee. I can talk generally about it now. I've mentioned a couple of times that we've done many years' worth of work to build capability in businesses, so we've got a proven model that does work. We've also got a platform that already exists, and we've got a lot of proof points that show that. I'd be really pleased to work with the committee and show you that. The short version is that there needs to be a combination of online accessibility, because businesses are looking for 24/7, and a coaching element, whether that's one on one or peer to peer. There also needs to be a curated pathway where businesses can grow their maturity. There's a strong behavioural change element to that. Importantly, any work that is done needs to meet businesses where they're at. It's not a static website; it's not a static report. It's something that enables businesses. I previously used this quote from one of the participants in one of our programs: 'I felt like I had a business mentor in my back pocket.' That's what I think could be achieved, and it's definitely what we hear from businesses that they are looking for. They need to have that access at a time that suits them, but they also need to be able to speak specifically about their business and how that works. That can be achieved through a combination of digital work that provides consistency, access and scale, as well as localised learning. Ms CLUTTERHAM: I have two more questions on what I think we would call the contract requirements. I think you talked earlier, Ms Cooper, about there being a gap between what businesses are being required to demonstrate in terms of winning work, as it were—demonstrating cybersecurity capability in order to bid for work and win work or whatever the case may be. What are some of the requirements that small businesses are expected to meet in order to bid for work, and what is the gap between what's being asked of them and what is realistically achievable for businesses? Ms Cooper : You would have seen in our submission that we are pleased to see that, at this point in time, businesses haven't been excluded from procurement opportunities because of their cyber standards. Having said that, though, we also heard directly from them that they are being asked more about it. We are seeing that government and corporate partners are becoming increasingly concerned about what small businesses in their supply chains are going to be required to do. That's where our concern is, particularly as we're entering into a major growth period. What we're seeing in Queensland a lot at the moment is what is coming down the line for businesses. The reality is that we can't upskill businesses in the four- to six-week period in which a tender requirement is due, so our concern is that this is a pending issue. Many businesses are not even necessarily aware of what they're going to be required to do. What that means is that businesses won't have the time to uplift their capability in order to meet the requirements. I had a conversation with one of our very large corporate partners just a couple of weeks ago, and they said, 'We know what we're going to have to require businesses to do.' They're in the financial services area. And they said, 'We know what we're required to do; therefore, we know what we're going to need to pass down to businesses, and they're just not ready.' But, Ms Clutterham, if you'd like some specific examples around that, we can provide those to you on notice. Ms CLUTTERHAM: That would be really helpful. That will enable us to understand the gap between what the government and the bigger businesses are asking for and where small business is at, what needs to be done to plug the gap and whether the gap, depending on the type of business we're talking about, is a productive one. Ms Cooper : We can definitely do that. What's really important is that there is a gap. There's a very, very clear gap. When a business is looking at procuring, tendering or even bidding for a contract, that's not the only requirement that they're needing to meet. That's the challenge. When we have a look across the board at what businesses are being required to do now and whether they need to demonstrate their sustainability capabilities, their workforce, their D&I side of things, the cyber requirements and other standards that might exist, our concern is that, as this new piece comes in, it may get to a small business saying, 'I don't know how to do that.' Ms CLUTTERHAM: I think that's exactly right. The analogy I'm thinking of at the moment is the defence industry. Lots of SMEs are wanting to bid for work within the defence industry, particularly in South Australia, where I'm from, and in Western Australia. To do that, they need to have certain levels of security, DISP membership and those sorts of things. I guess those requirements are actually non-negotiable because of national security and all kinds of issues. So I think it would be really helpful for us to understand the non-negotiable nature of what small businesses are being asked to do and to then look at a gap analysis from that perspective. Ms Cooper : We'd be very pleased to support you with that. I can add another example. I agree that defence is one of them. We are also watching this evolve in Queensland because of the significant infrastructure bill that we're seeing. We see the large businesses who are wanting to support an SME community and may not necessarily be able to meet the requirements of a tier 1 because they don't have the same standards. Ms CLUTTERHAM: Yes. My final question is to Mr Harford. It is about cyber insurance. Your paper notes that there's a gap in insurance coverage. Why do you think that is? If I'm a small business, I've got a capability gap and I don't have the resources to hire a cyber person, the first thing I would probably do is get cyber insurance. Because I'm not in a position to take as many steps as I would like to minimise the risk, I would get insurance to cover that risk. Is it cost? Is it the understanding of what's available? Is it insurance companies? What's the deal? Mr Harford : I think it's a combination of factors. Partly, it is a question of cost. Cyber insurance can be expensive, and, if you're trying to add it into an existing portfolio of insurance, you might be looking at it and thinking, 'Is it really worth the investment?' I think it probably is, but there's a cash flow issue that businesses grapple with. It can be quite complex to apply for cyber insurance. Your insurance company will typically be asking a reasonably complicated series of questions in order to make sure that they're not exposing themselves, which I can understand, but it does create a bit of a barrier if you don't have the headspace or the capability and knowledge to understand enough about your business in the first place. I think those are the two major reasons. There is also, perhaps, a lack of awareness of the benefits of cyber insurance. It's a relatively new product in the market, so, if you've been running a business for a number of years, you might not have had it before or had those conversations with your broker. Typically, if you're working through a broker, you will tend to find that you're being offered a full range of insurance cover as part of that process. But, if you are dealing directly with an insurance company, it's a little bit more transactional and you might not have the same questions being asked. Ms CLUTTERHAM: Okay. As well, there is a challenge in understanding what risks that might be related to cyber are already insured. For example, if your credit card gets scammed, is that already an insured risk under another policy, or do you need something new? All of that education is, I imagine, quite a challenge for a small business that doesn't have a dedicated cyber or compliance professional. Mr Harford : I think that's right. There are a whole lot of questions. You don't know what questions to ask if you don't know what the problem is. Part of that comes back to getting the message out, cascading it down and getting businesses talking to each other, which is the sort of stuff we do all the time. Ms CLUTTERHAM: Thank you both very much. CHAIR: I want to thank you both for joining us today and for all the work that you've been doing to help support small businesses. Ms Cooper, there are a couple of things you took on notice. One is about the training and support that you provide on cybersecurity. Are you still happy to do take that on notice? Ms Cooper : Yes, I'm more than happy to provide further information on some of the work we've been doing to date and some of the work we will possibly do, going forward. CHAIR: Please send that information to the secretariat by Tuesday 20 October 2026, and please note that responses to questions on notice will be published on the website as submissions to the inquiry. You will be sent a copy of the transcript of your evidence, and you will have an opportunity to request corrections to any transcription errors. Proceedings suspended from 12:38 to 12:59 .