QUINN, Ms Nicole Denise, Vice President for Policy and Government Affairs, Japan and Asia Pacific, Palo Alto Networks SCULLY, Mr Tom, Director and Industry Principal, Japan and Asia Pacific, Palo Alto Networks [13:35] CHAIR: Welcome. I understand that information has been provided to you regarding parliamentary privilege and the protection of witnesses giving evidence to our inquiry. I'd now like to invite you to make some opening remarks as quickly as you can so that we can get straight into questions. If there's anything else that you'd like to provide to the committee in writing, please do so through the secretariat. Over to you. Ms Quinn : Thank you, Chair and members of the committee, for this opportunity. Palo Alto Networks is a global cybersecurity company with a substantial presence here in Australia. We work every day with government agencies, critical infrastructure operators and enterprises across the economy to defend against cyberthreats, including those increasingly shaped by AI. Because I'm a simple country girl, instead of referencing our submission, I wanted to use an analogy. That's the simple analogy of the motor car. Cars did not arrive safe. They became safer gradually over more than a century, as road rules, licensing and vehicle design all improved together, step by step, alongside the technology itself. This gradual two-part evolution is worth pausing on. The first part was rules of the road: speed limits, traffic lights et cetera. Those are the laws and standards that govern how the car is used once it's out in the real world. That is the part of AI safety that gets most of the public attention, and rightfully so. Good road rules are important—but the rules of the road were never enough. A stop sign won't work if you don't have brakes in that car. So the second thing that made cars safer was what manufacturers built into the vehicle itself—seatbelts, airbags, crumple zones et cetera—safety engineered at the design stage. Here at Palo Alto Networks, we call the AI equivalent of this 'secure AI by design'. It means policy settings that promote secure AI by design across the AI ecosystem are built in from the start rather than bolted on afterwards. Here is why this simple analogy is important. Cars have had the benefit of time. They've had decades to learn from experience and to improve rules and engineering together as each model has been advanced. AI has not had that benefit. Its capability is advancing much faster than the rules and safeguards around it have time to mature, and we think this committee and Australia have an opportunity to close that gap deliberately rather than waiting for it to close on its own. Right now Australian organisations, including government agencies and critical infrastructure operators, are rapidly building complex ecosystems of AI models, applications and agents. This ecosystem introduces attack surfaces that traditional models in our world, in cybersecurity, were never built to address. In car terms—again, as an analogy—it's like we're adding lots of new componentry to a current vehicle and we don't quite know where it's sourced from. We get AI from emerging markets. We get it from open. We get third-party plugins. All this creates hidden risks, and we shouldn't accept it. We wouldn't accept a car like that, and we shouldn't accept AI systems built that way either. That brings me to the third and final part of my simple analogy, which links to the national security terms of reference for this committee. Good drivers also need the ability to react in real time when something unexpected happens on the road. Frontier AI has compressed the offensive cyberattack life cycle, and it outpaces our traditional human speed detection and responses. This is the equivalent of the road itself getting faster and more dangerous. The good news—because we're cybersecurity, we can often go down the negative side—is that we're using these same frontier AI models that make attacks faster to defend. The policy question is not simply how to constrain frontier AI capability; it is whether Australian regulators, the Australian AI Safety Institute and our intelligence and security community have timely, secure access to them to turn that same capability inward to defend. Our key message today is that we need to build secure AI by design, we need to not enable it to be retrofitted, and we need to give to the defenders the powerful current tools available to the attackers. We welcome your questions. CHAIR: Thank you very much. I really appreciate that analogy. I think that's a really useful way to describe some really complex and big issues that are confronting not just this committee but also Australians across the board, especially given some of the evidence that we've been hearing, particularly yesterday and earlier today. I'd be really keen to drill down into this idea of safety by design and the opportunity for Australia to influence that. What do you think is the best way Australia can play a role in influencing safety by design? Ms Quinn : There are several ways. If I use the analogy of how we've done it with critical infrastructure and our SOCI Act, and the investment that we've done in cybersecurity in general, there are certainly guidelines, frameworks and a regulatory environment that not only directs but also guides organisations' adaptation, use and design of AI. For example, we can learn and partner with the US—and Singapore is a leading nation in this space—and we can build a regulatory environment that enforces that you have to think about cybersecurity and you have to think about security to a certain degree before you deploy and put it into your organisation, and, in the broader context of Australia, before we implement it across systems. Mr Scully : I think Nicole's right. The regulatory settings are a balance—you can go too far one way, where you will regulate too harshly and stop that innovation cycle that you want, or you can not regulate enough and it becomes the wild west. It's really about sitting between the tipping point between them, as we as an Australian society want to sit. I discussed this with Nic earlier and I said some really good guidance is thinking about how you put to the directors of companies and organisations that they do so far as reasonably practicable—what they can within their power, given the context of how they want to apply AI—to make sure it's safe and fit for purpose. It's about where we sit on that spectrum. CHAIR: I'm also really keen to get your sense of safety by design and the actual development of the technology and the training of these frontier models. Is there an opportunity for Australia to play a role in that? The reason I ask that it appears to me there is an opportunity to leverage off the frontiers seeking to come here in order to help drive a conversation around what safety by design looks like in the model development of itself. How do we put regulations and safeguards around the training of these models, the safety of them and the continuous human control, which seems to be the challenge confronting us here— Ms Quinn : Do you mean in a loop? CHAIR: What opportunity does Australia have to influence these technologies and these big hyperscalers in particular? Ms Quinn : Palo Alto Networks was invited as part of Project Glasswing when Anthropic first said that they wouldn't release their model because it was considered such a step-change in capability. We have worked very closely on a global scale with the large frontier companies to ensure that they understand the security and cybersecurity protocols, the guidelines, and the regulation, as well as to ensure that we also know the technology that we can use to put a harness or a framework around the AI models. I think it speaks to trust, Chair. We can drive the behaviour and the way we build frontier AI in this country, and it speaks to understanding what's in that black box. If we have a regulatory environment that not only encourages the building but also encourages that security lens, it then builds trust not only in adoption here but also as we go to trusted partners and trusted countries around the world. We are a trusted nation. I look after the region from a policy setting. We have a wonderful reputation in Australia for being a safe operating country—consistent government; consistent construction—so this is actually an opportunity for us to be a leader in the region. If you're investing and using AI here that is being built and designed here, it also has those secure AI principles and that secure AI by design. CHAIR: Would you be able to expand on that and the opportunity cost if we don't see these big hyperscalers investing their training and frontier here or the capacity to have them here? Ms Quinn : I think that's more of an appropriate—we look at just securing that. We believe that any model, be it a frontier AI model—we just heard from some wonderful Australian smaller companies—should be secure. I think the opportunity cost is if we don't have that security we don't want that innovation, that discovery and that intelligence being targeted either through nation-state or criminal. Then we'd lose that IP and that wonderful innovation that we're so famous for developing. So we look at it very much from that cybersecurity and protecting lens. CHAIR: Excellent. Deputy Chair. Senator DUNIAM: To your analogy, which I love—it does sort of speak to my level of knowledge on this and many other issues! Ms Quinn : We're on the same page here. Senator DUNIAM: Yes, exactly. Maybe Australia will follow along with this. We will make recommendations at the end of this inquiry, and I want to know how we would specifically recommend to government or get them to build a vehicle to which they're not bolting on things to the chassis—after-market items. How do we actually formulate what you specified in your analogy there, as well as that 'safety by design' approach? What does it look like in a regulatory sense, and is it being deployed elsewhere in the world? Ms Quinn : I think the work that the US government has done around NIST and the guidelines set around—the guidance there is a really good landing point. Obviously, as a company that operates across multiple jurisdictions, the more consistency we have in policy and adoption the better. Tom, do you want to speak to that in a little bit more detail? Mr Scully : Yes. We have to look at this in terms of what is the oil that's going to power the car that Nicole was speaking about— Ms Quinn : We're all on the drivers analogy! Senator DUNIAM: Keep that analogy going; this is excellent! We've had lollipops, cars— Ms Quinn : We'll just do cars; no lollipops! Mr Scully : The thing that underpins it is fundamentally the data. The ability to feed a model with large sets of data and varied sets of data and train knowledge on that to then create the brain is the key. In some use cases—for instance, let's take when we all first got access to OpenAI and ChatGPT. We used it for a couple of days and we went, 'That's awesome, but I wish it knew more about how I did things in my life or my organisation.' So what did we do? We started giving it access to data to get that context, and then it became more useful. That's what's happening now, and the more systems we can plug in together and integrate the greater the outcomes will be. But the one fundamental thing underneath all of that is trust. How do we fundamentally trust that your data is okay to share with me and that we can integrate them and we have that agreement? Then that knowledge that comes out is treated the same. So we have to take this concept of secure AI by design that Nicole spoke about and fit that together. Some concepts around that, and we've spoken to this a little bit in our submission, are around gateways. How can we fundamentally provide a secure AI gateway between data, users and organisations so that heavy burden of maybe how to integrate it, that load, is taken away and we can let them focus on integrating for the AI outcomes that we want in solving the problem and making sure that the fundamental underpinning of trust is taken care of as well? Senator DUNIAM: But the US model is— Ms Quinn : The NIST model is certainly what they have adopted and leant into very much the secure 'AI by design' principles. You've got some in the EU that certainly address 'sovereign' and privacy—and not in that US lens—which I think the Australian government could lean into. Finally, even the guidance issued through the Australian Signals Directorate, our Five Eyes and our intelligence community—those guiding principles of how AI can be used across the Australian economy—very much could be legislated—similarly, again, to how we did SOCI, where we go, 'This is best practice; this is what you should do; now we're actually going to hold you accountable for it, and now, if you haven't considered this in your journey, there could be consequences.' I don't think we can get from there to there overnight, but if we don't, as a government or a nation, send very strong messages that securing AI is just as important as adoption and just as important as implementation, we put at risk the building of that citizen trust and we also undermine the economic and national security of those most important functions of government and critical infrastructure. We often talk about the use cases of AI and, because we live and breathe it, we're very much saying, 'Okay, we need to do it securely; we do it safely,' and we actually now have the technology across the globe to help do that. It's not, 'Oh, we don't know how to do it.' We actually can do it, and vendors, like us and our frenemies, would also have the ability to do that. Senator DUNIAM: Yes, I think that security trust issue is one of the very salient major issues that need to be dealt with as we move forward, so your advice there is very much appreciated. CHAIR: Ms Chaney. Ms CHANEY: In relation to frontier models, I'm interested in your views about what access is reasonable to seek, for whom and when. Your submission says that the AI Safety Institute or other national security bodies should facilitate access to frontier models for defensive cybersecurity purposes. Can you talk a little bit more about what that access arrangement could look like. Is it for properly safeguarded close-to-public-release models, or is it for internal higher-capability earlier-testing models, and who should we be seeking access for? Ms Quinn : Yes, we should be asking, as an Australian government, that we have early access to these models. I do not think it's unreasonable to give. Because they are so powerful in the cybersecurity space, and they have already shown that we've gone from days for exploiting a vulnerability to minutes, it is not unreasonable for us as a government or a nation to ask for early access to frontier AI models that could risk that. We're seeing it. As I mentioned, Anthropic recognised that Glasswing was such a step change in capability, from a cybersecurity point of view, that they actually got the experts in the room—the cybersecurity companies—and partnered to ensure that we actually put it through our own systems and defences so that we would ensure that our over 80,000 customers around the world were not going to be made vulnerable when these frontier AI models were released. As to how that is done, we've seen it in the UK through the safety institute, we've seen it through memorandums of understanding and we've seen it with direct agreements, so I think the AI Safety Institute could be a leverage. Even our Five Eyes and other strategic relationships, our Australian Signals Directorate and our national security portfolio would also be able to have mechanisms available to them to formulate this prior—or as early as possible—access. Ms CHANEY: So, in terms of 'who', it's the AI Safety Institute and ASD plus, potentially, cybersecurity companies or big companies that are at risk? Ms Quinn : We were involved because we obviously provide the cybersecurity solutions and, if we had a vulnerability in our solutions that frontier AI could identify, the sooner we had that in our hands to enable us to patch, mitigate and provide the solution, the sooner we're securing those. We have a classification of critical infrastructure entities. We have organisations of national significance. So we've already mapped, here in Australia, those organisations and those entities that would be most at risk if we weren't prepared. Ms CHANEY: Yes. Understood. Ms Quinn : And that could be through Home Affairs as well, through that mechanism. Ms CHANEY: So that's the who. In terms of what, when we spoke to the frontier models yesterday, it sounded like early access to the frontier models would be with the safeguards on them, and then, for limited use cases, there could be early access without the safeguards on them. Is the predeployment model in the form in which it will be released the thing that we should be seeking access to? Mr Scully : Yes, I would agree with that statement. It should be. Ms CHANEY: That's good. How long do you need pre deployment to actually make it useful? If it's released a week before or a day before, is it going to be useful? I just have no sense of it. What's a reasonable thing to ask frontier developers in terms of early access? Mr Scully : Looking at the numbers, I think the numbers that we've got here are that 29 per cent of CVEs are now weaponised within 24 hours. CVEs are critical vulnerabilities. That's going from, 'Hey, there is a vulnerability available,' to it being weaponised and utilised. if we can actually get inside that window and buy down the risk or resolve some of the risk by putting access in the hands of good people in that time, the better it is. One of the key things to actually do— Ms CHANEY: Does that mean that in 24 hours you could guard against that, or do you need a week to guard against that? Mr Scully : You need to have the tooling to understand the scale of the problem and then plan out how you're actually going to resolve that. For instance, if you have the same tooling as a red team actor or a malicious actor and you can understand maybe how and where they would use it and what assets it would be targeted against, then you have a great ability to rationalise where you should deploy your defensive resources and how you should mobilise those forces at the same time. The key to that is— Ms CHANEY: How long does that take? If we get a week or a month or a day before, what's a reasonable expectation that would actually be useful? Mr Scully : The question is a little bit more detailed in nuance, but, really, it comes down to what systems you have behind it with the ability to load that model in and out. One of the key findings from our interaction with Glasswing is that the main game here is not so much the model all the time, because we're seeing models come out regularly and at speed and capability and pace. What is important around it is the AI harness—the ability to change the brain in and out quickly and integrate it with your data sources to then ask it the key question. What, really, you're coming to there is: if I have access to this model, how quickly can I leverage it on the data sources I have and derive knowledge on it? The fundamental question is: what does your AI harness for the Australian government look like for that? Ms CHANEY: Have you got an answer? Do you have a sense of this. I'm trying to get a sense of what the government should be asking in terms of early access to models. If it's going to mandate that rather than rely on voluntary early access, what are reasonable expectations? Ms Quinn : I think as early as possible, in the sense of giving us the ability as a government to run it through the system. If I'm looking at government processes, if 28 days is possible, that's fantastic. But if it's only 24 hours, that's better than nothing, because it's giving us the opportunity. So I think that would be best answered by the regulators or the agencies that would have to do that testing. For us, as a pure play cybersecurity company with thousands of engineers, we can throw everything at it, if needed, in quite a short time. The Australian government resourcing may be challenged by that. Ms CHANEY: Knowing what you know about cyber resourcing, if the AI Safety Institute is going to be playing the role that it's meant to be playing in testing, do you think that its current resourcing of $7.5 million and 25 people is adequate for the functions that it's currently being allocated? Ms Quinn : For what it's currently been asked—it's a new initiative. If I look at how we operate and interact with safety institutes around the world, and we use that model a lot for whole of government and guidance and interaction, I would look at growing that investment. Ms CHANEY: Any sense of quantum? Does it need to be 10 times what it is if it's going to play a significant role in AI safety? Ms Quinn : I'd like to take that on notice in the sense that I haven't spent a lot of time looking at the funding models of the institutes. Ms CHANEY: Thank you very much. CHAIR: Senator Sheldon. Senator SHELDON: From the perspective of what constitutes a reportable AI incident, can you lay out what the threshold might be? Again, you've done such a wonderful job in local terms! Ms Quinn : I'm going to take that as a compliment! Thank you, Senator. Senator SHELDON: Let's give it a go! Ms Quinn : I'm looking at when we report the car crash—is that it? Senator SHELDON: That's right. Even the swerving—when it swerves and crashes. Ms Quinn : I'll answer the question, but I'd like to talk about the importance of giving agents identity, as we talked about in our submission. In our world, you cannot defend what you can't see. We are now reporting that, for every human or customer in an enterprise, we're seeing about 109 to 110 agents, and they have varying degrees of access like our human does in the analogy. We really believe that the Australian government needs to identify and record those agents, and then, when I know who they are and what they're doing, that's when I can set that threshold of what is a reportable incident versus, 'We've caught it, we've stopped it, we mediated it.' If we look at our future predictions, where organisations will have thousands of agents, we don't want our regulators to be completely overwhelmed and swamped by small reportable incidents that were mitigated or fixed or immediately addressed. It's where either those agents have impacted services, especially citizens' services, or they are behaving in a way that needed to be learnt and helped—to help control and bring those agents in. Senator SHELDON: This is probably a really stupid question. If you've got those low-level non-reportable incidents, as you're suggesting—if they are increasing in number, isn't there some importance to actually keeping track of what's going on there? It might escalate. Ms Quinn : Yes. That's where we've got this wonderful relationship with AI where we use AI to track AI, like how we as a cybersecurity company use AI to defend against AI. I think, as that beast grows, if we set the foundations now for those identities and that register of agents, the AI will actually be able to help us. I asked the very same question. We don't want people overloaded with compliance and governance. We've got to crack on and do business. That's where the tools will help track and record and ensure that we're keeping an accurate, up-to-date list. Mr Scully : Just summarising Nic's points, two key areas I speak about very regularly about this journey, because it is quite a complex journey—I give two guiding principles. One is to create an immutable data chain for the use of your AI. Whether it's Tom using it day to day and just asking queries—to be able to have an immutable data chain of what I asked, what I was querying for, which data I got access to, what the response was and what I did with that. As we head towards what we call an agentic future, where agents will take actions on our behaviour, how can we create an immutable data chain where Tom asks an agent to do a task, he went away and he let it do that task? We create data points the whole way along so that we can reinspect that and understand that it did what was asked with the intent and with the authorities that I gave it on the data I accessed. That's one guiding principle. The second one, when you ask for someone to go do that in AI—or use AI at all—is giving it the right privileges. We talk about giving just-in-time intent based privileges. If I create an agent and I ask it to go get something from the fridge, I give it access to the fridge, I give it access to my house, I give it access to the data about the path to go in my house to get to the fridge, and I give it a task. You give it those authorities, you make sure it goes and does the immutable data chain, and you take those authorities away. If you build those as two core pillars into whatever you're doing with AI, you'll be able to track and regulate—'Did it do what I wanted it to do, when I wanted it to do it, with the intent with which I asked it to do it?'—and those things can be pulled up and queried at any point in time. Ms Quinn : And that's a classic example of secure AI by design. We've gone from cars to fridges! Mr Scully : Yes. Senator SHELDON: What sort of evidence would vendors retain to allow regulators to reconstruct an AI related incident? I think you touched on it, but how would that work? Should AI reporting be mandatory? Should there be a legal obligation for mandatory reporting? Are there some guidelines or a program that should be put in place? Ms Quinn : I think there should be mandatory reporting. We support that. We, as Palo Alto Networks, recognise ourselves as a system of national significance, and we hold those obligations very seriously. I think, if you put that responsibility at the CEO or secretary level—at the leadership—it really focuses the decision-makers on their responsibilities. So we are supportive of mandatory reporting and those obligations to ensure that cybersecurity is at the forefront of technology implementation. What was the second part? I apologise. Senator SHELDON: That's okay. The other part was just about allowing regulators to reconstruct an AI related incident, which you talked a bit about before. The importance of that is critical, obviously, to the structure. Mr Scully : Yes, those two rules are pretty well guiding, once you look at them. There are standards and things out there that will show you the make-up of the AI system and therefore the critical inputs and outputs that you would need to track—things like MITRE ATLAS. OWASP also track it. But, if you're looking at what data, what user, what interface for it and the identities for them, they're generally four key components that will go into creating that immutable data chain and reconstruction. Ms Quinn : That audit trail, especially for government, I think, is extremely important—our red teaming. If there is an incident, what we can do is go back and help with that process. Mr Scully : On that, if you look to really forward-leaning use cases where you might use this, where you might have a sensitive government database in one area that's protected and you want to enrich it with another for an outcome, the ability to have in place that immutable data chain and that just-in-time intent based privilege about what you're going to do will allow you to more freely share that information with trust and get the good outcome for the Australian people. CHAIR: Senator Pocock, final question. We've only got three minutes. Senator DAVID POCOCK: Thank you for your time. I've got a question about cybersecurity. The government's September consultation paper, the precursor to legislating AI standards, barely mentioned cybersecurity at all. It gets a couple of mentions, with no detail. Do you think the government needs to take cybersecurity in an AI context more seriously? Ms Quinn : In a simple answer for time: definitely. We believe you cannot have innovation, adoption and all the wonderful things that AI brings to us without the other side of the same coin, which is doing it securely, ensuring that we have trust in the technology and having that social licence to get the benefits. We need. cybersecurity almost as the same coin, as I said. So definitely we need to ensure that we are focusing on putting cybersecurity as a fundamental deliverable of AI adoption. CHAIR: Thank you very much. We'll bring that session to a close. We appreciate you being here to provide that evidence. If there's anything further that we've asked for or that you're keen to provide through the secretariat, we'd be grateful if you do so. Proceedings suspended from 14:09 to 14:19 .