AustralianSuper has implemented Microsoft’s Security Copilot amid fears of increasing attacks by threat actors using artificial intelligence.
Australia’s largest superannuation firm, which has $340 billion in retirement funds under management, has given all members of its security team access to Security Copilot as it looks to thwart attacks aimed at staff and its members.
Speaking during the Microsoft AI Tour in Sydney, AustralianSuper chief technology officer Mike Backeberg said the fund is now using “AI not only to provide defence but [also to] understand how threat actors are using [AI technology]”.
“AI is the single biggest global threat,” he said. “The single biggest difference is the maturity in how threat actors are using AI.”
During his talk, Backeberg referred to an unspecified distributed denial of service (DDoS) attack that hit Australian banks and insurance firms.
“The current hypothesis of the DDoS is that it was an AI DDOS attack – not just bots, but AI actually attacking," he said.
Backeberg said that AustralianSuper's security team had also used Security Copilot as part of its response to a ransomware attack simulation, conducted as part of a broader four-day organisation-wide “resilience test”.
“[The cyber security team] stood up a fake environment and got one of the [staff] to launch an attack so they could run the automated playbook through the service," Backeberg said.
“Historically, if we were doing a hunt for a threat actor, it would take us about two hours to start tracking. [This time] it took us two minutes.
“It was so fast, that the SOC thought something was going on in the environment, so they flagged a ticket in ServiceNow and shut the environment down. We had to tell them we had just shut down the test."
The security copilot usage sits in tandem with AustralianSuper's wider adoption of Microsoft Copilot for M365.
Every AustralianSuper employee is given a Copilot licence now, alongside a laptop and mobile phone.
The right candidate
Backeberg also spoke about AustralianSuper’s approach to hiring, saying the organisation would rather tap temporary contractors to fill gaps than make a wrong hire.
“We adopted an internal philosophy – we will not put bums in seats,” he said. “We walk away if we do not get the right candidate for our organisation.
"We would rather go to market tomorrow and get a contractor until we can get the right person.”
As an example of day-to-day activity in AustralianSuper, Backeberg said the company had performed 50 “substantial” automated releases across the organisation within the current financial year.
“That’s more than one a day on average," he said.
"If a person is going to sit on that seat and is uncomfortable with that level of change or they are not going to update the automation of the hard part...all they are basically saying is, 'I can’t sit in this world of constant change and innovation',” he said.
“And they are not the right person for [us]."
