This story is part of the 2026 iTnews State of Security report. Read it for free here.<\/a><\/p>\n\u201cThe most dangerous door is often one you didn’t even know existed,\u201d Prabhu said.\u00a0\u00a0<\/p>\n
\u201cThe journey has been about shifting from defending a perimeter to understanding the entire terrain, because the threat doesn’t stop evolving.\u201d\u00a0<\/p>\n
With operations spanning more than 50 countries, and\u00a0logistics\u00a0increasingly recognised as a high-risk sector within the global economy, Toll Group has embedded security requirements directly into procurement processes, contracts, and third-party risk decisions as a condition of doing business.\u00a0<\/p>\n
\u201cIf you’re only managing security after risk materialises, you’re already too late,\u201d Prabhu said.\u00a0\u00a0<\/p>\n
\u201cData security isn’t an abstract problem – you’re dealing with customer PII, vendor records, and operational telemetry, all of it moving across borders and third-party systems where you can never fully guarantee control.\u201d\u00a0<\/p>\n
Prabhu noted that because Toll\u00a0Group\u2019s\u00a0assets are\u00a0designated\u00a0as critical infrastructure under Australia\u2019s SoCI Act, the organisation faces obligations that extend beyond commercial risk.\u00a0<\/p>\n
\u201cA failure isn’t just a commercial or reputational issue \u2013 it has a national impact,\u201d\u00a0he said.\u00a0\u00a0<\/p>\n
\u201cThat’s the reality we operate in every day given shifting geopolitical alignment and global privacy mandates.\u201d\u00a0<\/p>\n
The result is a threat surface that continues to expand faster than the controls designed to protect it.\u00a0\u00a0<\/p>\n
\u201cBetween third-party vendor risk, multi-jurisdictional complexity, nation-state threats targeting critical infrastructure, and\u00a0AI introducing data flows that existing frameworks weren’t built to govern, we’re\u00a0constantly managing a perimeter that doesn’t stand still,\u201d Prabhu said.\u00a0\u00a0<\/p>\n
\u201cWe must identify every member in the ecosystem and get an assessment on each,\u00a0and that is phenomenal amount of work,\u00a0given resource constraints and evolving threat perception.\u201d\u00a0<\/p>\n
To address these challenges, Toll Group has strengthened vendor due diligence processes, tightened third-party access controls, and increased scrutiny around how AI technologies interact with enterprise data environments.<\/p>\n
Prabhu said third-party risk platforms such as\u00a0ProcessUnity\u00a0have helped ensure that \u201csecurity is a condition of entry, not an afterthought\u201d.\u00a0<\/p>\n
The organisation\u2019s current focus on supply chain and vendor security also follows a significant cyberattack that Toll Group experienced in 2020.\u00a0\u00a0<\/p>\n
\u201cWe’ve already lived through what the reactive version looks like,\u00a0and at the scale we operate, you can’t afford to learn that lesson again,\u201d Prabhu said.\u00a0\u00a0<\/p>\n
\u201cThe obligation to get ahead of it was as much about hard experience as it was about regulatory pressure and emerging threats.\u201d\u00a0<\/p>\n
AI data risks<\/p>\n
The growing use of AI across Toll Group projects is\u00a0creating an entirely new layer of complexity for data security and governance.\u00a0\u00a0<\/p>\n
\u201cSuddenly you’re asking questions about what data enters a model – is there a way of measuring the model performance,\u00a0and what is data residency and processing in different jurisdictions as per regulation,\u00a0and who sees the outputs\u00a0\u2013\u00a0and\u00a0realising your existing controls were never designed with that in mind,\u201d he said.\u00a0\u00a0<\/p>\n
\u201cIt requires a complete re-look at the data security strategy.<\/p>\n
\u201cIt’s\u00a0going to be a lot worse with Agentic AI entering the mix. Good governance and guardrails\u00a0is\u00a0mandatory.\u201d\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"Toll Group has adopted a more comprehensive approach to data security in response to a rapidly evolving threat…\n","protected":false},"author":2,"featured_media":797029,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[256,254,255,64,63,105],"class_list":["post-797028","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-au","tag-australia","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/797028","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=797028"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/797028\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/797029"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=797028"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=797028"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=797028"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"Toll](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/07\/1783925534_544_ImageResizer.ashx.jpeg\")
<\/p>\n