For years, the Essential Eight has been the benchmark many Australian organisations have used to improve their cyber security. Whether driven by government requirements, cyber insurance, customer expectations or internal governance, it has shaped security roadmaps across both the public and private sectors.
Now the conversation is changing.
The Australian Signals Directorate (ASD) is broadening its guidance through the ASD Cyber Security Framework, shifting the focus away from simply achieving a maturity level and towards implementing security controls that demonstrably reduce risk. That doesn’t make the Essential Eight irrelevant. Far from it. It remains one of the most practical security frameworks available. What is changing is how organisations should think about it.
Instead of asking, “Are we Maturity Level 3?”, a better question is:
“Would our controls actually stop the techniques attackers are using today?”
In our experience, that’s where the real discussion starts.
We’ve assessed organisations that considered themselves well on the way to Maturity Level 3. They had application control in place. Multi-factor authentication was enabled. Administrative accounts were separated. Patching processes were documented.
Yet when we looked beyond the project plans and policy documents, we found implementation gaps that significantly reduced the effectiveness of those controls.
PowerShell was unrestricted on developer machines.
Critical patches waited for the next monthly maintenance window.
Administrators logged into domain controllers from their everyday laptops.
MFA had been rolled out across the organisation, but it was still vulnerable to phishing attacks.
None of these environments were poorly managed.
Most had invested heavily in cyber security.
The issue wasn’t a lack of technology. It was that small implementation decisions had gradually introduced risk over time.
That’s why independent assessments remain valuable.
A control doesn’t become effective because it’s listed in a project plan or marked as complete in a spreadsheet. It becomes effective when it’s implemented consistently across the environment, monitored over time, and able to withstand the techniques attackers are actually using.
The Biggest Mistake Organisations Make
One of the biggest misconceptions we see is treating the Essential Eight as a deployment project.
Roll out MFA. Implement application control. Patch operating systems. Deploy a backup solution. Tick the box.
In reality, that’s only the beginning.
Cyber security isn’t static. Your environment changes constantly. New users join the organisation. Applications move into the cloud. Developers introduce new tools. Business units request exceptions. Third-party vendors gain remote access.
Every one of those changes has the potential to weaken a control that was considered complete six months earlier.
Take application control as an example. An organisation may successfully deploy Windows Defender Application Control across the business and consider the project finished. Six months later, a development team requests unrestricted Python to support automation. Another team needs PowerShell for deployment scripts. An engineering application requires an exception because it no longer functions under the existing policy.
Individually, each decision makes sense. Collectively, they can create the exact conditions an attacker is looking for. The same pattern appears with privileged access. A temporary Domain Admin account is created to support a migration project. The migration finishes, but the account remains active because nobody wants to risk breaking production.
A contractor receives elevated access for two weeks. Twelve months later, those permissions are still there. These aren’t unusual situations. They’re exactly the kinds of issues we encounter during security assessments. Rarely does an organisation fail because it ignores security altogether. More often, it struggles because strong controls have gradually been diluted by operational exceptions.
That’s why evidence matters more than intention. It’s also why the conversation is shifting away from maturity scores and towards security outcomes.
What We Look For During an Essential Eight Assessment
When we perform an assessment, we’re not trying to catch organisations out.
We’re trying to answer one simple question:
“If an attacker compromised one endpoint today, how difficult would it be for them to move further into the environment?”
That question changes the discussion completely.
Instead of reviewing policies, we start looking at how controls operate in practice.
Can PowerShell still execute unrestricted scripts?
Are privileged administrators using dedicated workstations?
How quickly are critical vulnerabilities actually patched, not just according to policy?
Are backups regularly restored and tested, or simply assumed to work?
Is multi-factor authentication resistant to modern phishing techniques, or is it only providing a basic second factor?
These questions reveal far more about an organisation’s security posture than a maturity score alone.
Over hundreds of assessments, we’ve found the same themes appearing again and again.
The controls are usually there.
The implementation detail is where organisations either strengthen their security or unintentionally leave the door open.
The Four Gaps That Keep Appearing During Assessments
Every environment is different.
Different industries have different risk profiles. Different organisations have different technology stacks. Even organisations in the same sector often have completely different security priorities.
Yet after enough security assessments, patterns begin to emerge.
The same implementation gaps appear again and again. Not because IT teams don’t know what they’re doing, but because these are the areas where operational requirements and security controls tend to collide.
These aren’t hypothetical examples pulled from a framework. They’re the kinds of issues that regularly surface during assessments and security reviews.
1. Application Control Isn’t the Problem. The Exceptions Are.
Almost every organisation we work with has some form of application control.
Some use Microsoft Defender Application Control (WDAC). Others rely on AppLocker or third-party allowlisting solutions. On paper, the control is implemented.
The problems usually start when exceptions are introduced.
Development teams need Python for automation.
Infrastructure teams rely on PowerShell to manage servers.
Engineering software requires custom scripts.
A legacy application won’t run unless specific executables are excluded.
Each request is reasonable in isolation. Business still needs to operate.
Over time, however, those individual exceptions can undermine the purpose of the control altogether.
One assessment involved an organisation that had invested heavily in application control across its entire Windows environment. Everything looked well managed until we examined how PowerShell was being used.
Although executable files were tightly controlled, unrestricted PowerShell was still available to a large number of users. An attacker wouldn’t need to introduce malware onto the system. They could simply use tools that already existed.
That’s exactly how many modern attacks work.
Rather than dropping malicious executable files onto disk, attackers increasingly rely on trusted tools already installed within Windows. PowerShell, Windows Management Instrumentation (WMI), Command Prompt and other legitimate administration tools are frequently used to move through an environment while blending into normal activity.
Application control is still one of the most effective security controls available.
The challenge isn’t deploying it.
It’s making sure the inevitable operational exceptions don’t become permanent security weaknesses.
One question worth asking is simple:
If someone compromised a developer’s laptop today, could they execute scripts that weren’t intended to run?
If the answer is yes, it’s worth revisiting how application control has been implemented.
2. Identity Has Become the New Perimeter
There was a time when organisations focused almost entirely on protecting the network.
Firewalls, web gateways and email filtering formed the first line of defence.
Today, identity has become the primary target.
Attackers know that if they can steal or hijack a legitimate identity, many traditional security controls become far less effective.
That’s one of the reasons phishing has evolved so quickly.
Modern phishing campaigns aren’t always trying to steal passwords.
They’re attempting to steal authenticated sessions.
That’s an important distinction.
An organisation may proudly report that multi-factor authentication has been deployed to every employee.
That’s good progress.
But it’s only the next question that really matters.
How resistant is that authentication method to phishing?
We’ve seen environments where every employee used push notifications through an authenticator application, yet users were still vulnerable to MFA fatigue attacks.
We’ve seen legacy VPN platforms protected by SMS authentication because “it’s only temporary.”
We’ve seen privileged administrator accounts protected differently from standard user accounts simply because older infrastructure hadn’t yet been upgraded.
None of those situations automatically mean an organisation has poor security.
They do highlight how quickly identity protection becomes inconsistent as environments evolve.
One of the biggest changes over the past few years has been the move towards phishing-resistant authentication, particularly for privileged users and access to critical systems.
Rather than asking whether MFA has been deployed, organisations should now be asking whether it provides the level of protection today’s attack techniques require.
Identity is no longer just another security control.
For many organisations, it has become the front door to the business.
3. Privileged Access Is Still One of the Fastest Ways to Lose Control
If there’s one area that consistently attracts an attacker’s attention after initial access, it’s privileged accounts.
That’s because compromising a single administrative account can dramatically change what an attacker is able to do next.
Most organisations already understand this.
Separate administrator accounts have become standard practice.
Administrative privileges are reviewed more regularly than they were a decade ago.
Password vaults are becoming increasingly common.
Those are all positive developments.
The challenge is what happens after privileged access has been granted.
One of the questions we often ask during an assessment is surprisingly straightforward.
“Where do your administrators actually perform administrative work?”
If the answer is “their normal laptop”, we usually explore that conversation further.
Think about a typical working day.
An administrator checks email.
Clicks a Teams link.
Browses vendor documentation.
Downloads software updates.
Joins video meetings.
Then opens Remote Desktop and connects to a domain controller.
If that same workstation is compromised, the attacker may already be sitting on the device used to administer the environment.
That’s why the ASD has increasingly emphasised stronger privileged access practices, including dedicated Privileged Access Workstations (PAWs) for administrative tasks.
The concept isn’t about making administrators’ lives more difficult.
It’s about reducing the opportunities for privileged credentials to be exposed through everyday activities that have nothing to do with system administration.
Privileged access should also be temporary wherever possible.
Permanent administrative permissions have a habit of surviving long after the project or migration they were originally created for.
One of the simplest security improvements an organisation can make is regularly asking:
“Who still has privileged access, and do they still need it?”
The answers are often surprising.
4. Patching Isn’t About Speed Alone. It’s About Consistency.
Every organisation patches.
The difference lies in how consistently it happens.
When we review patch management, we rarely find organisations ignoring critical vulnerabilities altogether.
More often, we find mature processes that occasionally struggle to keep pace with operational realities.
Emergency changes require CAB approval.
Business owners request delays.
Operational teams wait for scheduled maintenance windows.
Critical servers can only be restarted after hours.
Individually, these decisions are understandable.
Collectively, they create longer exposure windows than most organisations realise.
Attackers don’t wait for the next maintenance window.
If a critical vulnerability becomes publicly available, it’s often being scanned and exploited within hours or days.
The challenge is balancing operational stability with security risk.
That’s why we encourage organisations to look beyond patch compliance percentages.
Instead, ask questions like:
- How long does it actually take us to deploy a critical patch?
- Which systems consistently miss deployment targets?
- Are delays documented and risk assessed?
- Do we know which internet-facing services represent the highest priority?
Those conversations tend to reveal more than a dashboard showing 98% patch compliance.
A single internet-facing system waiting several weeks for a critical security update can create significantly more risk than dozens of internal systems that are only a few days behind schedule.
The goal isn’t perfection.
It’s ensuring the systems that matter most receive attention first.
One thing these four areas have in common is that none of them usually fail because of technology.
They fail because environments evolve.
Projects introduce exceptions.
People change roles.
New business requirements emerge.
Over time, those small operational decisions accumulate until the implementation no longer reflects the original security design.
That’s why regular validation matters.
Security controls shouldn’t only be reviewed when an audit is approaching. They should be assessed continuously to ensure they’re still providing the level of protection the organisation expects.
Frameworks provide direction.
Independent assessments provide confidence that those controls are still working the way they were intended.
Frequently Asked Questions
Is the Essential Eight still relevant?
Yes.
The Essential Eight remains one of the ASD’s most practical sets of mitigation strategies and continues to be widely referenced across government, critical infrastructure and enterprise organisations. As the ASD expands its broader Cyber Security Framework, the emphasis is increasingly on implementing effective controls rather than simply achieving a maturity level.
Should organisations still target Maturity Level 3?
That depends on your regulatory obligations, contractual requirements and risk profile.
For many organisations, the more valuable question is whether security controls have been implemented effectively and are operating consistently across the environment. A maturity score is useful, but it shouldn’t become the sole measure of security.
How often should an Essential Eight assessment be performed?
There’s no universal answer, but assessments should be repeated whenever there are significant changes to the environment, such as cloud migrations, mergers, major infrastructure upgrades or changes to privileged access models. Even without major changes, regular independent reviews help identify configuration drift before it becomes a security issue.
What’s the biggest mistake organisations make?
Treating implementation as the finish line.
Security controls need ongoing maintenance, review and validation. Most of the findings we identify during assessments aren’t caused by missing controls. They’re caused by controls that have gradually weakened as the environment changed.
Conclusion
The conversation around the Essential Eight is changing, but the underlying objective remains the same: reduce the likelihood of a successful cyber attack by implementing security controls that work in practice.
Whether your organisation is aligning with the Essential Eight, preparing for the evolving ASD Cyber Security Framework, or responding to customer and regulatory requirements, success isn’t measured by how many controls appear on a checklist. It’s measured by how effectively those controls protect your environment when they’re needed most.
The organisations that consistently perform well during security assessments aren’t necessarily those with the biggest security budgets. They’re the ones that continuously validate their controls, manage exceptions, and understand where operational realities have introduced risk over time.
Security is never static. As your business evolves, your security controls need to evolve with it.
How Intrix Can Help
At Intrix, we work with Australian organisations to move beyond compliance and build security programmes that stand up to real-world threats. Our team doesn’t just assess whether a control exists. We validate how it’s implemented, identify gaps that increase risk, and provide practical recommendations that strengthen your overall security posture.
Whether you’re preparing for an Essential Eight assessment, reviewing your cyber security maturity, or aligning with the ASD Cyber Security Framework, our specialists can help you understand where your environment stands today and what should be prioritised next.
Our services include:
- Essential Eight Assessments to benchmark your current security maturity and identify practical improvement opportunities.
- Penetration Testing to validate whether your security controls can withstand real-world attack techniques.
- Security Risk Assessments to identify technical and operational risks across your environment.
- vCISO and Security Advisory Services to help organisations develop practical cyber security strategies aligned with business objectives and regulatory requirements.
- Continuous Security Testing to ensure controls remain effective as your technology environment evolves.
Cyber security isn’t about achieving a single maturity level. It’s about continuously improving your ability to prevent, detect and respond to threats.
If you’re looking for an experienced Australian cyber security partner to independently assess your environment and provide practical, actionable guidance, contact Intrix to discuss how we can help strengthen your organisation’s cyber resilience.
