More than 30 super funds and related service providers recently tested their preparedness for an industry-wide cyber attack by participating in a simulated cyber incident exercise. This initiative was organised by SC3, the super industry’s new united front against cyber crime, and yielded several valuable insights. This article explores some of the key takeaways from the event.
Australians lost more than $2 billion to scams and fraud in 2025 and with the advent of AI, the ACCC is warning the digital threat landscape is only going to grow more severe.
To combat this, the super industry has come together under the banner of SC3 to develop a comprehensive new framework for shielding its members from attacks.
Through SC3, participating funds and service providers can share threat intelligence with each other and better coordinate responses to attacks.
Last month, SC3 and Retrospect Labs conducted a simulated industry-wide cyber attack to enable its members to test their preparedness for such an event, practice their responses, and reinforce their cyber defences based on feedback from the day.
Collaboration and communication prove invaluable
One of the key lessons from the day was the value of real-time information sharing and collaboration between funds and service providers.
Cyber incidents are dynamic and circumstances can change rapidly. Vital decisions often need to be made using incomplete, evolving information.
One of the challenges this has posed in the past is that individual organisations tended to interpret the information they had access to in different ways, resulting in a disconnect in how funds and service providers responded to the attack.
Where interdependencies existed between funds and service providers, the complications previously created by these inconsistencies were compounded: the decisions made by one organisation often altered or limited the options available to the other organisations they worked with.
The greater collaboration and information sharing enabled by SC3 proved to be the most effective tool against this during the exercise. By providing regular updates, participants received a clearer picture of both how the simulated attack and individual responses were evolving.
Executive involvement crucial to success
Another takeaway from the day’s proceedings was the importance of involving executives in the response early on. Although the technical response is crucial to managing an attack on digital infrastructure, many of the key decisions that need to be made during such an incident will need executive involvement to get it right..
Executives working closely alongside their teams to maintain stakeholder and communications continuity through the event ensure alignment between technical response and business outcomes.
This is especially important given the uncertainty that organisations experiencing a cyber event often face
More lessons yet to come
While these insights provide a useful baseline from which the industry can strengthen its cyber resilience, this is only an early preview of the day’s learnings.
A Sector Summary Report is currently being prepared for SC3 members. This report will provide detailed analysis, supporting evidence, opportunities for improvement and further insights from the exercise.
Additionally, organisations that participated on the day will be receiving an individualised report designed to empower their own cyber defence strategies.
SC3 will be conducting these incident response simulations on an annual basis to support its members and ensure the security of Australia’s retirement savings system.
