The civilian cyber defence sector in Australia has traditionally focused on the static protection of information systems, while cyber offence—used to disrupt malicious actors—is the responsibility of national defence and law enforcement agencies. However, between these two domains lies a critical and underutilised space: the proactive monitoring and engagement of malicious actors by civilian organisations.

The Active Cyber Defence Alliance (ACDA) believes this middle ground presents a valuable opportunity for civilian entities to observe, interact with, and gather intelligence on cyber threats. Such actions could significantly strengthen defensive capabilities—provided there is a legal framework in place that protects these organisations from prosecution when acting in defence of information, privacy, and intellectual property.

Every foothold a malicious actor gains within an Australian organisation brings them closer to exfiltrating nationally sensitive data. Denying that foothold requires vision and responsiveness.

As the saying goes, a boxer who fights blindfolded is at a severe disadvantage—unable to see incoming strikes, they lose the ability to block, dodge, or counterattack. The ACDA is committed to exploring the lawful use of active defence techniques that remove the blindfold, illuminate the threats, and enable a timely, informed response.