[This article was first published in December 2025 by James Turner.] Another year is about to tick over, and Australia’s cyber defence posture continues to evolve, but mostly in rhetoric rather than in practice. We have matured in what we believe needs to be done, yet the delivery of those capabilities remains underdeveloped. In 2026, that execution gap will become impossible to ignore. There are three strategic shifts we need to make.