Threat Detection & Response

Under the Notifiable Data Breaches scheme you have 30 days to assess a suspected breach once you become aware of it. The harder question is how you’d become aware at all.

Most practices find out when a patient calls, a system stops working, or a ransom note appears. By then an attacker has usually been in the environment for weeks and with no logs to reconstruct what they touched, you can’t tell the OAIC what was accessed, or tell patients whether their records were involved.

Detection isn’t about stopping every attack. It’s about knowing, early, and being able to prove what happened.