Imagine taking a call tomorrow to say your engineering drawings have appeared online. Then a second call, from your customer: what was taken, how bad is it, and who accessed it? For Australia’s defence suppliers, this isn’t hypothetical. It has happened before, and the threat is growing as attackers adopt AI.
The good news is that the gap can be closed. Small and mid-sized suppliers don’t need a prime’s budget to know where their sensitive data is, see how it moves, and keep it protected wherever it goes.
In a recent AIDN webinar, GuardWare Co-Founder and CEO Rizwan Mahmood spoke with David Bridge, founder, CEO and principal consultant of BPS Group, and Jim Boyd, operations and defence lead at BPS. David brings 35 years of project delivery experience across manufacturing, mining and energy, holds a master’s in project management and PMP credentials, and has twice received global recognition for project delivery excellence. Jim brings more than 25 years of experience working for Defence, both directly and through contracting. Together they discussed what a breach really means for a defence supplier, why engineering files are so hard to protect, how to use AI safely, and how BPS turned its cyber investment into lower insurance costs. Here are the key takeaways.
Defence supply chain breaches are real, and recent
In 2016, attackers compromised a small Australian defence supplier of about 50 staff and took around 30 GB of data, including information on the F-35 program, surveillance aircraft and naval vessels. In 2018, shipbuilder Austal reported a breach, stating it had detected an infiltration but no sensitive information was taken. And in November 2025, an engineering company confirmed unauthorised access to part of its IT systems, with attackers reportedly inside for five months unnoticed.
As Rizwan pointed out, a company the size of Austal had the capability to know what was happening. For a small business, one of more than 5,000 defence suppliers in Australia, you might not even know you had been breached.
“These are persistent attackers. They are after our IP and our technological excellence.” – Rizwan Mahmood
Old data still matters in defence
It’s tempting to dismiss a breach from ten years ago. But defence and engineering don’t move at the speed of IT. Designs that are built today stay in service for decades, so even an older or unclassified leak can help an attacker plan.
And it’s not only drawings at risk. Plans, pricing, customer and staff details all let an attacker build a picture of your business, then target your people. With AI tools now in attackers’ hands, they can do this at machine speed.
Turn It All On, Then Learn Fast
Rather than switching features on gradually, Joanne turned the whole system on from day one and let the data tell her what mattered. That approach surfaced things she didn’t expect, including how differently her own team members were each handling day to day processes. It led to real changes, like banning USB use once she could see exactly how and when it was being used. It also led to a principle she now recommends to every business owner watching: build a no fault culture. “You’ve got to bite your tongue and have a no fault policy,” she said. “You want people to come to you if something happens.”
A breach costs far more than your reputation
Reputational damage is the first thing most people think of, and it flows on to the primes you supply. But for an SME where people already wear many hats, the bigger burden is the work that follows: reports, investigations, paperwork and dealing with insurers.
David added that insurers set fairly stringent guidelines for how you respond, particularly to a ransomware event. The first minutes, hour, day and week are an intensive process, which is why he sees having a response plan and a business continuity plan in place as one of the most valuable investments of your time.
“It’s not as simple as ‘I’ve been breached, now I report it.’ There are ongoing investigations, paperwork and insurers. If you don’t follow the process correctly, it can open you up to further complications.” – Jim Boyd
Even a simple mistake can cost hundreds of hours
Rizwan shared that a major Australian prime had told him the same thing. An incident doesn’t have to be a breach: a human error, such as an email sent to the wrong person, may have no impact but still has to be reported. Establishing that nothing was breached then takes effort on the prime’s side, the supplier’s side and Defence’s side. As Rizwan put it, prevention is better than cure.
And when you report, the first questions are simple: where was the data stored, and what was taken?
“Usually the insurance broker asks where the data was stored and what was taken. A lot of SMEs probably can’t answer that.” – Jim Boyd
Why engineering files are so hard to protect
Engineering data flows down a long chain: from the Commonwealth to a prime, then to project managers, contractors and vendors. Each package of drawings may go to several companies, creating a spiderweb of copies that is very hard to track.
Engineering files also come in non-standard formats, and day-to-day work often depends on moving them. Many engineering firms can’t even block USB drives, because files have to be copied to a device to be printed or used on the shop floor.
“There are only so many limitations you can deploy in Microsoft. Once I share that with my end user, I’m starting to lose control of that data.” – Jim Boyd
Once data is shared, can you take it back?
Jim pointed to the cancelled French submarine program as an example. Data went out to around 120 vendors, and when the government didn’t proceed, the data was meant to be destroyed. According to Jim, investigations are now finding it hasn’t been. Without a way to instantly revoke access, you are relying on trust alone.
Some primes respond by refusing to let data leave their systems at all, so vendors must work on-site or on prime-issued laptops. That keeps data in, but it makes collaboration slow and restrictive, especially for SMEs trying to break into the market.
“We need to start controlling our data and protecting it ourselves, and knowing where our data is going.” – Jim Boyd
Use AI to augment your team, not to leak your data
David described AI as an augmenting tool rather than a replacement: it won’t be replacing great engineers and designers anytime soon. Jim noted that BPS uses it to gauge early whether it is a genuine contender for a tender before investing in a full response. Some organisations ban AI outright, and as Jim put it, there goes that productivity. Yet where companies haven’t set controls, people will use tools like Claude or ChatGPT, and sensitive data can end up in a public AI chat.
David said he doesn’t think anyone would knowingly put sensitive data into an AI tool. The risk is inadvertent leakage, when data is put into an unsecured environment. The answer is clear rules on which tools are authorised, ongoing staff education, and visibility for management over who is doing what, and when.
“It’s about setting up the rules and the guardrails so we can safely and securely use AI tools in our day-to-day work. Most importantly, our staff need to understand when and how to use them.” – David Bridge
Good data governance starts where a file first lands
Jim shared a practical example from BPS’s work towards Essential Eight Maturity Level Two. Client files often arrive first in a downloads folder, mixing official and sensitive material in one place. If staff don’t move, scan and label them straight away, sensitive data can sit unprotected or be sent out by mistake.
The lesson is to apply controls at the very start of a file’s journey: scan incoming data, label its sensitivity, and keep that protection in place as the file moves.
“The protection, the label, the sensitivity, how we handle it matters at that very starting point of the file’s journey.” – Jim Boyd
A cyber investment that pays for itself
BPS’s decision came at a telling moment. An engineering firm it knew well, with 50 to 60 staff, discovered attackers had been in its systems for about six weeks, only when screens went blue one Monday morning. At the same time, BPS’s broker made it clear that insurers no longer want to hear what you plan to do. They want to see what you are actually doing.
Since adopting GuardWare alongside other risk measures, BPS has received a premium discount every year. David estimates it now pays 35 to 40 per cent less for insurance than it otherwise would, and the investment paid for itself in under a year. Jim adds that the alerts give real peace of mind: when a new starter plugged in an unauthorised USB, it was blocked and he was notified instantly.
“The feedback from our underwriters is: that’s a company that understands risk, and that’s a company we want to do business with.” – David Bridge
Where to start: three steps for the next 90 days
Asked what a business owner should do in the next 90 days, David outlined a practical starting point:
- Map how your data moves. Understand where your work happens, and when, where and how your people share your IP and your clients’ IP with external stakeholders.
- Assess the risk and build your defences. Once you know your threat surface, put the right controls in place to protect it.
- Plan your response. Prepare an incident response plan and a business continuity plan, so the first hour, day and week of an incident are already mapped out.
“For me as a business owner, the first thing is to understand what you have.” – David Bridge
How GuardWare supports defence suppliers
GuardWare is an Australian data centric security company, and its work on securing engineering files for the defence supply chain was funded through the Defence Trailblazer program. Its data-centric suite maps directly to the challenges the panel raised:
- Discover finds and classifies sensitive data across Microsoft 365, SharePoint, email, Google Workspace and file servers, including text inside images and scanned documents, so you can label, move or delete it and answer “where was the data stored?”
- Insight monitors how data moves 24/7, at content level, across email, web uploads, printing, USB and AI tools. It can block sensitive data from reaching public AI without banning AI, and we can send staff a “Speeding Ticket” turning a risky action when data is potentially exposed into a teachable moment, which is very effective in changing people’s behaviour.
- Protect keeps files encrypted at all times, even while people work on them, including SolidWorks, Autodesk and Siemens engineering formats. Stolen files are unreadable, new files can be encrypted by default, and access can be revoked from a contractor at any time.
- Assessor gives you a baseline of where your data risks sit today, so you can plan with confidence.
Webinar attendees can claim a free AI assessment to see how data is being used across their environment today.
As Rizwan put it, the key question for every defence supplier is simple: do you know where your sensitive data is, who is accessing it, and how it is being used, moved and shared?
Related Blogs
The Outsourcers Answer: TCS and HCLTech Confront a Hacker’s Claims
Eight Agents, Four Days: AI Runs a Government Intrusion in Taiwan
Closer to Home: Origin Energy’s Breach Traced to a Manila Call Centre
284 Million Rows in Four Days: McKesson’s Cloud Warehouses Emptied
