Across Australia, cyber incidents continue to test the resilience of critical infrastructure and public services. While government agencies have strengthened their perimeter defences, the nature of risk has changed. Today, the question is not if an attack will happen – it’s how fast you can recover when it does. 

For NSW Government leaders, this challenge is front and centre. As the State continues to digitise citizen services and modernise systems, the pressure to meet new mandatory resilience standards has intensified. True readiness now depends not only on technology, but on the speed and clarity of executive-level decision-making when systems go down, data is encrypted, and public confidence is at stake. 

At Digital NSW 2025 showcase, Canary IT and Commvault co-hosted “Inside a Ransomware Crisis” – an executive simulation which was held over two exclusive sessions. Limited to a select number of executive attendees from various NSW Agencies and Departments, attendees were immersed in an interactive experience which recreated the critical hours of a ransomware attack. Facilitated by Commvault’s Security Field CTO for APAC, participants navigated real-world decision paths – from initial detection and containment to communication strategies and the ultimate ethical and financial dilemma: to pay or not to pay the ransom. 

What makes this experience unique is its real-world applicability underpinned by collaboration with confidentiality. Conducted strictly under Chatham House Rules, the format ensures complete candour among peers, enabling genuine discussion about vulnerabilities, accountability, and policy coordination. Leaders can explore their response strategies in a safe environment, uncovering gaps that often only become visible under the pressure of a real event. 

This focus on realism mirrors the insights from the latest Commvault State of Data Readiness Report. The findings paint a stark picture of the gap between expectation and operational reality: