Board Cyber Advisory and AI Governance

Matt Miller, Co-Founder, CEO and Fractional CISO, Insicon Cyber

A cybersecurity leader with more than 25 years of experience across NASDAQ and ASX listed organisations, and an ISO 27001 Senior Lead Auditor working on AI governance with boards across Australia and New Zealand. Matt has held the CISO seat, full time and fractional, which is why his advice to directors comes from having been accountable rather than adjacent.

Speak with Matt

Areas of expertise

Matt Miller is a cybersecurity expert, business-savvy technologist and entrepreneur who advocates for the importance of cybersecurity knowledge in the boardrooms of Australian organisations. He co-founded Insicon Cyber in 2013 with Greg Bunt and continues to work directly in client engagements as a fractional CISO.

His 25 year career spans NASDAQ and ASX listed organisations. Matt has served as both a full-time and fractional Chief Information Security Officer for large-scale enterprises in online retail, financial services and technology, and was Head of Technology, the CIO role, for the asset finance division of one of Australia's leading regional banks. That background covers ICT service management and delivery, risk management, contract negotiation, data and information security, and strategic planning.

His particular strength is bridging executive leadership and technical teams, aligning functions that usually talk past each other. It is the reason his current work sits where AI governance meets the board table: the question of whether an organisation should deploy an AI system, and how it evidences that decision, is exactly the kind of problem that fails when those two groups cannot communicate.

Board cyber advisory and director education

Board level risk briefings, director education and translating regulatory expectation into decisions a board can actually make. Matt works with directors on the ASD and AICD guidance for boards, the APRA letter to industry on AI of 30 April 2026, and ASIC open letter 26-092MR of 8 May 2026.

AI governance and ISO 42001 readiness

Matt leads the Insicon Cyber AI Security and Governance practice, helping organisations design AI management systems aligned to ISO 42001 and prepare for independent certification by an accredited certification body. As an ISO 27001 Senior Lead Auditor he has assessed management systems from the other side of the table, which makes him direct with clients about what a certificate does and does not prove.

Fractional CISO leadership

Acting as the accountable security executive for organisations that need CISO-level judgement without a full-time appointment. Matt has held the role both ways, in-house and fractional, across online retail, financial services and technology. Most of his AI work originates here, because AI decisions arrive at the CISO desk before they arrive anywhere else.

Financial services, retail and technology

Deep sector experience from inside listed organisations, including the Head of Technology role for the asset finance division of a leading Australian regional bank. Matt advises on APRA CPS 230 and CPS 234 obligations, third-party and supply chain risk, and the contract and vendor questions that sit underneath both.

Trans-Tasman regulatory advisory

Essential Eight, the Australian Privacy Act, the SOCI Act, the Aged Care Act 2024 information management obligations, the New Zealand Privacy Act 2020 and the New Zealand Information Security Manual. Matt advises organisations operating on both sides of the Tasman where obligations differ and a single control set has to satisfy both.

Recognition and credentials

Finalist, CISO of the Year, Australian Cyber Awards 2026
ISO 27001 Senior Lead Auditor
More than 25 years of experience across NASDAQ and ASX listed organisations
Former Head of Technology (CIO), asset finance division of a leading Australian regional bank
Co-Founder and CEO of Insicon Cyber, winner of the Retail Security Partner Award at the Benchmark Security Awards 2025
Insicon Cyber is a finalist for Cyber Consulting Business of the Year, SME, at the Australian Cyber Awards 2026, a finalist in the Healthcare Security Partners category at the 2026 Benchmark Security Awards, and a finalist in the SMB of the Year category at the AISA Cyber Security Awards 2026

Point of view

Treat cybersecurity as a business problem, not a technology one. There is always more tech you can throw at the problem, but is it solving it or shifting it?

Matt's test for whether an organisation is genuinely resilient rather than merely compliant is a simple one. When did you last run a full incident response exercise under realistic conditions? When did you last restore from backup under time pressure, with real business consequences simulated? If the answer is that you have not, or that it was a couple of years ago, you are not resilient. You are hoping.

He applies the same standard to AI. Most organisations bought AI before they architected it. Licences went out, agents got built, staff connected tools to models, and nobody costed the token bill or drew the data path. The result is an AI estate that is expensive, opaque and difficult to evidence to a board or a regulator.

The Insicon Cyber approach to AI reflects that position: test it, govern it, maintain it. Assurance is continuous rather than a point-in-time certificate, and controls are proven through adversarial testing rather than asserted in a policy document.

Speaking, media and commentary

Matt is available for media commentary, conference speaking, board briefings and podcast appearances on AI governance, ISO 42001, board cyber risk, the fractional CISO model and cyber risk for Australian and New Zealand boards. For media enquiries and speaking requests, contact info@insiconcyber.com.

Work with Matt

Matt leads engagements across Board Cyber Advisory, CISO-as-a-Service, and AI Security and Governance, alongside Greg Bunt, Co-Founder, Director and Fractional CISO, and an experienced management and consultant team who deliver the work day to day.

AI Security and Governance

Test it. Govern it. Maintain it.

If your board cannot describe the AI risk the organisation is carrying, that is the first thing to fix. Start with an honest read of where it actually sits.

Engage Insicon Cyber AI Readiness Assessment