Foreword  2

1 Executive summary  3

Key findings  4

Recommendations  5

2 Introduction  6

Defining the problem  7

3 Framing opportunity alongside risk  8

Scale of debt  8

Increasing threat  8

The cost of inaction and the case for structured investment  9

4 Emerging technology acceleration  11

AI-accelerated vulnerability discovery and modernisation  11

Harvest-now, decrypt-later: the post-quantum transition  12

OT convergence: expanded attack surface and operational value  12

A compressing window, a stronger case for action  13

5 Comparative case studies: three pathways to the same governance challenge  13

Dominant challenge  14

Governance maturity and institutional ownership  14

Transition mechanisms: budgets, procurement and parallel running  16

Comparative implications  17

Spotlight on Australia: governance maturity, persisting exposure  18

6 Conclusion: What 'good' looks like  21

Policy levers: What governments need to do  23

Commercial levers: what enterprises need to do  25

Enabling conditions  27

Differentiated application  27

Governance standard  28

Notes  29

Acronyms and abbreviations  32