What replaces the Essential Eight needs to fix nine years of blind spots

Since its inception, the Essential Eight has been the yardstick Australian organisations used to answer one question: are we secure enough? Now the Australian Signals Directorate (ASD) has confirmed it’s retiring that yardstick. Over the next two years, it will be replaced with a broader principles-based Essentials series built for a world of SaaS, cloud, BYOD and AI agents.

It’s the right call, but only if the framework that replaces it closes the gaps the original Eight didn’t address.

To understand why a reimagining of the Essentials is the right move, it helps to remember what the original Eight was actually built for. First published in 2017, the Essential Eight evolved from the ASD’s Top Four in 2012 and was designed for on-premises enterprise IT at a time when cloud adoption was still in its infancy.

The original framework was a reasonable simplification of the IT environment in 2017, when most organisations really did run a Windows fleet behind a corporate firewall. However, it’s a poor fit for today: an environment stitched together from SaaS platforms, identity providers, personal devices and increasingly autonomous AI agents acting on an organisation’s behalf looks nothing like that.

The details matter here, because a lot of noise has surrounded this announcement.

The Essential Eight control areas themselves (application control, application patching, configuring macro settings, user application hardening, restricting administrative privileges, patching operating systems, MFA, and regular backups) aren’t being discarded. They’re being rebuilt into a structure that can accommodate how modern organisations actually operate.

The replacement will be outcome-based rather than product-based, as well as threat-informed and prioritised rather than tied to a fixed maturity ladder. It will be split into domain-specific chapters starting with enterprise IT, and will be architecture-led, drawing on the ASD’s modern defensible architecture work, with an emphasis on defence in depth rather than a hard perimeter shell.

There’s no doubting that’s a solid foundation to build on, but there are specific blind spots the Essential Eight left unaddressed for years, and the new series has to shine a light on them.

Where are the gaps?

The Essential Eight’s controls were designed around a traditional network perimeter, with the assumption that there is a defensible network edge to apply them at. In practice, identity has been the actual perimeter for years, with credentials, tokens and session data moving across dozens of SaaS platforms and no single network edge left to harden. Any Essentials chapter on enterprise IT needs identity governance treated as a first-class domain, not a footnote under privileged access restriction.

There’s also the problem of shadow IT. Application control under the Essential Eight was built around executables on a managed endpoint, and it has almost nothing to say about the browser-based SaaS sprawl that now accounts for most of an organisation’s actual attack surface, much of it provisioned outside IT’s visibility entirely. Endpoints have shifted in a similar way. The Essential Eight’s patching and application hardening controls are built on the assumption that devices are organisation-owned and centrally managed, where IT can push updates, restrict admin rights, and control what software runs. Hybrid work has made that assumption fictional for a large share of the workforce, and the framework has had little to offer organisations trying to secure devices they don’t own.

Beyond the organisation’s own walls sits another gap entirely: third-party and supply chain risk. The past five years of high-profile breaches have shown that an organisation’s own controls, however mature, don’t protect against a compromised vendor, contractor or managed service provider, yet this has sat almost entirely outside the Essential Eight’s scope.

The newest and least-settled gap is agentic AI. To the ASD’s credit, this topic is explicitly on the table for the new series; the meeting on the first chapter, Essentials for Enterprise IT, was held live, with submissions and feedback invited from the public. AI agents acting autonomously with standing permissions across systems represent a fundamentally different risk model to anything the original Eight strategies were built to mitigate, and the guidance needs to say so clearly rather than leaving it implied.

What do we plug the gaps with?

For Australian security teams, and for the partners and vendors who support them, the priority now is to stay engaged in the process and be ready to respond to the outcome.

The ASD has said that the eight mitigation strategies remain the sound foundation they always were, and organisations should keep investing in maturity uplift on the current framework rather than pausing in anticipation of the new one.

The most important thing to consider during this transition is that the Essentials series doesn’t just make the checklist longer. It must change the operating model, from a static maturity ladder assessed periodically to something that reflects how continuously an organisation’s identity, SaaS and AI footprint actually changes. With the ASD’s consultation process open and ongoing, organisations have a genuine opportunity to shape that shift rather than just wait for it to arrive. We need a framework fit for the future, because a patched-up version of the last one just won’t cut it.

Top image credit: iStock.com/JuSun