Human-controlled AI defence • Sydney, Australia

Defend against AI. Secure AI. Use AI to defend.

AI changes both sides of cyber security. Attackers can move faster, AI systems create new trust boundaries, and defenders can use AI to improve analysis and response. HD Cyber Defence turns those realities into practical controls with human authority at the point of consequence.

See the defence journey Explore defensive services

01 Evidence before action 02 Least privilege 03 Human override

HD / AI DEFENCE CORE HUMAN AUTHORITY VERIFIED

OPERATING SEQUENCESEE → VERIFY → REDUCE → RESPOND

Public: Observe
Trusted: Verify
Sensitive: Limit
Privileged: Approve
Containment: Override ready

Trust boundaries are explicit. Automation remains bounded. Consequential action requires human authority.

DetectSignals visible VerifyEvidence required ReduceExposure limited ContainOverride ready RecoverPath defined LearnControls improve

The HD defence principle

Defence first.
Verify always.
Respond calmly.

Modern attacks do not always look suspicious. AI can make a false request polished, personal and urgent. Familiar language, a recognised face or a trusted voice is no longer enough.

The safer response is an evidence-led operating model: verify through a trusted channel, reduce unnecessary access, bound automation and preserve a clear human decision point.

Read Henry’s operational approach

Defensive operating journey

Move from uncertain signal to controlled recovery.

Six connected decisions keep speed from outrunning evidence, authority or containment.

01
Detect
See unusual identity, data, endpoint, email, network and AI behaviour.
02
Verify
Confirm identity, source and intent through a separate trusted channel.
03
Reduce
Remove unnecessary exposure, privilege, data access and agent autonomy.
04
Contain
Stop harmful actions while preserving the evidence needed to understand them.
05
Recover
Restore access and services carefully, with ownership and decision points clear.
06
Learn
Turn evidence into stronger controls, tested playbooks and calmer future decisions.

Defence Genome / Threat Signature

Seven signal layers. One controlled defence system.

This is a cybersecurity signal structure—not biological DNA. Each layer joins a risk to a primary control and a practical pathway.

01
IdentityWho is asking?
Risk
Compromised or manufactured identity
Control
Independent verification and strong access controls
Identity protection →
02
DataWhat may be exposed?
Risk
Sensitive information enters an unsafe tool
Control
Classify before use and prohibit secrets
Data classification guide →
03
AIWhat can act?
Risk
Prompt injection or excessive agency
Control
Bound tools, permissions and human approval
AI Security Hub →
04
EndpointWhere can it spread?
Risk
Compromised device or unpatched exposure
Control
Harden, monitor and isolate deliberately
Exposure reduction →
05
EmailIs the request genuine?
Risk
AI-generated phishing and payment pressure
Control
Trusted-channel verification before action
Verification guide →
06
NetworkWhat is connected?
Risk
Unexpected access and uncontrolled movement
Control
Segment, observe and contain meaningful signals
Security visibility →
07
Human verificationWho authorises impact?
Risk
Urgency bypasses judgement and evidence
Control
Second approval, override and calm escalation
Human verification →

Choose the outcome

Start with the decision you need to make safer.

Each pathway connects practical guidance, defensive services and a clear next action.

01AI

Adopt AI safely

Set data boundaries, governance, approved use, agent controls and verification routines.

Explore secure AI adoption → 02ID

Reduce exposure

Prioritise identity, remote access, vulnerabilities, privileged access and preventable gaps.

Review exposure services → 03IR

Prepare for an incident

Clarify roles, evidence, escalation, containment, communication, recovery and learning.

Build incident readiness → 04VX

Defend against impersonation

Prepare for AI phishing, cloned voices, deepfakes, payment pressure and executive fraud.

Strengthen human verification → 05SO

Improve security visibility

Turn fragmented identity, endpoint, email and network signals into useful operational context.

Explore security operations → 06EX

Brief leaders clearly

Translate technical risk into board-safe decisions, priorities, ownership and resilience.

View leadership services →

Designed for the people making the decision

One defence philosophy. Different operational needs.

Select an audience to see where HD Cyber Defence can add the most value.

EXECUTIVE DECISION SUPPORT

Turn cyber and AI risk into clear ownership and action.

Board-safe briefings, tabletop exercises, decision paths and readiness reviews help leaders understand what matters, who owns it and what should happen next.

Board and executive briefings
Incident decision and escalation pathways
AI risk, governance and resilience priorities

View leadership services

Threat Verification Console

Slow the signal down. Make the safer decision.

This educational decision aid is not a live scanning, detection or incident-response service.

01 / MESSAGE

AI-generated phishing

Signal: A polished, contextual message creates urgency around access, payment or disclosure.
Why it matters: Fluent language and familiar detail can now be generated at scale; quality is not proof.
Verification method: Contact the person or organisation through a known number or independently opened channel.
Immediate containment: Do not click, reply, pay or provide credentials. Isolate the message and alert the responsible team.
Evidence to preserve: Original message, full headers, sender details, links, timestamps and any related conversation.
Safer decision: Act only after identity and request are independently confirmed.

02 / AUDIO

Cloned executive voice

Signal: A familiar voice requests secrecy, urgency, payment, credentials or a process exception.
Why it matters: Short recordings can support convincing synthetic audio and emotional pressure.
Verification method: Call a known number, use an agreed phrase and require a second authorised approver.
Immediate containment: Pause the transaction or access change and notify finance, security or leadership through trusted channels.
Evidence to preserve: Audio, voicemail, caller ID, call logs, transcript, requested account details and timestamps.
Safer decision: Treat voice familiarity as context—not identity proof.

03 / VIDEO

Deepfake video

Signal: A video call or clip presents a trusted person making an unusual consequential request.
Why it matters: Synthetic video can combine a recognisable face, voice and organisational context.
Verification method: Move to a known channel and confirm a shared fact or approval known outside the call.
Immediate containment: End the call, pause action and inform the impersonated person and relevant response owner.
Evidence to preserve: Meeting link, participant details, chat, recording where lawful, screenshots and timestamps.
Safer decision: Require independent approval for money, access, data or public statements.

04 / INSTRUCTION

Prompt injection

Signal: External content attempts to redirect an AI system, reveal data or invoke tools outside its task.
Why it matters: Models may follow malicious instructions embedded in pages, files, email or retrieved material.
Verification method: Inspect the source, compare instructions with policy and require human review before tool use.
Immediate containment: Stop the workflow, disconnect affected tools and revoke temporary tokens or sessions if exposed.
Evidence to preserve: Prompt, source content, model output, tool-call logs, identity, permissions and timestamps.
Safer decision: Treat retrieved content as untrusted and keep consequential tools behind approval.

05 / DATA

Sensitive-data exposure

Signal: Confidential, regulated, personal or security material is pasted, uploaded or connected to AI.
Why it matters: Prompts, files, history and connectors can create retention, access and disclosure risk.
Verification method: Check classification, approved-use policy, provider terms, retention and authorised audience.
Immediate containment: Stop sharing, remove access where supported and notify the data owner or response contact.
Evidence to preserve: What was shared, by whom, tool/account, recipients, settings, timestamps and provider response.
Safer decision: Do not place secrets or restricted data into unapproved AI tools.

06 / IDENTITY

Compromised identity

Signal: Unexpected sign-ins, recovery changes, MFA prompts, sent messages or privilege changes appear.
Why it matters: A trusted account can make malicious activity look authorised and reach connected systems.
Verification method: Confirm with the account owner and review sign-in, recovery, session and access records.
Immediate containment: Revoke sessions, reset credentials safely, protect recovery methods and remove unknown access.
Evidence to preserve: Alerts, sign-in logs, device/session details, mailbox rules, recovery changes and affected actions.
Safer decision: Restore trust from a known-clean channel before returning privilege.

07 / AGENCY

Over-permissioned AI agent

Signal: An agent can email, alter files, browse sensitive systems or transact beyond its narrow mission.
Why it matters: A mistaken or manipulated instruction can turn broad permission into real-world impact.
Verification method: Review identity, tools, scopes, connected data, limits, logs and approval gates.
Immediate containment: Disable the agent or tools, revoke credentials and pause downstream automation.
Evidence to preserve: Configuration, prompts, tool calls, approvals, outputs, changes, credentials and audit logs.
Safer decision: Grant minimum privilege, bounded actions, rollback and human approval before impact.

Decision principle: when identity, authority or evidence is uncertain, pause the consequential action and verify outside the original channel.

Henry Delfino • Cyber Security Architect & AI Defence Specialist

Cyber defence shaped by real operational pressure.

Henry combines security operations, incident readiness, threat intelligence, identity and access protection, Essential Eight improvement, awareness and secure PHP/Python tooling.

The objective is practical: help people see the signal, verify trust, reduce preventable exposure and make a calmer decision when an attack or AI-enabled deception is unfolding.

Read Henry’s profile Connect on LinkedIn

AI PERMISSION ENVELOPE

Human authority around every consequential action.

Capability is not authority. Data, tools, identity and actions remain inside explicit human-approved limits.

01
Discover the real workflowMap the tool, owner, data, connectors and intended decision.
02
Limit data and agencyUse minimum information, permissions, actions and duration.
03
Verify identity and outputRequire evidence and trusted-channel checks before consequence.
04
Keep accountable approvalA qualified person authorises, pauses or overrides material action.

Practical field guides

Guidance for decisions that cannot wait for perfect certainty.

Browse all guides

AI impersonation • verification playbook

When the voice sounds familiar: how to verify cloned-audio requests

A practical response for staff, families and leaders before money, access or sensitive data changes hands.

Read the verification guide →

Safe AI use • data handling

What should never be pasted into a public AI tool?

A plain-English classification guide for everyday users and teams.

Open the data guide →

AI agents • control design

Limit the agent before the agent can act

Minimum permissions, approval points, logs and human control before impact.

Open the agentic AI guide →

Start with a safe, high-level conversation

Build a stronger response to AI-enabled cyber risk.

Describe the audience, risk or outcome without sending passwords, tokens, private keys, financial details or confidential evidence.

Email [email protected]Connect on LinkedIn