Security architecture in practice.

The challenge

The bank was preparing to replace its core banking platform — a programme spanning five years and involving more than thirty technology vendors. Security had not been formally considered in the programme architecture, and the organisation lacked a documented target-state security architecture against which solution designs could be assessed. The board had also received regulatory feedback from APRA regarding the maturity of the bank's CPS 234 compliance posture.

Zysla's approach

Zysla was engaged to lead the security architecture workstream across the transformation programme. We began with a current-state assessment of the bank's security controls, architecture and governance arrangements, benchmarked against APRA CPS 234 and the bank's own risk appetite. From this foundation we developed a target-state security architecture covering identity and access, data security, network segmentation, third-party integration security and security operations. The architecture was translated into a prioritised three-year roadmap with clear investment cases for each initiative, designed for presentation to the board and APRA.

Outcomes

• Target-state security architecture adopted as the governing framework for the core banking programme
• Security architecture review process embedded across all thirty-plus vendor engagements
• Three-year security roadmap approved by the board with full investment commitment
• APRA CPS 234 gap closure plan accepted by the regulator at subsequent review
• Security Architecture as a Service engagement extended for ongoing programme support

The challenge

Following a ransomware incident that resulted in extended clinical system outages across multiple hospital sites, the organisation's board directed an independent review of the security architecture. The review identified that flat network architecture, weak privileged access controls and an over-reliance on perimeter security had allowed the attacker to move laterally across the environment with minimal resistance. The organisation needed a credible, practical path to a fundamentally stronger security architecture — one that could be implemented without disrupting clinical operations.

Zysla's approach

Zysla designed a phased Zero Trust architecture tailored to the operational constraints of a clinical environment. The architecture addressed four domains: identity and privileged access, device trust, network micro-segmentation, and application access controls. Particular attention was given to the challenge of legacy clinical systems that could not support modern authentication protocols — a common constraint in healthcare that generic Zero Trust frameworks fail to address adequately. Zysla developed a practical treatment approach for these systems that reduced risk without requiring immediate replacement. The architecture was documented in a form suitable for both technical implementation teams and board-level reporting.

Outcomes

• Zero Trust architecture design adopted across all hospital sites
• Privileged access management programme initiated within ninety days of architecture approval
• Network micro-segmentation implemented across critical clinical systems within twelve months
• Legacy system risk treatment approach accepted by the board as an interim control
• Security architecture embedded into the organisation's capital planning process for future clinical system investments

The challenge

The organisation had identified significant operational efficiency opportunities through AI adoption but lacked the governance framework to assess and manage the associated security risks. Business units were independently evaluating AI tools and platforms, creating an uncontrolled proliferation of AI integrations with access to sensitive operational and customer data. The organisation's existing security governance frameworks did not address AI-specific risks, and the board had requested a clear position on AI security before approving further adoption.

Zysla's approach

Zysla developed a comprehensive AI security governance framework covering the full lifecycle of AI adoption — from initial use-case assessment through to ongoing monitoring and review. The framework addressed AI-specific threat vectors including data poisoning, model manipulation, prompt injection and supply chain risk in AI platforms. Zysla also conducted security architecture reviews of the five highest-priority AI use cases already under evaluation, providing clear risk assessments and treatment recommendations for each. The governance framework was designed to be operationally practical — enabling the organisation to move forward with AI adoption under appropriate controls rather than imposing a blanket moratorium.

Outcomes

• AI security governance framework approved by the board and adopted as policy
• Security assessment process embedded into the AI use-case approval workflow
• Five priority AI use cases cleared for adoption with documented risk treatments
• Two AI platforms identified as presenting unacceptable data security risk — procurement halted
• AI security architecture standards published for use by internal technology teams