The Monthly Roundup: James Corera on trust, risk, and the technology stack
Summary
James Corera, Director of ASPI’s Cyber, Technology & Security programme, argues that 2025 made clear how cyber risk, information manipulation and geostrategic pressure are now intertwined. Technology is no longer neutral — it is a lever of power that shapes national resilience, public debate and strategic competition.
Corera highlights a surge in state-backed cyber activity, ransomware against critical infrastructure, zero-day exploitation and AI-enabled information operations. ASPI updated two core data tools in 2025 — the Critical Technology Tracker and the China Defence Universities Tracker — to provide system-level visibility into where trust is being built or eroded. The piece urges a shift from threat-based thinking to risk-based approaches and calls for operational, shared frameworks to embed trust across entire technology stacks for 2026.
Key Points
- Cyber risk, disinformation and geostrategic pressure are converging and amplifying each other.
- Commercial AI is being weaponised; adversaries combine generative tools with behavioural targeting, making attribution and defence harder.
- ASPI upgraded the Critical Technology Tracker (now 74 techs) and expanded the China Defence Universities Tracker (180+ institutions) to map systemic trust and dependencies.
- Four technology areas flagged for high monopoly risk: cloud & edge computing, computer vision, generative AI and grid-integration technologies.
- Policy is shifting from vendor-by-vendor checks to system-level assessments of ownership, control and influence across stacks (cloud, telecoms, subsea cables, OT, IoT, AI).
- Effective defence requires moving from threat-centric to risk-centric thinking — building operational visibility and shared assurance frameworks.
- CTS will push in 2026 for practical, deployable tools: integrated datasets, early-warning signals and interoperable assurance for government, industry and partners.
Why should I read this?
Short answer: if you care about national security, tech policy or running resilient systems, this saves you time. Corera cuts through the noise and explains why 2026 is the year governments and operators must stop treating tech as neutral and start building shared, system-level trust — fast.
Context and relevance
This roundup matters because it reframes how policymakers and organisations should assess risk. Instead of counting adversaries and isolated vulnerabilities, ASPI recommends integrated visibility across supply chains, vendor lineage and system-level control. That approach aligns with recent government moves (eg. Australia’s National AI Plan) and international concerns about alliance coherence and tech dependencies in the Indo-Pacific.
For technologists and procurement leads, the takeaway is operational: embed trust into procurement, regulation and planning; for policymakers, the message is to fund and adopt shared analytic tools that surface systemic exposure before it becomes a crisis.
Source
Source: https://aspicts.substack.com/p/the-monthly-roundup-james-corera