Most boards don't fail because they're careless
They fail because they find out too late
Where good governance becomes a habit
The gap between a problem and a board decision has collapsed
Threats now move in hours. Most boards still learn in board cycles — often from someone else
Speed
Frontier AI can cut the time from finding a weakness to exploiting it, from days to hours
AICD & ASD Board Guidance, Aug 2026
Duty
to report a ransomware payment to ASD — organisations over $3m turnover, in force since 30 May 2025
Cyber Security Act 2024
Visibility
of ransomware incidents ASD responded to in 2024–25 were ones where ASD told the victim first
ASD Annual Cyber Threat Report 2024–25Five forces are converging
Why 2026–27 is the time for boards to act
Faster threats
Attack timelines shrink from days to hours
AI is everywhere
AI arrives inside software you already buy
New responsibilities
Ransom payments and automated decisions must be disclosed
Higher bar
Draft ASX Principles ask for skills and risk disclosure
Personal liability
Courts test what directors did with what they were told
Sources: Cyber Security Act 2024; Privacy Act 1988 (statutory tort; APP 1.7–1.9); Privacy Amendment (Personal Data Protection) Bill 2026 exposure draft; ASX consultation draft (Jul 2026). The ASX 5th edition is still a consultation draft (closed 14 Sep 2026) and doesn't name cyber or AI directly.
What's the difference between governance and management?
Governance is the framework for how an organisation is run and how it interacts with its stakeholders and community
Governance is about oversight
Governance is the set of rules, systems and processes by which authority is exercised and controlled. The board acts as a steward, ensuring the organisation is effectively led, and is responsible for setting the organisation's strategy, risk tolerance, policy and culture.
aicd.com.au/corporate-governance.htmlManagement is about execution
Management handles day-to-day operations. The board relies on management to share, in a timely manner, all material information needed for its decision-making — and expects management to ask advice and draw on directors' experience when appropriate.
aicd.com.au — relationship between the board and managementGood governance is a cornerstone for organisational success
Good governance is about effective decision making. It enables authority to be exercised appropriately and holds those who exercise it accountable. It sets the tone for the organisation's activities and culture, and influences relationships with stakeholders and community.
aicd.com.au/corporate-governance.htmlA productive relationship between the board and management is critical for good governance and organisation effectiveness
A Collaboration — a Cyber / AI roadmap you own
Kick off with the 90-Minute Board Session
Your whole board, in one sitting. An anonymous pre-read to understand the questions you should be addressing, then 90 minutes that leave the board with one shared picture of cyber and AI risk, a draft Board AI Charter, an AI Agent Canvas and three AI/Cyber commitments to feed into your board cycle.
Gets all board members on the same pageBuild proof — the Board Resilience Roadmap
A deeper dive into your organisational AI/Cyber maturity, leading to a co-created roadmap where you commit to three actions to raise your AI/Cyber governance — a six-week journey built with your board over two board sessions. An actionable roadmap you own, not a report for the shelf, with metrics to track real progress — plus a tailored Responsible Use of AI Policy.
Creates defensible proof that you as the board have taken appropriate governance steps toward robust AI/Cyber adoptionOptional check-ins
We partner with a Cyber/AI specialist to provide agnostic Cyber/AI control testing for greater peace of mind, with facilitated check-ins at days 30, 60 and 90, so the board sees evidence of progress, not just a plan.
Confidence that the right expert advice is there when you need itTwo directors, with a human lens
Karen Wood
Co-founder and Director, Muru BridgeTransformation specialist with deep IT program and change delivery expertise. Focused on the "human" aspects of cyber and AI, working with AI agent deployment for governance. Brings a practical, collaborative approach to boards building their confidence in AI/cyber adoption.
Margaret Gilbert
Co-founder and Director, Muru BridgeIT program manager with complex cyber security delivery expertise across multiple industry sectors. Dissolves the fear of cyber and AI for boards, while bringing the implementation wisdom to ensure they're not blindsided by jargon or their management teams.
We focus on coherent board governance
The truth, in time
We help the information that matters reach the board complete, on time and unfiltered
Co-created
Your board owns its principles, priorities and commitments. We facilitate; we don't impose
Board level
We work on how the board governs. Independent partners test technical controls
Practical and paced
One level up at a time, with a 90-day re-check. Progress beats perfection
Care and candour
No fear and no hype. We care personally and challenge directly
Community first
We share what works and point you to the best free resources — including other people's
Who we are
Why "Muru"?
"Muru" was chosen deliberately — a word of significance to both Māori and the local Gadigal people. Karen and Margaret have both made Sydney their home, yet have extensively travelled, lived and worked in places where Indigenous peoples have forged their own experience of path and belonging (NZ, Canada, US, PNG, Hong Kong, the Philippines and the UK) — and both value the power of bringing diverse peoples together.
In the Gadigal/Dharug language of the Sydney region, Muru means "path," "track" or "pathway" (as in Walanga Muru, "follow your path," or Muru Giligu, "path of light"). In Māori, muru extended into the customary legal concept of ritual compensation that restores social balance after an offence.
Merging Muru with Bridge represents, for our clients, a pathway to better governance
The same questions, asked of Muru Bridge
Which AI tools do we use, and with what data?
How do we use AI in our own work?
Is multi-factor authentication on everywhere client data lives?
Where is client data stored, and who else holds it?
Do data backups actually restore?
Have we rehearsed our own bad day?
Who checks what we tell you?
Ask us any of these — if we can't show you the evidence, we haven't earned the right to ask your board these questions
We use AI carefully — and we're honest about how
AI is not intelligence; it is pattern recognition. We use AI, we test AI using multiple models, and we constantly expand our cyber and AI knowledge — we build with AI. We experience the benefits and the pitfalls, so we can share with conviction.
We've trained AI agents to help with Muru Bridge, and we often start brainstorming with AI — but we always review every AI output, and adapt and amend it, because mistakes can be subtle, but they are made.
Parts of this website were drafted with the help of AI tools and edited, fact-checked and improved by Karen and Margaret before publishing.
We have our own published AI Charter: the same standard of guardrails, logging and human oversight we'd ask of your board.
We use data carefully — and we adhere to all laws
Data protection is at the core of cyber security, and Muru Bridge takes it very seriously. All our data is housed in Australia. We collect the minimum data necessary to meet our commitments to you and delete it as soon as legally possible. We never use client data without full consent. We always comply with strict ethical standards, ensuring fairness, data protection, transparency and accountability.
Read our full Privacy Policy for the detail behind this.
Start with a 15-minute conversation
Tell us a little about your board, and we'll call you back — no calendar to manage
Prefer to reach out directly?
Margaret Gilbert — margaret.gilbert@murubridge.com
Karen Wood — karen.wood@murubridge.com