The assessment says: "A security manager should be looking after assassination, hijacking, hostage-taking, chemical attack, biological attack, radiological or nuclear attack, explosive materials and devices, other hazardous materials and devices, and cyber-attack."

The PSCC is the Commonwealth agency responsible for managing Australia's protective security, counter-terrorism and dignitary protection. This includes security for high-risk premises and persons such as ministers, their families, staff and foreign dignitaries. The PSCC also promotes security through training programs on physical, computer and personnel security.

CIOs already labouring under their current responsibilities should not contemplate taking on such physical security concerns, but perhaps a career as a CSO awaits.

"In the early days, CIOs had a life expectancy about the same as a second lieutenant in Vietnam," says Ames. "There's still high turnover, due to stress and a perceived inability to perform against expectations that are set way too high.

"The true CSO role is about making people feel like everything is under control. Even though it's very challenging - and if the shit hits the fan they have to deal with it - I think the stresses are quite different from being a CIO. I can imagine many CIOs wanting to be a CSO. It would be a nice, quiet change," says Ames.

Kingsley says IS professionals are broadening their horizons beyond IT so that their interests are better aligned with someone of a risk mind-set. They understand that security's task is to uncover the real threats, not get sidetracked down blind alleys.

"It's folly for a security executive of any sort to put all their energy into managing a certain threat if they leave their organisation vulnerable to more dangerous threats," he says. "Cyber-terrorism or massive business interruption is awful enough, but it remains extremely unlikely. Contrast this to the rogue employee on your network right now stealing customer lists or intellectual property. Which threat do you want to worry about?" Both physical security and IS experts agree that the biggest challenge facing Australian security executives is managing the perception of what represents real risk. No one should discount the threat of terrorism, especially any organisation located in a CBD. The possibility of having a building disrupted is real, they say. But at the same time, they caution that talk about "real" threats implies that there are sound benchmarks in place or effective information sharing. There isn't.

"There's plenty of half-truths and guesses, but unfortunately, the best judgement of whether an organisation is focusing on the right things comes after they have an incident," says Kingsley.

"People put too much faith in what they read, what they hear or what their colleagues are doing rather than thinking about the real threats themselves," he says. "There's a fair amount of the herd mentality in security and there's plenty of complacency. Organisations are over-estimating how good their controls are or underestimating the danger, particularly for internal threats. Anyone who thinks they are on top of that issue is absolutely kidding themselves."