Who secures the autonomous mine? The OT security gap Australian VCs have not funded

Pilbara iron ore fleets are driven from Perth, 1,500 km away. Seven Australian venture funds back 655 companies, 43 of them in cyber security, and not one secures mining operational technology. We look at why, where the gap really is, and ask miners, equipment makers and investors whether we have it right.

CISO AI · 2 Nov 2026 · Analysis

Rio Tinto's autonomous haul trucks in the Pilbara are driven from an operations centre in Perth, more than 1,500 km away. Fortescue runs its fleet from the Hive, also in Perth. A mine is now a network: trucks, drills, conveyors and processing plants, controlled by software, over radio and fibre, from a city at the other end of the state.

Securing that network is called operational technology (OT) security: protecting the systems that move physical things, not the laptops and email. Australia is one of the world's largest mining economies. So we expected to find a few Australian startups working on it. We went through every company that seven Australian venture funds list on our startups directory and found none.

This piece explains why, where we think the openings really are, and where we may be wrong. The animations play as you scroll to them; press Replay to watch one again. At the end we ask three groups of readers for their view. The comments are open.

The short version

No Australian VC backs an OT security company for mining. 655 companies, 43 in cyber security, two close to OT, none aimed at mine sites.
The biggest miners are already served. Claroty, Dragos and Nozomi Networks sell to them through integrators, and those three are consolidating into larger groups.
The gaps are elsewhere: mid-tier and junior miners, the equipment makers that build autonomous fleets, and protecting critical-minerals data from state actors.
Nothing forces the purchase. Mining is not one of the SOCI Act's 11 critical infrastructure sectors.
It has been tried. Sapien Cyber, a Perth OT security startup backed by Woodside and Honeywell, was wound up in 2024.
Our pick: the strongest opening is security for autonomous fleets, sold to the equipment makers rather than mine by mine.

The 655 companies that AirTree, Antler Australia, Blackbird, Investible, Main Sequence, OIF Ventures and Square Peg list, added by year of first investment. Then everything outside cyber security goes, then everything that does not touch OT, until two are left.

What OT security means at a mine

Office IT security protects data. OT security protects machines that can hurt people. At a modern mine that means:

Autonomous haul trucks and drills, steered by GPS and site radio networks.
Fleet management and dispatch systems that tell each truck where to go.
Processing plants, conveyors and rail, run by control systems (SCADA) built to last 20 years, not to be patched every month.
Remote operations centres that tie it all back to the city.

The rule that shapes everything: production never stops. A security tool that needs a reboot, an agent on a controller, or a scan that floods an old network does not get installed.

Research on autonomous haulage names GPS spoofing and Wi-Fi de-authentication among the threats. The consequences it lists range from lost production to equipment damage and injury.

What has happened so far

The public record in Australia is mostly about IT, not OT:

Evolution Mining, August 2024: ransomware hit its IT systems. The company said it was contained, with no material impact on operations.
Northern Minerals, 2024: corporate, financial and geological research data was stolen and published. Who did it is disputed.
Iluka Resources, 2024: an attempted attack that the company says did not get through.
Lynas Rare Earths: named by Mandiant as a target of DRAGONBRIDGE, a China-linked online influence campaign aimed at rare earths producers.

We found no public case of an Australian mine's OT being disrupted. That is either good security or under-reporting, and we do not know which. What we do know: EY found miners lag the energy sector in protecting OT, and the ASD says critical infrastructure is a standing target for state-sponsored actors. Its latest advice to operators starts with knowing what OT you own.

Why nobody has funded it

There are four reasons, and the first matters most.

1. No regulation forces the purchase. The Security of Critical Infrastructure (SOCI) Act covers 11 sectors. Mining is not one of them. A miner's power stations, gas pipelines, ports or rail may still be captured as energy or transport assets, so check your own position with the Cyber and Infrastructure Security Centre. For most mine sites, though, there is no deadline and no regulator asking. Security spend competes with production spend, and production usually wins. Our SOCI Act guide covers the obligations for the sectors that are in scope.

The 11 sectors listed on the Cyber and Infrastructure Security Centre's site.

2. The buyer is not the CISO. At a mine, OT budgets sit with site general managers and control engineers. Their measure is tonnes moved and nobody hurt. A startup that sells to the security team finds that the security team cannot say yes.

3. The equipment makers own the hardest parts. Autonomous fleets and drills come from Caterpillar, Komatsu, Epiroc and Sandvik. A miner often cannot put a third-party tool on them without voiding support. Sandvik already holds IEC 62443-4-1 certification for secure product development, so the makers are building their own.

4. Long sales cycles through integrators. Miners buy OT security through integrators and managed service providers, often bundled with Rockwell or Siemens. Proof-of-concept to contract can take years. That is a hard road for a company with 18 months of seed money.

Who sells today

The three specialists dominate, and all three are changing hands or raising at scale:

Claroty raised US$150m at a US$3b valuation in January 2026 and is still independent.
Dragos: Accenture has reportedly taken a majority stake. We have not seen the final terms confirmed.
Nozomi Networks was bought by Mitsubishi Electric for close to US$1b.

When a specialist joins a larger group, it usually follows the larger group's biggest customers. That serves Tier 1 miners well. It leaves the mid-tier to managed service providers reselling the same tools, and juniors with very little.

Our reading of public deals and partnerships, not a market survey. Equipment makers appear as buyers because they need security evidence for their own customers and regulators.

The lesson from Sapien Cyber

Sapien Cyber was spun out of Edith Cowan University's cyber research, with Woodside, Honeywell Ventures and QuantumTX among its investors. It built OT threat detection for Western Australian industry. In March 2024 it went into administration after two large customers, who were also shareholders, took their business elsewhere. No one bid to rescue it, and it was wound up.

The lesson is not that the market is not real. It is that selling site by site to a handful of large industrial customers is fragile. Lose two and the company goes with them. Any new attempt needs a model where one sale reaches many sites.

The one local startup we found with recent funding is EchidnaAI in Perth, which runs automated security testing for OT at mines, ports and shipping operators. Data aggregators report about A$4.5m raised to January 2026, but we have not seen a company announcement.

Five openings, ranked

#	Opening	Who pays	Crowding	Why now
1	Security assurance for autonomous fleets: testing, monitoring and IEC 62443 evidence	Equipment makers, then miners	Low	The EU Cyber Resilience Act puts lifecycle security duties on manufacturers, and fleets are run remotely
2	Protecting critical-minerals data: geology, offtake contracts, process IP	Rare earth and lithium miners, offtakers, government	Low	State actors want geological data; critical minerals are now a national security matter
3	Testing OT safely, without touching production (digital twins, simulated attacks)	Mid-tier miners, ports	Low to medium	It gets around the "do not touch production" rule
4	Managed OT security for mid-tier and junior miners, across 5 to 30 remote sites	Mid-tier miners	Medium	The specialists are moving up-market. This is service-heavy: a good business, a weaker venture case
5	Remote access for contractors and vendors at remote sites	All miners	High	A real need, but crowded worldwide

Why we put fleets first. Equipment makers are few, they need security evidence for regulators and customers, and one contract reaches every mine that runs their fleet. That avoids the site-by-site sale that sank Sapien. The risk is that the makers build it themselves, as Sandvik is starting to.

Why critical minerals come second. Australia's critical-minerals strategy and its supply deals with allies turn geological data and process know-how into strategic assets. The Northern Minerals theft shows someone wants them. Today nobody sells a product built for that problem.

What would make us wrong

The equipment makers bundle it. If Caterpillar, Komatsu and Epiroc follow Sandvik and build fleet security in-house, opening 1 closes.
Accenture bundles Dragos into mining transformation deals. Large miners already buy consulting from Accenture. A bundled offer could reach the mid-tier faster than any startup.
Regulation never comes. If mining stays outside SOCI and no major OT incident happens here, the budget may never move from production to security.
We are missing companies. Our directory covers seven funds. If you know an Australian OT security company we have missed, tell us in the comments and we will add it.

Over to you

We wrote this to start a debate, not to settle one. Three sets of questions:

For miners and CISOs - Does your OT security budget sit with the CISO, or with the site general manager? - If an autonomous truck were spoofed tomorrow, whose incident is it: yours, or the equipment maker's? - Would your board accept a product from a young Australian company, or only from Claroty, Dragos or Nozomi?

For equipment makers and integrators - Are customers asking you for IEC 62443 evidence on autonomy systems yet, or only in tenders? - Would you buy fleet security from a startup, or build it?

For investors - Is mining OT security a venture-scale market, or a good services business? - After Sapien Cyber, what would you need to see before backing the next one?

Tell us in the comments. We will update this piece with what we learn.

This article is general commentary, not investment or legal advice. Company figures are from public reporting as at 2 November 2026.

Sources

Related on CISO AI: the SOCI Act guide, Australian startups we track, and WiseTech's moat is regulatory, not code.