The warning comes as government internet services provider Macquarie Telecom Group told a parliamentary inquiry some agencies had not joined a program to improve their cyber security.

Special adviser to Malcolm Turnbull on cyber security Alastair MacGibbon warned departments focused on complying with audits and following safety checklists could harm their security by ignoring evolving cyber threats.

"Agencies will consider themselves safe from compromise if they have their internal ICT area and their subcontractors put in place, and uncritically follow prescribed security procedures," the Department of Prime Minister and Cabinet official said.

"With the cyber security landscape shifting rapidly and continuing to grow as a business risk for all our agencies, we need to ensure that our historical reliance on compliance does not prevent the necessary change that is needed to keep up with our environment."

Mr MacGibbon told the inquiry, which is examining an audit showing the Tax Office and the Immigration Department were vulnerable to cyber attack, agencies needed to improve their security culture to ward off threats.

"This would sit alongside compliance measures, audits and alternative security options that may be more appropriate or effective for a given agency," he said.

His comments come after an Australian Cyber Security Centre report found cyber attacks from foreign states and criminals regularly targeted government networks.

Another ACSC report in April revealed cyber criminals targeted organisations critical to Australian infrastructure up to hundreds of times a day.

Macquarie Telecom Group told the inquiry some agencies had not joined a program aiming to improve cyber security by reducing the number of departments using their own internet gateways.

"The Department of Finance has seemingly not had the power and/or the willingness to compel agencies to participate in the program, which leaves some small organisations still self-supplying," it said.

Agencies had failed to join the 'lead agency gateway program' despite being assigned to 'lead agency groups' and without specifically being granted exemptions, MTG said.

However it was not clear whether these agencies were using their own gateways because their own security met government requirements, it said.

The program had benefited smaller agencies unable to manage and maintain modern internet and email firewall technologies.

"Acquiring these as services means they have available to them the same technologies deployed to protect the very largest departments," MTG said.

Some agencies choosing how their cyber defences were deployed under the program were not applying the full toolkit of safeguards available to them, it said.

The Digital Transformation Agency, which has taken over the lead agency gateway program from the Finance Department, said it was reviewing all of its functions and would consider the outcomes and recommendations of the parliamentary inquiry.

The national auditor found in March a lack of security had left the Australian Taxation Office and Immigration Department vulnerable to cyber attacks, putting personal data at risk.

The agencies, which hold national security data and personal information including bank account details, have failed to make crucial IT reforms they promised to adopt by 2016, the Australian National Audit Office report said.