Australian firms face surge in AI cyber threats amid skill gaps

A new survey by IDC highlights a significant increase in artificial intelligence-powered cyber threats across Australia and the wider Asia Pacific region, with organisations reporting greater complexity and volume in digital attacks.

The study, commissioned by Fortinet, illustrates a rapidly shifting threat landscape, largely attributed to cyber attackers' adoption of AI technology to orchestrate stealthy, fast-moving campaigns. As a consequence, security teams often struggle to detect and respond in time, resulting in increased vulnerability for many organisations.

Escalating AI-driven attacks

The survey found 51 per cent of Australian organisations encountered AI-enabled cyber threats in the past year. Among these, 76 per cent reported a two-fold rise, while 16 per cent noted a three-fold surge in such incidents. Key threats identified include self-evolving malware, AI-assisted credential stuffing and brute force attacks, deepfake impersonation, AI-enhanced zero-day exploit discovery, and sophisticated deepfake-driven social engineering. These methods often target human weaknesses, system misconfigurations, and identity management protocols.

Despite the scale of these attacks, confidence in defensive capability remains low; only 32 per cent of local organisations express strong confidence in their ability to protect against AI threats. Furthermore, 15 per cent believe that AI-driven threats are outpacing their detection capabilities, revealing a significant preparedness gap for many firms.

"The findings of this survey point to a growing need for AI-accelerated defence strategies across Asia Pacific, Japan, and China (APJC). Organisations are facing a surge in stealthy, complex threats—from misconfigurations and insider activity to AI-enabled attacks—that bypass traditional detection methods. A shift toward integrated, risk-centric cybersecurity models is critical to staying ahead. In this new threat landscape, reactive security is no longer enough; predictive, intelligence-driven operations must become the norm." Simon Piff, Research Vice President, IDC Asia-Pacific

Perpetual risk environment

Crisis-driven security events have become less episodic and more endemic, according to the report. The most frequently encountered threats in Australia are denial of service (60 per cent), software supply chain attacks (59 per cent), cloud vulnerabilities (59 per cent), ransomware (56 per cent), and insider threats (51 per cent). Notably, unpatched vulnerabilities and zero-day exploits, along with insider threats and cloud misconfigurations, now feature prominently as the most disruptive threats.

This shifting threat environment is not only affecting system uptime. Data theft and privacy violations (47 per cent), loss of customer trust (40 per cent), operational disruption (36 per cent), and regulatory penalties (35 per cent) are now the top consequences. Financial repercussions are also noted, with 54 per cent of respondents reporting breaches with monetary losses, and about one-third experiencing incidents costing more than USD $500,000.

Resource constraints for security teams

Resource limitations are compounding the challenge. On average, only 7 per cent of a typical workforce is dedicated to IT, and just 13 per cent of that is allocated to cybersecurity, leaving many organisations with less than one full-time cybersecurity professional per 100 employees. Only 15 per cent of those surveyed employ a dedicated Chief Information Security Officer, and most organisations merge cybersecurity functions with broader IT roles. Furthermore, specialist teams such as threat hunting and security operations are rare, present in only 6 per cent of Australian organisations.

Security teams also face increasing pressure from higher threat volumes (54 per cent), challenges in retaining skilled cybersecurity staff (52 per cent), and tool complexity (44 per cent). These factors can lead to team burnout and fragmented operational response.

Investment trends remain cautious

Cybersecurity spending, while increasing, still lags behind the heightened risk environment. Organisations typically allocate around 15 per cent of their IT budgets—barely over 1.4 per cent of total revenue—to cybersecurity. Most budget increases remain under 10 per cent, according to the survey. Strategic investment priorities are shifting toward identity security, network security, secure access service edge (SASE) or zero trust, cyber resilience, and cloud-native application protection.

Nevertheless, operational technology/Internet of Things (OT/IoT) security, development security and operations, and security training continue to see limited allocations, indicating ongoing gaps in addressing operational and human-layer vulnerabilities.

Platform integration and simplification

Nine out of ten surveyed organisations are either converging their security and networking infrastructure or evaluating related options. This shift aims to simplify architectures, integrate disparate defences, and streamline operations. While 74 per cent are consolidating their technology platforms, almost half still struggle with tool management—citing fragmentation and lack of integration as persistent challenges.

Organisations see vendor consolidation as a way to reduce costs and enhance both detection speed and issue resolution. Faster support (59 per cent), cost savings (53 per cent), better integration (53 per cent), and improved security posture (51 per cent) are highlighted as the principle benefits sought through consolidation.

"Organisations must approach security defence as a dynamic and continuously evolving ecosystem. This requires more than simply adopting the latest technologies. Lasting resilience comes from effectively embedding and optimising security solutions in alignment with people and processes. Fortinet is focused on helping companies shift from piecemeal defences to AI-powered security systems that are built for scale and sophistication. As the market shifts from infrastructure-centric models to more strategic priorities such as access, identity, and fortification, Fortinet is assisting customers to position cybersecurity as a long-term business enabler rather than just a protective measure. Through its platform approach, Fortinet provides the scale, intelligence, and simplicity organisations need to stay ahead of evolving threats." Glenn Maiden, Director of Threat Intelligence, FortiGuard Labs, Australia and New Zealand, Fortinet

The survey was based on responses from 550 IT and security leaders across 11 Asia-Pacific markets, including 70 in Australia. Respondents were from organisations with more than 250 employees and were directly involved in cybersecurity decision-making.