Australian firms face wave of AI cyber threats, ESET says

ESET has reported that 66% of Australian businesses faced at least one AI-related cyber threat over the past year, based on a survey of 400 cybersecurity decision-makers and influencers across Australia.

The research also found that AI use is already widespread, with 92% of organisations either using or piloting it in at least one business function. Those functions include fraud detection, customer service, content generation, document processing, threat detection and software development.

As AI use has spread, businesses have reported a mix of internal and external risks. Employee misuse of generative AI was cited by 34% of respondents, while 33% said they had experienced data leakage through AI platforms.

Another 30% reported AI-generated phishing or impersonation attacks, while 29% said they had faced AI-enabled deepfake or voice-cloning attacks.

Most respondents said their organisations had introduced at least some measures to manage those risks. According to ESET, 89% had at least one safeguard or policy in place or planned, while 11% had none.

The most common steps were monitoring access to AI tools and their outputs, cited by 49% of respondents. Internal responsible-use guidelines were followed at 48%, while 47% said their organisations restricted the uploading of sensitive data to AI platforms.

Parvinder Walia, President of the APAC region at ESET, said AI was becoming more closely tied to day-to-day operations and decision-making.

"AI is becoming deeply embedded in how businesses operate. As we give it access to more data and greater influence over decisions, organisations must ensure the right oversight and safeguards are in place. Trusting AI also means knowing how and where it is being used," Walia said.

Incident pressure

Beyond AI-linked threats, the survey pointed to broader strain on Australian organisations' cyber defences. Some 72% said they had experienced at least one major cybersecurity incident during the past year, and of those, 35% said they had dealt with three or more incidents.

Cloud environment breaches and business email compromise were the most commonly reported incident types, followed by credential theft or abuse and insider threats.

While 80% of affected organisations said they could detect and respond to their last significant incident within 24 hours, many still reported obstacles once an attack had taken place. Delayed detection was the leading containment challenge, cited by 53% of respondents.

Limited internal resources were named by 40%. Coordination across teams was cited by 38%, and 36% pointed to a lack of visibility across environments.

ESET's findings also suggested a gap between confidence and preparedness. Although 83% of respondents said they were moderately or very confident in their organisation's ability to withstand and recover from a cyberattack, recurring incidents and reported detection challenges suggest confidence does not always align with response performance.

"In cybersecurity, speed changes the outcome. A threat left undetected for hours can quickly become a business-wide incident. Organisations need continuous visibility, rapid response and access to deep expertise to contain threats early and protect business continuity," Walia said.

Human factors

The survey found no single dominant cause behind cyber incidents. Weak, stolen or compromised passwords were the most commonly cited cause, at 37% among affected organisations.

Phishing or social engineering attacks and user actions or human error followed at 34% each. Unpatched vulnerabilities or outdated software and limited security resources or skills shortages were each cited by 30%.

Training is already common, with 92% of organisations saying they provide cybersecurity training at least annually. Even so, employee awareness and training remained the top cybersecurity challenge, cited by 50% of respondents.

Time constraints across teams were named by 49% as a barrier to improving security behaviour. Another 44% pointed to a lack of user engagement with training, while 38% said training materials were not engaging enough.

A shortage of skilled cybersecurity professionals and the pace of change in the threat landscape were also prominent concerns, cited by 41% and 40%, respectively.

"Phishing and social engineering continue to demonstrate why the human layer of cybersecurity cannot be overlooked. As AI makes malicious communications more convincing and personalised, organisations need to continuously build employee awareness through relevant training and realistic simulations. Technology can stop many threats, but a well-prepared employee can help stop the one that gets through," Walia said.

Spending focus

The report said security priorities are shifting as businesses expand their use of AI, cloud services and connected technologies. It found that 69% of organisations are using or planning to adopt managed detection and response.

Cyber insurance is also drawing attention. According to ESET, 48% of organisations are currently covered, and 33% are planning to obtain cover.

However, 95% reported challenges in obtaining or maintaining cyber insurance. Rising premiums were the most common barrier at 47%, while stricter insurer security requirements and limited internal budgets were each cited by 42%.

The financial impact of cyber incidents remains significant. Among organisations affected by incidents, 14% reported significant financial loss.

"Cybersecurity is now essential to keeping businesses running. As AI and connected technologies grow, organisations need to understand where their risks are, react quickly when something goes wrong, and adopt new technology with confidence," Walia said.