Australian firms lag in cybersecurity as AI reshapes threats

Only three percent of organisations in Australia have achieved a mature level of cybersecurity readiness, according to Cisco's 2025 Cybersecurity Readiness Index.

The study highlights persistently low preparedness among Australian organisations, which continue to face challenges from rapid developments in artificial intelligence and increasingly complex digital environments.

The report states that 82 percent of Australian organisations experienced AI-related security incidents over the past year. Despite this, only 46 percent of respondents expressed confidence that their employees fully understand AI-related threats, and just 47 percent believe their teams comprehend how hackers are leveraging AI for sophisticated attacks. This gap in knowledge places organisations at heightened risk.

Cisco's analysis is based on a double-blind survey that included 8,000 private sector security and business leaders across 30 global markets. Organisations were assessed across five key cybersecurity pillars: Identity Intelligence, Network Resilience, Machine Trustworthiness, Cloud Reinforcement, and AI Fortification. Their capabilities were grouped into readiness stages defined as beginner, formative, progressive, and mature.

Alongside the difficulties posed by AI, half of all surveyed organisations reported a cyberattack within the last year. The majority cited complex frameworks involving multiple disparate security solutions as a barrier to meeting emerging threats. Respondents considered external threats—such as malicious actors and state-affiliated groups—as more significant, with 58 percent focusing on these over internal threats, which were prioritised by 42 percent.

Cisco's Chief Technology Officer in Australia and New Zealand, Carl Solder, emphasised the importance of narrowing the awareness gap in cybersecurity. "As AI is reshaping the cybersecurity threat landscape, there is an urgent need to close the threat awareness divide. What the data shows is there is a clear need to bridge the readiness gap between threats and action in order to modernise security to combat external threats. As innovation continues at lightning speed, the need for organisations to stay ahead of the curve when it comes to cybersecurity is more important than ever before. And, with technology today it's possible to fight machine scale threats with machine scale defence."

The findings indicate a widespread expectation of future disruptions, with 75 percent of Australian respondents anticipating that cyber incidents may impact their businesses within the next 12 to 24 months.

The report found that Australian organisations are increasingly reliant on AI technologies, with 88 percent using AI to increase their understanding of threats, 79 percent deploying it for threat detection, and 65 percent applying it to response and recovery operations. However, the adoption of generative AI tools brings its own risks. The research revealed that while 49 percent of employees are using approved third-party tools, 18 percent have unrestricted access to public generative AI, and two-thirds of IT teams are unaware of the scale of employee interaction with these tools, raising significant monitoring and governance concerns.

Shadow AI, or the unauthorised and unregulated use of artificial intelligence, is another area of concern. A total of 63 percent of surveyed organisations lack confidence in their ability to detect these deployments, representing a potential vulnerability in both cybersecurity and data privacy.

The study also notes the impact of hybrid working environments, where 82 percent of organisations identified increased risks as employees are more likely to access company networks using unmanaged devices. The problem is compounded by the use of unapproved generative AI tools.

Despite recognition of the growing threat landscape, budget allocations toward cybersecurity remain relatively limited. Ninety-seven percent of organisations said they plan to enhance their IT infrastructure, but only 44 percent will devote more than ten percent of their IT budget to cybersecurity, a figure that has only risen by one percent in the past year.

The complexity of security postures is underscored by the finding that more than 76 percent of organisations are using at least ten different point security solutions, which the report states is hampering their ability to respond effectively and quickly to emerging threats.

A shortage of skilled personnel is also prominent, with 86 percent of respondents acknowledging this as a major issue and 51 percent reporting over ten open cybersecurity positions waiting to be filled.

The analysis suggests Australian organisations may need to focus on investment in AI-powered solutions and the simplification of security infrastructure. There is a call for an enhanced focus on awareness training for AI-related threats and improved management of risks associated with both unmanaged devices and unauthorised AI deployments.

Cisco Chief Product Officer Jeetu Patel commented on the broader implications. "As AI transforms the enterprise, we are dealing with an entirely new class of risks at unprecedented scale - putting even more pressure on our infrastructure and those who defend it. This year's report continues to reveal alarming gaps in security readiness and a lack of urgency to address them. Organisations must rethink their strategies now or risk becoming irrelevant in the AI era."