Australian firms risk breaches as AI-driven threats outpace cyber readiness

New research from Accenture has found that 97% of Australian organisations are not adequately prepared to secure themselves against modern cyber threats, exceeding the global average of 90%.

The findings come from Accenture's annual State of Cybersecurity Resilience 2025 report, which surveyed more than 2,200 executives from large enterprises worldwide, each with an annual revenue exceeding USD $1 billion. The data identifies a significant gap between cybersecurity ambition and actual readiness in the face of advanced attacks, particularly as organisations integrate artificial intelligence into their operations at scale.

AI accelerates threat landscape

The Accenture research indicates rapid adoption of AI technologies is amplifying the speed, scale and sophistication of cyber risks. The majority of organisations reported that attackers are now leveraging AI to exploit weaknesses in legacy systems, while existing defences are not keeping pace with these evolving tactics.

Four fifths (80%) of Australian businesses are reported to lack essential data and AI security practices required to protect their business models, data pipelines and cloud infrastructure. This shortfall exposes organisations to increased risk of breaches and data loss as digital infrastructure expands.

Despite widespread implementation of AI tools, only 16% of Australian companies have established clear policies and training related to the use of generative AI. In addition, few companies maintain a comprehensive inventory of AI systems, a step identified as crucial for managing risks within supply chains.

Data protection and security maturity

Accenture's analysis found that only 22% of Australian organisations are fully leveraging critical data protection methods such as encryption and access controls to safeguard sensitive information. This signals that many are vulnerable not only to direct cyber attacks, but also to inadvertent data exposure.

The report classifies Australian organisations into three security maturity zones. The 'Reinvention Ready Zone' comprises just 3% of organisations, who have developed an adaptive and resilient security posture that is continuously updated to counter new threats. The 'Progressing Zone', which accounts for 11%, shows strength in some practices but lacks strategic direction or struggles with defence implementation. The majority, 86%, fall within the 'Exposed Zone' - highlighting limited cyber readiness and a primarily reactive approach to emerging threats, exacerbated by both the complex AI environment and broader global risks.

Strategic risk, not technical challenge

The report emphasises that, given the evolving threat landscape and heightened global tensions, cybersecurity has shifted from a purely technical issue to a strategic business risk. Geopolitical developments are prompting organisations to reconsider data and supply chain strategies, inadvertently introducing further vulnerabilities into enterprise systems.

"Rising geopolitical tensions, economic volatility and increasingly complex operational environments are leaving organisations more exposed to cyber risks. This report serves as a wake-up call that cybersecurity can no longer be an afterthought. It must be embedded by design into every AI-driven initiative. Taking this proactive approach will help ensure a competitive edge, strengthen customer loyalty and turn cybersecurity into a business enabler."

Mary Attard, Security Lead at Accenture ANZ, highlighted the fundamental changes underway in the cybersecurity domain. She said, "The rapid advancement of gen AI represents a profound paradigm shift in cybersecurity, bringing unique challenges and opportunities. By designing AI systems with security at their core and continuously monitoring and updating them, organisations can stay ahead of the most critical threats. Business resilience requires readiness, rapid response to disruptive forces and confidence in your organisation's ability to act effectively."

Actions for improved security posture

The State of Cybersecurity Resilience 2025 report outlines four specific actions for organisations aiming to achieve the highest maturity zone. These include developing and deploying a governance framework that connects AI security to regulatory and business priorities, building a digital core that is secure for generative AI from the outset, and maintaining AI systems with secure foundations that are actively updated to address new threats. Leveraging generative AI to automate security processes, strengthen digital defences, and detect threats earlier is also recommended as a critical strategy.

The report concludes that while organisations are embracing AI for greater efficiency and agility, significant gaps in security practices and readiness persist, posing risks that require renewed focus and sustained investment.