The Industry Speaks - part 8: Cyber Security Awareness Month 2026

As cyber threats become more sophisticated, organisations spin up new products at extreme AI speeds, and the demand for specialist expertise grows, we need to apply the same ‘trust but verify’ mindset to cyber talent and services that we apply everywhere else in security. Whether you’re hiring a professional or bringing in external support, knowing that the person on the other side has been properly verified should be the baseline. In an industry built on trust, we can’t afford to leave the people protecting us as an unchecked part of the security chain.

Zach Wasserman
Co-founder, Fleet Device Management

Frontier AI models can now uncover vulnerabilities at enormous scale, yet our recent Road to AI in IT research found that 79 per cent of organisations take more than a day to deploy critical security patches. That gap between discovery and remediation is only going to become more dangerous as AI capabilities accelerate.

This Cyber Security Awareness Month, organisations should consider if they can actually keep pace with this new reality. AI can help defenders understand endpoint state, prioritise remediation and ultimately respond faster, but speed without control creates its own risk. The goal should be an operating model where AI can move quickly while changes remain visible, reviewable and reversible. In the AI era, good cyber hygiene is knowing what needs fixing and having the infrastructure to safely fix it before an attacker gets there.

Arti Raman
CEO, Portal26

Cyber Security Awareness Month has always been about closing the gap between what security teams think is happening in their environment and what's actually happening. Today, that gap is widest around AI. Employees are adopting AI tools faster than governance teams can track them, and every ungoverned prompt is a potential data exposure. Real AI security doesn't start with another policy document – it starts with visibility. You can't govern what you can't see, and this month is a good reminder that 'we have an AI policy' and 'we have AI security' are two very different things.

VIEW ALL

Amit Shuster
VP Product at Vetric

Insider threats in the AI era aren't just about malicious actors; they're about how easily trust can be manufactured or misplaced. The line between external attack and insider risk is blurring fast, and understanding the intelligence behind the deepfake is now essential, because verification can't rely on gut instinct anymore.

Cyber Security Awareness Month should be a reminder that the organisations who fare best this year will be the ones treating verification and visibility as an ongoing discipline, not a once-a-year training exercise, because processes need to hold up even when something looks and sounds completely legitimate.

George Harb
Vice President Australia and New Zealand, OpenText

Australia’s reliance on interconnected digital infrastructure means a cyber weakness rarely exists in isolation. Legacy systems, cloud services, third-party suppliers and digital identities can each introduce relatively small exposures that become far more significant when combined. AI is making it easier for attackers to identify those connections quickly and determine where they can be exploited.

For Australian organisations, the challenge is shifting from simply finding and patching individual vulnerabilities to understanding how weaknesses across their broader technology environment could connect to create an attack path.

John Cannava
CIO at Ping Identity

Cyber Security Awareness Month is an important reminder to make security a priority, but it shouldn’t begin and end in October. As technology evolves, so does the definition of who, or what, organisations need to secure. AI agents are increasingly accessing applications, data, and critical business systems while taking actions at machine speed, creating a new layer of risk that businesses need to manage every day.

The same security principles we’ve long applied to human access now need to extend to AI. At the end of the day, the nonhuman identity problem is still a human problem. Organisations need to know who authorised an agent, what authority it has, and what it should be allowed to do. That means giving AI agents verifiable identities, clear ownership, and least-privilege access, with continuous authorisation and accountability for their actions. Businesses should extend proven identity principles to machines acting on behalf of people and build those principles into controls that can actually be enforced.

Looking ahead to secure the next 250 years, security cannot be in the spotlight for only one month. Leaders must build a culture of security and maintain visibility and control over every kind of identity year-round.

Darryl Jones
Vice President of Consumer Segment Strategy at Ping Identity

Securing the next 250 years means thinking about how trust needs to evolve as technology becomes a bigger part of consumers’ lives. AI is helping people make decisions and take actions online, but consumer trust isn’t all or nothing. Consumers might be comfortable having an AI agent recommend a product, for example, but hesitate to let it make a purchase or access sensitive financial information on their behalf.

For retailers, identity is as much a business issue as it is a security one. AI creates more convenient digital experiences while at the same time allowing fraudsters to find new ways to impersonate legitimate consumers and make scams more convincing. Businesses need to embrace technologies like biometric authentication and verifiable credentials that allow consumers to securely prove who they are while helping retailers establish trust at every interaction. Putting identity at the centre of digital commerce can help reduce fraud without sacrificing the seamless experiences consumers expect. Cyber Security Awareness Month is a reminder that building trust isn’t just an October priority. It’s fundamental to creating a safer digital economy for the years and generations ahead.

Charles Spencer
General Manager ANZ at Vectra

Cyber Security Awareness Month feels particularly timely this year. Recent developments involving AI agents have raised fresh questions about the security controls needed to manage technologies, particularly in sensitive environments. The question is no longer whether AI will change the threat landscape, but whether organisations are prepared to detect and contain what comes next.

Ensign’s 2026 Cyber Threat Landscape Report found that frontier AI models can already complete multiple stages of a simulated cyber attack. Meanwhile, the capability gap between the leading Eastern and Western models tested is narrowing, with a leading Eastern model delivering comparable offensive performance at approximately one-fifth the operating cost.

These findings come against an already serious threat environment. Ransomware activity across Australasia increased by more than 600 per cent, while the sale of initial access rose fivefold. Organised crime accounted for 52 per cent of observed threat activity.

Awareness remains important, but it cannot be treated as an annual exercise. At Vectra, we encourage Australian organisations to move beyond awareness to preparedness. Businesses need to assume they will be probed and potentially compromised, then continuously test whether they can detect, contain and recover from an AI-enabled attack.

Danny Jenkins
CEO and Co-Founder of ThreatLocker

October is Cyber Security Awareness Month, and while much of the discussion will rightfully be centred on AI, we need to make sure those concerns don’t lead us to lose focus on the cybersecurity fundamentals.

Most AI cyberattacks still rely on familiar weaknesses like stolen credentials, untrusted software and an allow-by-default approach that lets users and applications do whatever they want unless activity is later identified as a problem.

Australian companies should treat ransomware as a board-level issue and act proactively rather than in the middle of a cyber incident. The controls that matter the most are allowlisting, ringfencing, and zero trust network access. They can limit what a hacker can access despite entering a system. Don’t make it easy for them.