The industry speaks – part 9: Cyber Security Awareness Month 2026

Removing unused accounts, enabling multi-factor authentication and limiting third-party access to the systems and timeframes required are practical steps businesses can take to reduce their exposure. Supplier access deserves the same scrutiny as access granted to employees.

For critical infrastructure operators, the stakes extend beyond stolen information. Where digital networks connect to equipment controlling energy, water, or manufacturing processes, a cyber incident can disrupt essential services and put safety at risk. Separating corporate IT from operational systems, and tightly controlling what passes between them, can help contain a breach before it becomes a wider operational incident.

Through our partnership with Owl Cyber Defense, GME supports organisations in protecting sensitive networks and controlling data transfers between systems. Connectivity brings real operational benefits, but every connection needs a clear purpose and appropriate safeguards. This month is an opportunity to challenge unnecessary access and test whether those safeguards work in practice.

Sonia Eland
Executive Vice President and Country Manager, Australia and New Zealand, at HCLTech

Cybersecurity awareness has been a priority for organisations for many years, and most businesses now understand it’s not just the responsibility of IT teams. What has changed recently is the speed and complexity of the risk environment, particularly as generative AI and frontier language models become part of everyday work and everyday life.

The act of typing a prompt can now create new and sometimes unforeseen vulnerabilities. A poorly framed instruction, a vague request, or the use of sensitive company or customer information in the wrong environment can expose organisations to risks that traditional cyber training was not designed to address. This is not just a technology issue. It is a people, process and governance issue as well.

VIEW ALL

Employees are already using generative AI at home and in their personal lives, often in very open and experimental ways. At work, that same behaviour needs much clearer boundaries. People need to understand what information can be shared, what should never be entered into external tools, and how to use AI safely without putting company, customer or partner data at risk.

At the same time, established cyber threats have not gone away. Phishing, impersonation and social engineering remain major entry points into corporate systems, but generative AI is making these attacks more convincing, more personalised and harder to detect. That makes the human in the loop one of the most important parts of an organisation’s security posture.

Cyber Security Awareness Month is a timely opportunity for organisations to reinforce that message. The goal is to make sure their people are properly supported with the right awareness, guardrails, processes and technology. As AI becomes more deeply embedded in the way we work, uplifting cyber safety across the workforce is more critical than ever.

Anand Ramamoorthy
Director for Data Governance and Quality at Informatica from Salesforce

Cyber Security has traditionally focused on keeping attackers out. In the AI era, organisations across ANZ face a challenge: understanding whether the data powering AI is trusted, visible, and properly governed.

Many of the biggest AI data risks aren’t new – AI exposes them faster. Before organisations ask whether their AI is secure, they should first ask whether the data powering it is trusted, accessible only to the right people, and governed consistently across the business.

That starts with context. Trust is conditional; data fit for one use may be inappropriate for another, depending on what it contains, where it came from, and who's asking. Organisations that can't answer this for their own data can't answer it for the AI systems consuming it, which is why visibility into data – through catalogue, classification, and lineage – matters as much for security as for analytics. Transparency builds the awareness and trust employees need to work confidently with data, and it gives AI agents a governed, auditable trail to act on that same data responsibly.

Visibility needs consistency to hold up. Ad hoc access decisions don't scale and leave little to defend later, whether to a regulator or after a breach. Governing access as policy, with fine-grained controls and de-identification limiting exposure to only what's needed, brings the transparency both compliance and AI now demand – ideally automated into everyday systems rather than applied after the fact. That same transparency is what lets human and AI agents alike be trusted with greater autonomy over time.

Cyber Security Awareness Month is a reminder that the biggest AI security risk doesn’t stop at the model – it depends on an organisation's ability to govern the data behind it. As AI adoption accelerates, the governance gap is becoming the new security gap.

Sam Salehi
Managing Director ANZ at Qualys

This Cyber Security Awareness Month, awareness and action need to go hand in hand.

Qualys Threat Research Unit analysis found that the average time-to-exploit has fallen to negative one day, meaning vulnerabilities are being weaponised before they are publicly disclosed. The recent unauthorised access of Services Australia’s Medicare statistics portal by an OpenAI agent raises a question every organisation should be asking: if the incident hadn't been disclosed, how quickly would it have taken us to notice? As autonomous AI systems become more capable, that question only grows more urgent.

Frontier AI is changing the clock cyber security operates on. Security teams aren't failing because they aren't doing enough. The operating model itself needs to change. You cannot defend against machine-speed attacks with human-speed processes alone. Autonomous offence requires autonomous defence — continuously identifying exposures, understanding which assets and risks matter most to the business, and automatically prioritising and remediating critical risks where it is safe to do so, with humans providing oversight and judgement.

That is why ASD’s push from awareness to action through Cyber Action Year resonates. Awareness without action doesn't reduce exposure. And action that comes after an attacker has already exploited the weakness may simply be too late.

The next era of cyber resilience is about closing the gap between knowing and doing. Organisations need to strategically combine human judgement, business context and autonomous defence to find and reduce the risks that matter before attackers get there first.

Octavian Tanase
Chief Product Officer at Hitachi Vantara

Over the last year, cyber risks have increased as AI capabilities have become more sophisticated, giving threat actors new ways to identify vulnerabilities faster and launch attacks on a broader scale. At the same time, data governance is taking on greater importance amid sovereignty concerns and international regulations like DORA, NIS2, or GDPR. Protecting that data and ensuring it remains available and recoverable needs to be the top priority for any board or leadership team. This requires organisations to think beyond prevention and prepare for how they will maintain business continuity and recover trusted data when an attack occurs.

Cyber resilience starts with a strong data foundation and clear governance, and it needs to be built into your data infrastructure from the start. If critical data is compromised, organisations need to know they can recover trusted data quickly and keep the business running. Planning for that recovery in advance is critical to maintaining business continuity and customer trust.

Building cyber resilience into infrastructure means giving organisations multiple layers of protection, detection and recovery, from immutable data snapshots and anomaly detection to automated recovery processes and air-gapped environments. The goal is not simply to withstand an attack, but to be ready to restore trusted data and operations as quickly as possible when disruption occurs.