The industry speaks – part 11: Cyber Security Awareness Month 2026

Veeam research found that 51 per cent of ANZ organisations were not confident they could restore critical data within 24 hours, while 47 per cent said they would not know who to contact or what steps to take if a major data incident occurred tomorrow. Having a recovery plan is not the same as being ready to execute it under pressure. That readiness gap has real consequences. More than half of ANZ organisations surveyed said they had paid a ransomware demand following a cyberattack, despite around four in five expecting their organisation to have a robust data-resilience strategy capable of avoiding payment.

As cyber incidents become an expected business risk, organisations must continuously test and validate their recovery capabilities before a crisis hits. The goal is not confidence on paper. It is being able to recover quickly enough to keep the business running and remove ransom payments from the decision set altogether.

Ramon Rodriguez
Executive AI Advisor, Market Advisory AI, Acquire Intelligence

For businesses deploying AI agents, the first question is ownership: who signed off on what the agent is allowed to do? An AI agent that holds valid credentials is an identity with access to real systems. It needs a named human owner, a defined approval boundary and logs that show what it did and why.

Security teams can start this month. List every agent running in the business, the credentials each one holds, and the person accountable for it, then test how quickly that access could be removed. If nobody can name the owner or run the test, the business has an access-control gap to address.

Itzik Swissa
Country Manager A/NZ & Sr. Director, JFrog

VIEW ALL

The vulnerability backlog hasn’t just grown – it’s changed shape. AI-assisted development is producing code faster than security teams can govern it, and attackers are exploiting that gap in ways severity ratings were not designed to catch. A low-severity flaw and a medium-severity one may each look manageable alone, but attackers can chain them into something serious. That is why exploitability and exposure should carry as much weight as severity score.

Australia is actually ahead of the curve here in some respects. JFrog’s 2026 Software Supply Chain Security State of the Union, which surveyed 1,508 IT professionals across eight countries in early 2026, found 47 per cent of Australian organisations use automated controls to block unapproved IDE extensions and MCP servers, the highest rate of any country surveyed. However, only 38 per cent have adopted secrets detection, so most are not actively scanning their code for exposed credentials, API keys or tokens.

Cybersecurity Awareness Month is a good moment to look beyond phishing. A harder question is whether an organisation knows what is in its pipeline and can show it quickly when a board or regulator asks. JFrog’s research found 44 per cent of Australian organisations need a week or more to produce compliance audit proof for a single application.

Charles Spencer
General Manager, Australia and New Zealand, Vectra Corporation

Cyber Security Awareness Month feels particularly timely this year. Recent incidents involving AI agents have raised fresh questions about the security controls needed to manage technologies, particularly in sensitive environments. The question is no longer whether AI will change the threat landscape, but whether organisations are prepared to detect and contain what comes next.

Ensign’s 2026 Cyber Threat Landscape Report found that frontier AI models can already complete multiple stages of a simulated cyber attack. Meanwhile, the capability gap between the leading Eastern and Western models tested is narrowing, with a leading Eastern model delivering comparable offensive performance at approximately one-fifth the operating cost.

These findings come against an already serious threat environment. Ransomware activity across Australasia increased by more than 600 per cent, while the sale of initial access rose fivefold. Organised crime accounted for 52 per cent of observed threat activity.

Awareness remains important, but it cannot be treated as an annual exercise. At Vectra, we encourage Australian organisations to move beyond awareness to preparedness. Businesses need to assume they will be probed and potentially compromised, then continuously test whether they can detect, contain and recover from an AI-enabled attack.

Harshvendra Soin
President, Asia Pacific and Japan Business, Tech Mahindra

This year’s theme, “Take a second. Stay secure”, asks people to pause before they click, share or respond. For organisations, the harder truth is that attackers no longer need much more than a second. AI has compressed what once took days into minutes, and it has made familiar attacks cheap enough to run against everyone.

That is why the shift from awareness to action matters. Across Asia Pacific and Japan, the conversation in boardrooms has moved on from “are we aware of the risk?” to “can we prove we are ready for it?” Three actions stand out.

First, govern every identity, human and machine. AI agents now log in, retrieve data, and execute workflows on behalf of the business. Each one is a privileged user. Organisations that would never give an employee permanent, unreviewed administrator access are doing exactly that for automated systems. Every agent should have a named owner, least-privilege access, and a clear audit trail back to a human decision.

Second, prove resilience rather than assume it. Most organisations have a recovery plan. Far fewer have tested it against a realistic scenario such as ransomware, a compromised administrator account or a third-party outage. Regulators across the region, from APRA’s operational resilience standard (CPS 230) to the SOCI Act and Singapore’s Technology Risk Management guidelines (MAS TRM), increasingly expect evidence, not intent. Boards should be asking for the same.

Third, treat security as an operating model, not a shopping list. The gap we see most often is not a missing tool. It is fragmented tools, unclear ownership between the organisation and its providers, and too few skilled people to connect the signals. Outsourcing operations do not outsource accountability.

Finally, no organisation is more secure than its weakest supplier. Large enterprises depend on thousands of small and mid-sized businesses that rarely have dedicated security teams. Australia’s inaugural Cyber Action Year is right to frame this as collective action. Industry, government and service providers must make strong security practical and affordable across the whole supply chain, not just at the top of it.

Taking a second is a good start. Making security part of how the organisation runs every day is what keeps it secure.

Andrew McCorquodale
Director, CyberProof APAC, a UST company

Cyber Security Awareness Month has become a ritual of reminding staff not to click suspicious links. But the attacks hurting organisations today often don't need a click at all. Adversaries are calling help desks, impersonating employees with AI-generated voices, and exploiting third-party platforms to walk straight through the front door with valid credentials.

Employees play an important role, but awareness alone cannot address every risk. If a single convincing phone call can reset an executive's MFA, that's a process failure, not a training gap.

Organisations need to move from awareness to resilience. That means phishing-resistant authentication, verified processes for every privileged change, and treating identity across the supply chain as one attack surface. It also means recognising that attackers now operate at machine speed, so detection and response must match it, with AI handling the volume so analysts can focus on the decisions that matter most.

The question boards should be asking this October isn't “Did our staff complete their training?”; it's How quickly would we know, and how quickly could we recover?”