Op-Ed: Just 4% of Australian organisations regularly test their response to AI cyber incidents

The finding comes from ISACA's State of Cybersecurity 2026 research and raises some important questions about how prepared Australian organisations really are.

While AI is helping cyber security teams detect threats and automate routine tasks, it is also introducing new risks that organisations need to understand and manage. Yet many appear to be adopting the technology faster than they are preparing for the problems that could come with it.

Globally, 41 per cent of cyber security professionals say their organisations now use AI to automate threat detection and response, up from 32 per cent last year. Another 40 per cent use it to automate routine security tasks, compared with 28 per cent in 2025.

These are positive developments, particularly for cyber security teams already struggling with heavy workloads and limited resources.

However, almost half (48 per cent) of respondents either don't know whether their organisation has an AI-related incident response playbook or say one doesn't exist. Nearly a third (31 per cent) report that their organisation has conducted no AI-related incident response exercises.

Consider what might happen if an employee inadvertently exposed sensitive company information through a generative AI tool, or an organisation became the target of a sophisticated AI-enabled fraud attempt.

VIEW ALL

Would the security, privacy, or fraud teams know how to respond? Would responsibilities be clear? Would senior management understand the potential consequences and what decisions needed to be made?

These are scenarios organisations should already be discussing and testing.

Most businesses have spent years developing incident response plans for traditional cyber threats. Those plans now need to account for the additional risks associated with AI.
But having a plan on paper doesn't necessarily mean it will work when something goes wrong. Testing helps identify gaps, clarify responsibilities and ensure the right people know what to do.

Cyber teams are feeling the pressure

The other concerning finding from this year's research is the pressure being experienced by cybersecurity professionals.

In Australia, 69 per cent say their role is more stressful today than it was five years ago, while 58 per cent report that their teams are understaffed. Evidence of this is perhaps best highlighted by the recently disclosed vulnerabilities in PHP and Citrix Netscaler, which demonstrate the impact AI is having on exposure management. Cyber teams across the globe were heavily impacted by these vulnerabilities – and their incidence is only going to accelerate as AI is increasingly weaponised to find and exploit vulnerabilities.

Interestingly, only 24 per cent of Australian respondents reported an increase in cyberattacks over the previous year. Yet among those who said their jobs had become more stressful, 78 per cent identified the increasing complexity of the threat landscape as a contributing factor.

This suggests the problem isn't simply the number of attacks organisations are dealing with. Cyber security professionals are having to manage more complicated threats, keep up with new technologies, and meet rising expectations from the businesses they support.

AI is adding another dimension to their responsibilities. More than half (51 per cent) of cyber security professionals globally are now involved in developing, onboarding or implementing AI solutions, up from 40 per cent last year and 29 per cent in 2024.

That's a significant change in a relatively short period, and one that employers need to recognise when considering the resources and skills their cyber teams require.
There are also consequences for staff retention. Globally, high work stress is now the leading reason cyber security professionals leave their jobs, cited by 52 per cent of respondents, up from 47 per cent last year.

Losing experienced professionals creates further pressure on teams that may already be understaffed. Recruiting replacements can be difficult, particularly when organisations are looking for people with both technical expertise and the ability to understand business risk.

What should boards be asking?

There are some encouraging findings in this year's cyber security research. Globally, 77 per cent of respondents say their organisation's cyber security strategy is aligned with business objectives, and 56 per cent believe their board adequately prioritises cyber security.

But recognising the importance of cyber security is one thing. Boards also need to know whether their organisation is adequately prepared to deal with an incident.

When was the last time the organisation tested its response to an AI-related incident? Are cyber security teams adequately resourced? Do they have the skills and authority to manage emerging threats? And is the organisation doing enough to retain experienced people?

These are reasonable questions for any board to ask, regardless of the size of the business.
Boards may also want to consider participating directly in a crisis simulation of their organisation’s response to an AI-related incident. Any material incident will almost certainly require board oversight, so it’s vital to be as prepared as possible.

For all the attention being given to AI, organisations need to spend more time considering what happens when something goes wrong. That means testing their response plans, making sure responsibilities are clear, and giving cyber security teams the resources they need.

Jamie Norton is Vice Chair of the ISACA Board and Chief Information Security Officer at the Australian Securities and Investments Commission (ASIC). With more than 25 years of experience across government, commercial and international sectors, he specialises in cybersecurity, resilience and strategic risk management. Jamie has previously served as a Partner at McGrathNicol, advising executives and boards on navigating emerging technology risks; CISO at the Australian Taxation Office and has held leadership roles with NEC, Tenable, Check Point, and the World Health Organisation.