Are you cyber ready?
Australian businesses grapple with cyber resilience in 2024

Today, almost 80% of respondents to our Cyber Risk Survey believe the cyber threat to their organisation has increased compared with last year. However, our data shows that many are still not undertaking crucial preparatory work – perhaps one of the most jarring findings from our survey was that 58% of respondents said it would take an actual cyber attack to motivate their organisation to meaningfully improve their data risk management.

The traditional view of cyber risk and resilience is becoming harder to sustain. As companies continue to transform their digital capabilities, handle ever-greater data volumes, and transact with a complex array of third parties, their supply chains are subject to growing cyber vulnerability. Their attack surface has increased (and become less visible) and many are faced with the real prospect of regulatory intervention, cyber-related class action claims and long-term reputational damage.

Robust cyber resilience involves many parts of a business, but we believe it is time to acknowledge that technology and IT plays a disproportionate role in building cyber resilience. Many of the incidents we see could have been avoided through basic cyber hygiene and good technology or IT solutions.

We also observe that legal teams are increasingly front and centre. This was evident in our survey last year and is reinforced in 2024. In the immediate aftermath of an incident, legal expertise is essential in assessing the impact of an attack, preserving evidence, ensuring regulatory compliance, navigating communications, managing notifications and helping the business engage with stakeholders.

Boards also play a significant role. Key decisions, including those relating to disclosure, threat actor engagement and extortion payments often reside with the board. Despite this, half of our respondents say their boards have not been through a cyber simulation, 30% have not been educated about cyber risk in the last year and 36% have not yet decided whether they were open to paying an extortion demand. Clearly there is a lot more to do.

We can always work harder or spend more on the technical side of the ledger. The challenge for many organisations is whether the investment is sufficient to align with the company’s risk profile – what does good look like? What resilience measures are sufficient? Many are turning to the Government for guidance, and more than 50% of our respondents think the Government needs do more to address cyber risk.