1. AI-powered cyber threats

Artificial intelligence has become a powerful enabler—unfortunately, not just for legitimate businesses but also for cybercriminals. Attackers are using AI to automate mundane tasks like vulnerability discovery, spear-phishing, and evading traditional security measures. This development radically increases the scale and speed at which attacks can be launched, posing new complexities for organisations of all sizes.

Adaptive cyber threats

What sets artificial intelligence-driven attacks apart is their ability to adapt. Instead of following a single, predictable playbook, these threats evolve in real-time. Machine learning models can quickly identify weaknesses in network security and applications, pivoting instantly to exploit vulnerabilities. Traditional defences, which might rely on static rules or infrequent threat intelligence updates, can struggle to keep pace.

Personalisation

Automation

What you can do:

• Automate your defences: Use AI-based cyber security tools to detect unusual network traffic or login behaviour in real-time.
• Conduct regular phishing campaigns: Help your staff recognise AI-fuelled phishing attempts by running realistic, ongoing training.
• Align budgets to threat levels: Factor in the rising costs of AI-driven attacks when planning security spend, ensuring you have funds for advanced defence solutions.

2. Zero Trust Architecture

As organisations adopt remote work, hybrid models, and Bring Your Own Device (BYOD) policies, the traditional network perimeter has become blurred. Zero Trust Architecture (ZTA) has emerged as a leading security model to address this challenge. In essence, ZTA assumes that no user or device—inside or outside the network—should be trusted by default.

Principle of least privilege

Zero Trust mandates that individuals and devices are granted only the minimum level of access required for their tasks. This principle is particularly relevant for managing teams with varying levels of financial systems and operational systems access. By strictly limiting privileges, ZTA minimises the damage a compromised account can inflict.

• Minimise access: Users and devices should only have the minimum level of access necessary to perform their tasks.
• Role-Based Access Control (RBAC): Implement RBAC to ensure access permissions are aligned with job roles and responsibilities.
• Regular reviews: Continuously review and adjust access permissions to ensure they remain appropriate and secure.

Continuous verification

Unlike traditional approaches that verify users once at login, ZTA frequently re-authenticates identities and devices throughout a session. This continuous verification is crucial when employees might work from a home network one day and a public Wi-Fi network the next. Microsoft’s Zero Trust framework underscores the importance of assessing security posture in real-time to spot anomalies quickly.

• Always verify: Every access request should be authenticated, authorized, and encrypted before granting access.
• Real-time monitoring: Implement continuous monitoring and logging to detect anomalies and potential security threats.
• Adaptive policies: Use adaptive policies that adjust based on real-time risk assessments and telemetry data.

Assume breach

Zero Trust further emphasises the idea of assuming a breach has already occurred. In practice, this means constant vigilance: systems monitor behaviours and context, and any suspicious activity triggers alarms or restricts access. When malicious actors do gain a foothold, continuous monitoring severely limits their ability to move laterally and access critical or sensitive data.

• Prepare for breach: Operate under the assumption that data breaches will happen, and plan accordingly.
• Segmentation: Use network segmentation to limit the impact of a breach.
• Incident response: Develop and regularly update incident response plans to quickly address and mitigate breaches.

For organisations embracing hybrid work or BYOD policies, Zero Trust is less a trend and more a necessary evolution. “Leadership recognises that a single compromised device—an unprotected laptop, for instance—can jeopardise sensitive financial and operational data,” says Anthony Porter, Cloud Security Architect at Canon Business Services ANZ. “ZTA counteracts these security risks by adopting a ‘trust no one, verify everything’ stance.”

What you can do:

• Set up MFA for all user accounts to add an extra layer of security.
• Schedule periodic reviews of user access permissions to ensure they align with current roles.
• Use network monitoring tools to continuously observe traffic and detect anomalies.
• Regularly review and update security policies to address new threats and vulnerabilities.
• Deploy endpoint security software to protect devices from malware and other threats.

3. Regulatory compliance and governance

Australia and New Zealand’s regulatory landscape continues to evolve in response to new cyber security threats and escalating concerns around data privacy. Not only must organisations protect themselves against potential fines and legal ramifications, they also risk severe reputational damage if found to be non-compliant.

Data privacy laws

In Australia, the Privacy Act 1988 requires organisations to handle personal or sensitive information responsibly. Across the Tasman, the New Zealand Privacy Act 2020 has introduced modernised guidelines that demand transparency and accountability in how personal data is processed and stored. Both laws stipulate how data should be collected, used, and disclosed, with hefty penalties for breaches.

Cyber security frameworks

Beyond data privacy statutes, frameworks like the Australian Cyber Security Centre (ACSC) Essential Eight guide organisations on key cyber security controls. These controls range from application whitelisting to patch management and backup strategies. Government agencies and large enterprises increasingly reference the Essential Eight, indicating a broader emphasis on baseline cyber hygiene.

Reporting requirements

What you can do:

• Schedule regular audits: Assess your systems and processes against local legal requirements (Privacy Act, Essential Eight) at least annually.
• Create a breach response plan: Define clear roles, responsibilities, and timelines for reporting and managing incidents.
• Monitor legislative updates: Keep abreast of changes in Australian and New Zealand privacy and cyber security laws to maintain compliance.

4. Data security with generative AI use

Generative AI, from complex text generation to image creation, is reshaping how content is produced. While this technology can speed up many business processes, it also presents unique security concerns. The very systems that generate valuable data can also create new unexpected security risks to your organisation.

Unstructured data protection

Generative AI often handles unstructured data—text, images, videos, or even audio. This increases the complexity of data security because many existing tools are designed primarily for structured datasets like spreadsheets or databases. The risk is that sensitive information may be embedded in artificial intelligence-generated content, making it harder to monitor and protect.

Risk of PII leak

AI model security

Securing the AI model itself is another concern. Hackers could tamper with a model’s parameters to produce misleading or damaging outputs, effectively ‘poisoning’ the system. This risk underscores the importance of integrity checks, access controls, and robust monitoring.

Ethical considerations

• Fairness – ensuring AI systems do not perpetuate bias or inequality.
• Reliability and safety – guaranteeing consistent, dependable outcomes under a variety of conditions.
• Privacy and security – protecting sensitive data and preventing misuse.
• Inclusiveness – designing AI tools that are accessible and equitable.
• Transparency – making AI decisions understandable and explainable.
• Accountability – establishing clear oversight and governance mechanisms.

For many executives, the question is no longer whether to adopt AI, but how to integrate it responsibly—balancing innovation with ethical foresight.

What you can do:

• Conduct an AI risk assessment: Identify where and how you use AI across your organisation—then create guidelines for responsible use.
• Implement data classification: Use automated tools to scan and enforce security measures on sensitive information before it’s fed into AI models.
• Secure the model environment: Restrict access to AI development systems and apply real-time monitoring to prevent unauthorised modifications.
• Enforce employee awareness training: Educate on Gen AI use, best practices, and data security concerns. Develop awareness to keep everyone informed and up-to-date on guidelines and ethics.

5. Cyber security talent shortage

The final trend impacting cyber security is not a purely technological one: a growing talent shortage. The demand for cyber security professionals far exceeds the supply in Australia and globally. This deficiency directly translates into higher salaries, increased competition for top talent, and a heavier reliance on third-party providers.

Skills gap

According to the (ISC)² Cybersecurity Workforce Study 2024, the global cyber security workforce needs to grow by an estimated 4.8 million professionals to effectively defend organisations. This shortage is particularly critical in specialised areas like threat intelligence and incident response, leaving companies without the expertise to tackle advanced threats.

Training and development

Organisations are increasingly focusing on upskilling. With targeted training and certification programs, they can build a cyber security bench in-house. This approach benefits employers and employees: it addresses pressing security needs while boosting retention and job satisfaction.

Retention strategies

High turnover in cyber security roles remains a challenge. Cyber security specialists are regularly headhunted with offers of better pay or more attractive projects. Retention strategies—ranging from flexible work arrangements to clear career progression pathways—help companies hold on to critical talent. For small to medium enterprises and large corporations alike, third-party services such as a 24/7 Security Operations Centre (SOC) can plug immediate gaps while internal teams focus on strategic initiatives.

What you can do:

• Offer fast-track certifications: Partner with training providers to equip staff with specialised skills quickly. Incentivise upskilling within your organisation to align with business needs.
• Enhance retention: Implement career pathways, mentorship programs, and flexible work options that appeal to skilled cyber security professionals.
• Outsource for immediate coverage: If you’re short on expertise, consider partnering with a 24/7 SOC to fill critical gaps while gradually building in-house talent.

Building a secure, compliant future

Organisations across Australia and New Zealand are wrestling with an increasingly complex cyber terrain. AI-powered threats, the adoption of zero-trust frameworks, evolving compliance mandates, the intricacies of generative AI, and a persistent talent shortage underscore the need for a coordinated, forward-thinking strategy.