Cybersecurity professionals have long been fighting a battle against the volume and variety of attacks being executed by attackers. But AI has changed the game, adding velocity to the equation. Threat actors can launch more attacks, using different attack methods faster than ever before.
Carl Solder, Cisco's Chief Technology Officer for Australia and New Zealand, said "Company executives are starting to realise that the practices of yesterday might not necessarily be enough to defend the tomorrow."
Citing research from the company's Relentless Defence Report, he said 93% of Australian organisations saw a business disrupting cyber incident with just over a third reporting that they believed AI enhanced attacks were the culprits. Those attacks were typically characterised by hyper-realistic generative phishing, audio/video deepfakes, or highly automated reconnaissance and evasion patterns.
The emergence of AI threats took on new urgency when Anthropic told the world about Mythos and its ability to detect zero day vulnerabilities. Through the research, Cisco assessed the AI threat readiness or organisations and grouped them into four categories in descending order of readiness: relentless, established, reactive, and exposed.
"We found that many organisations were not fully prepared to fend off these new threats with only 5% of the 300 Australian companies believing that they were ready," Solder said. "The reality is there are probably more than 50% of companies at the lower end of the scale. It shows that there's still work to be done to get them more prepared to handle the threats that we will start seeing."
One of the factors Solder identified was the structure of technology and security teams. He said that when organisations start to unify the data they need for incident response and rehearse their response plans, it becomes obvious that organisational friction becomes a big issue.
He added that cybersecurity teams need to communicate more effectively with boardrooms and executives simple, clear, articulate reasons for what's happening. Without this, the cyber team will fail to influence changes in the organisation.
Exacerbating the organisational challenges is the issue of having too many different security products. Each has its own data stores and correlating across those data sources can slow incident response.
"Having a unified data store where everything is in one place will speed up your ability to identify and then remediate," said Solder. "We asked Australian organisations whether they can control autonomous agents given the rise of agentic workforce in the marketplace. 62% said that they felt confident that they could detect and respond to a compromised agent but only 36% indicated that they had mature governance for managing non-human machine identities."
Solder said the data from the report paints a clear picture. Organisations the research placed in the highest Relentless category have their team structure, systems and processes aligned. They can detect and react at machine speed against machine speed threats.
"The operational habits of the global top 8% removed operational and organisational friction. They governed first and have a mature approach to managing identity access rights. They have comprehensive controls and more hygiene around data security, privacy, network security and application security. This gives them the platform to then scale," explained Solder.
One thing that is sometimes lost in the rush to defend against AI-led attacks is a focus on cybersecurity fundamentals. Solder said that for many company executives, the pace of what's happening means they are so busy, they might lose some focus on those basics.
"With the arrival of Mythos earlier this year, there were several post-Mythos recommendations that came out. In a recent incident, water plants in the US were compromised by a hacking group. When they did the post-mortem, patching wasn't up to speed on internet facing PLCs. Post mythos, I think there's a recommendation that we must get back to the basics. It's multi-factor authentication. It's network segmentation. It's all those basics which are going to improve the overall hygiene.," he said.
Cisco's research highlights a gap in Australian organisational cybersecurity preparedness for AI-driven threats. Despite recognising the escalating sophistication of attacks, only 5% of surveyed companies demonstrate readiness. Addressing this requires a fundamental shift, including unified data management, streamlined incident response plans, and a renewed emphasis on foundational security practices like multi-factor authentication and network segmentation. For Australian organisations to move into the "Relentless" category they must optimise team structures, improve governance, and emphasise the importance of core cybersecurity hygiene.