Australian firms urged to automate against AI cyberattacks

Australian businesses are being urged to strengthen basic cyber defences and make greater use of automation to counter AI-enabled attacks, as cybersecurity professionals gather in Melbourne to assess the threat landscape.

Research cited by Elastic points to a widening gap between the speed of modern attacks and the ability of many organisations to respond. Based on feedback from IT and cybersecurity professionals in Australia and New Zealand, the study suggests many security teams still rely heavily on manual processes even as attackers adopt more automated methods.

AISA Director Dr Rajiv Shah said businesses should reject the idea that they cannot defend themselves against this shift in attack methods. He said organisations can reduce risk by improving routine security practices and using automated tools to manage a higher volume of alerts and investigations.

"AI is giving cybercriminals the ability to identify weaknesses, launch attacks and exploit vulnerabilities faster than ever before. But organisations have a growing range of tools available to protect themselves," Dr Shah said.

He outlined a practical checklist for businesses seeking to reduce their exposure.

"We need to focus on what businesses can do to reduce their exposure and strengthen their ability to respond.

"Good cyber hygiene remains our first line of defence. Keeping systems patched, managing access, removing unnecessary vulnerabilities and maintaining secure configurations can significantly reduce opportunities for attackers.

"That also means fewer security incidents and less unnecessary pressure on the people responsible for protecting our systems.

"At the same time, we need to make better use of tools like automation to handle the volume and speed of threats that remain. Machines can process information and investigate alerts at a scale humans simply cannot match, while skilled cybersecurity professionals provide the judgement, oversight and expertise needed to make critical decisions."

Response gap

Elastic's findings indicate that only 14 per cent of Australian organisations believe they can respond to AI-driven attacks at machine speed. The research also found that 83 per cent still rely on manual or partly manual processes, leaving defenders trying to keep pace with intrusions that can unfold far more quickly.

Global Chief Information Security Officer Mandy Andress said the figures show how difficult it remains for many organisations to deal with increasingly automated attacks.

"Only 14 per cent of Australian organisations say they can respond to AI-driven attacks at machine speed, while 83 per cent still rely on manual or mixed processes. That creates a serious imbalance when attackers can use automation to move through systems faster than security teams can investigate what's happening," Andress said.

The research also points to weaknesses in internal monitoring. Elastic said 60 per cent of organisations had identified gaps in their security monitoring, with legacy systems, fragmented data and skills shortages contributing to the problem.

"We also found that 60 per cent of organisations have identified gaps in their security monitoring. Legacy systems, fragmented data and skills shortages all contribute to the problem. These are practical challenges that organisations can address.

"Cyber hygiene is an important starting point. But organisations also need to look at how they manage the alerts that remain. Better integration of security data, automated triage and investigations can help teams identify genuine threats, prioritise their response and act much faster."

Shared responsibility

Dr Shah said the response to cyber risk must evolve as the threat environment changes. Business leaders, he said, have a role in supporting both preventative security measures and more modern operational processes, rather than treating cybersecurity as a narrow technical issue for specialist teams alone.

That reflects a broader concern across the sector that attackers are using AI to shorten the time between identifying a weakness and exploiting it. For defenders, the challenge is not only to stop every incident at the perimeter, but also to detect, assess and contain suspicious activity more quickly once it appears inside networks and systems.

Routine controls such as patching, access management and secure configuration remain central because they close straightforward openings that attackers often exploit first. Automation, meanwhile, is being presented as a way to ease the burden on security teams by helping them sift through large volumes of alerts and focus human attention on the most serious threats.

Skills shortages remain a persistent issue, making that balance more important for many organisations. Security teams are often expected to monitor sprawling technology estates that include legacy platforms as well as newer cloud-based systems, creating blind spots when data sits across disconnected tools.

For many businesses, the issue is less about adopting a single new product than improving the basics and connecting the systems they already use. Better visibility across those environments can help teams understand what is happening sooner and decide which incidents need immediate action.

"Cyberattacks are becoming faster and more sophisticated, but so are the tools available to defend against them. There is a lot that organisations can do right now, regardless of their size or technical maturity," Dr Shah said.

"Getting the fundamentals right will prevent many attacks. Using automation intelligently can help teams identify and deal with the threats that get through," he said.