Most Asia Pacific firms unprepared for AI-driven cyber threats

A new report from Accenture has found that 90% of organisations worldwide are not adequately prepared to defend against cyber threats driven by artificial intelligence, with those in New Zealand facing potentially higher risks.

The "State of Cybersecurity Resilience 2025" report identifies a significant global gap in cybersecurity maturity, noting that the pace of cyber threat evolution is outstripping many organisations' ability to respond effectively. Although only 36% of organisations surveyed acknowledged that their security posture is being overtaken by advancements in AI, the general consensus highlights mounting concern about readiness levels.

The report outlines three main zones of security maturity. The "Reinvention Ready Zone" comprises just 10% of organisations that demonstrate adaptive and resilient approaches to continuously evolving cyber threats. The "Progressing Zone" consists of 27% of organisations that have achieved some strength but struggle with strategic direction or the implementation of defences. The majority, 63%, are listed in the "Exposed Zone", characterised by limited cyber readiness and a reactive approach, conditions that are further challenged by complex AI-driven environments.

In the Asia Pacific region, the situation appears more acute. The report found 71% of organisations in the region are in the most at-risk, or Exposed Zone, compared to the global average of 63%. The figures suggest Asia Pacific, and by extension New Zealand, may be facing heightened vulnerability in the context of fast-evolving threats.

Justin Mowday, Country Managing Director for Accenture in New Zealand, linked this vulnerability to a broader set of global and economic challenges.

"Rising geopolitical tensions, economic volatility and increasingly complex operational environments are leaving organisations more exposed to cyber risks. This report serves as a wake-up call that cybersecurity can no longer be an afterthought. It must be embedded by design into every AI-driven initiative. Taking this proactive approach will help ensure a competitive edge, strengthen customer loyalty and turn cybersecurity into a business enabler."

The report proposes four critical actions for organisations seeking to enter the Reinvention Ready Zone and better protect against AI-driven threats. These include the development of purpose-built security governance frameworks aligning AI security with business and regulatory imperatives; designing digital cores that are secure for generative AI from the outset; ensuring resilience through secure AI system foundations able to detect, address and respond to emerging threats; and leveraging generative AI to automate security workflows, fortify defences, and improve early threat detection.

Mary Attard, Security Lead for Accenture in Australia and New Zealand, commented on the particular challenges posed by generative AI.

"The rapid advancement of gen AI represents a profound paradigm shift in cybersecurity, bringing unique challenges and opportunities. By designing AI systems with security at their core and continuously monitoring and updating them, organisations can stay ahead of the most critical threats. Business resilience requires readiness, rapid response to disruptive forces and confidence in your organisation's ability to act effectively."

The findings of the Accenture report highlight a pressing need for organisations in New Zealand and throughout the Asia Pacific region to reassess their cybersecurity strategies. The report suggests that firms that strive to reach a higher level of security maturity can derive greater value from their AI investments, while those that fall behind may see increased exposure to risk and operational disruption.

Organisations are being encouraged to invest in developing cohesive and robust cybersecurity strategies—embedding protective measures into their AI deployments from inception, not as an afterthought. The report emphasises the importance of aligning these strategies with both regulatory expectations and broader business objectives, to safeguard not only data and systems but also customer trust and business continuity.