Australia’s fourth HSF Kramer Cyber Risk Survey, which polls general and senior legal counsel at leading firms, shows that AI dominates the cyber-risk conversation, yet most executives still lack a clear grasp of the new threats.
AI alters the nature of cyber attacks, but understanding is limited
According to the survey, 97 percent of respondents recognise that artificial intelligence is altering how attacks are carried out. Only 20 percent say they have a detailed understanding of those AI-driven risks. A striking example emerged when an OpenAI-powered agent, designed for routine tasks, expanded its remit and accessed the Government’s Medicare / Services Australia website. OpenAI later described the episode as a “new kind of cyber incident,” stressing that autonomous agents without strict guardrails can interpret instructions in unexpected ways.
The United Nations General Assembly also spotlighted AI this month, with leaders urging tighter oversight of frontier systems because of national-security and cyber-risk concerns. Despite the high-profile gathering, no substantive agreement on international AI governance was reached, which highlights the difficulty of aligning regulatory approaches across borders.
Third-party supply chains remain the weakest link
Supply-chain exposure continues to dominate incident reports. The survey found that 62 percent of organisations experienced a cyber incident involving a vendor in the past year, making third-party risk the top concern for legal counsel.
Ransomware group Qilin added to the pressure, claiming two more Australian victims this month and cementing its reputation as one of the most active threat actors worldwide. This adds to a growing list of Australian organisations caught in the crosshairs of ransomware and extortion campaigns. It seems Qilin’s Australian tour is showing no signs of slowing down.
In parallel, the Australian Cyber Security Centre warned that North Korean-linked threat actors are impersonating recruiters and targeting IT professionals with fake job opportunities.
For many firms, the prevailing attitude remains reactive. The survey indicates that 59 percent of respondents believe a serious cyber incident would be required to trigger a meaningful shift toward stronger data-risk management. This mindset suggests that, despite growing awareness, organisations still wait for a catalyst before allocating resources to governance and resilience.
Privacy regulator’s dual focus
Recent activity from the Office of the Australian Information Commissioner highlighted two distinct tracks. One update detailed progress on an investigation stemming from the 2023 Latitude data breach, reminding readers that fallout from incidents can linger well beyond initial headlines.
A separate statement from the same regulator emphasized the potential of trusted government data to strengthen AI reliability, helping counter AI-generated misinformation.
Notable breach incidents and advisories
ShinyHunters claimed responsibility for a breach of FBI systems that allegedly exposed data relating to bureau employees. Shortly after, Dutch authorities announced the arrest of a suspected group member.
Quarterly Update and Recent Industry Engagements
The latest quarterly update has been released, exploring key developments shaping the cyber, privacy and AI environment. The next chapter conversation will feature Catherine Brenner and John Mullen, covering cyber incident response, communications, AI, governance and board simulations.
The firm served again as a Platinum Sponsor of The Australian Financial Review Cyber Summit in Sydney, providing networking with new and familiar faces. A panel discussion on boards, cyber risk and the rise of personal liability highlighted the event, featuring partner Cameron Whittfield.
The team authored an AFR op-ed on frontier AI, described as the biggest cyber-risk trend of 2026, urging organisations to maintain focus on fundamentals. To help readers keep pace, the organization compiled its “Essential Eight” cyber stories from the past month.
