By Anthony Daniel, Managing Director, Australia, New Zealand and the Pacific Islands, WatchGuard Technologies
“This Cyber Security Awareness Month, the theme “Take a second. Stay secure.” is a timely reminder that a brief pause can interrupt an attack, but with threats evolving at unprecedented speeds, awareness alone is no longer enough.
For years, cyber security advice focused on familiar warning signs such as poorly written emails or suspicious links. Today, generative AI is helping attackers craft convincing messages, while stolen credentials can allow unauthorised entry through seemingly legitimate logins. At the same time, malware is becoming increasingly tailored to individual victims.
Media Partner
WatchGuard’s latest Internet Security Report found that 95.72% of Q2 endpoint threats appeared on just one machine, while novel endpoint malware rose 2,065% year-on-year. APAC also accounted for 50.33% of network malware detections per Firebox in the first half of 2026, roughly double the share recorded in either EMEA or the Americas.
For organisations across ANZ and the Pacific Islands the message is clear: security teams need to look beyond whether an email, link or login appears legitimate and focus on whether activity is behaving abnormally. Evolving attack methods must be treated as a local business priority.
Security must make the safe choice the easiest choice. Combine regular employee education with practical safeguards such as multi-factor authentication, strong identity controls, encrypted traffic inspection, layered network and endpoint protection, and continuous monitoring.
Cyber Security Awareness Month is a good opportunity to test where the gaps are. Use it to test one assumption your business has been making, whether that’s assuming MFA is enforced everywhere it should be, or that unusual account activity would be caught quickly, and fix what the test reveals.”
By Daniel Churches, Director Cybersecurity, Asia Pacific and Japan, DXC Technology
“Across the region, organisations are moving fast to become AI-native, deploying tools and agents to drive efficiency and competitive advantage. But as AI transforms how your business operates, security must evolve too.
Our recent research shows that only 47% of organisations have fully integrated governance for agentic AI, despite many rapidly deploying autonomous AI capabilities across the business. AI systems are now touching identities, data and decision-making at a scale and speed that traditional, human-paced security simply wasn’t built for. If governance and identity aren’t embedded from the outset of an AI transformation, organisations are effectively scaling risk as fast as they’re scaling capability.
This Cybersecurity Awareness Month, take a second to assess whether your security strategy is keeping pace with how your business is adopting AI. Organisations need to move beyond reactive defence towards intelligent, proactive and increasingly autonomous security, with governance, identity and trust embedded into AI initiatives from the start. This will enable organisations to scale AI adoption without compromising resilience or control.”
By Pat Breen, Head of ANZ, Cloudflare
“The conversation many customers are having right now is around mitigating the scaling cyber threat with the increased capabilities of AI models such as Astra and Fable being available. It’s a fair question, and the uplift in capability is real.
The fear of attackers finding flaws that nobody knew existed is not what is getting most Australian organisations breached right now.
We block an average 1.7 billion cyber threats per day targeting Australia, and that’s increased 16.7% in three months. The majority of those threats are automated attacks pointed at weaknesses we’ve known for years – reused passwords, unpatched systems, access that nobody has reviewed since the person left.
It’s important to understand: AI hasn’t changed the attack. It’s made it cheap enough to run the same attacks against everyone.
The assumption worth retiring is that you need a sophisticated defence for a sophisticated threat. Most attackers aren’t spending a breakthrough capability on you. They’re trying the front door with a password someone reused, and 63% of the logins we see use credentials that are known to have been compromised. It works often enough to be worth it.”
That’s why this year’s theme, ‘Don’t Make It Easy for Them’, is the right one. If I were advising a customer, I’d tell them the foundations still decide the outcome: know what you’re running, know where your data sits, know who has access to what. Strong, unique passwords. Multi-factor authentication wherever it’s available. Compromised credentials rotated quickly. Systems patched.
None of that is new advice. That’s the point.
Better tools just mean everyone gets tried. An attacker is working out whether you’re worth the effort, and the basics are what change the answer.
By Cynthia Lee, Vice President APAC at Delinea
This year’s Cybersecurity Awareness Month theme, ‘Don’t Make It Easy for Them’, is a reminder that attackers don’t always need to outsmart security controls. More often, they’re looking for gaps in oversight, particularly when it comes to access to sensitive systems and data.
As organisations adopt AI, automation and other productivity tools, they’re creating more ways to access information across the business. The challenge is to ensure security controls are in place to maintain accountability for access over time, and ensuring it remains appropriate as roles, technologies and business needs evolve.
Delinea’s latest Identity Security Report highlights why this matters. Only 42% of Australian IT leaders can always trace a sensitive AI access event back to a named human authoriser, while just 56% automatically revoke or expire access when a session ends. When organisations can’t confidently answer who approved access, who is using it, or whether it’s still needed, risk begins to accumulate.
Making it harder for attackers starts with closing those gaps. Organisations need a clear understanding of who, or what, can access critical resources, alongside the ability to continuously review, govern and remove access when it’s no longer required. The organisations best positioned to reduce risk will be those that treat access as something that must be actively managed, not simply granted and forgotten.”
