Cyber resilience enters its next phase

Cybersecurity is entering a new phase. Rapid advances in AI, geopolitical volatility and increasingly interconnected systems are reshaping both cyber risk and the capabilities organisations need to respond. 

The Australian findings show many of the same forces shaping the global cyber agenda — increasing investment, accelerating AI adoption and growing pressure to strengthen resilience. But they also reveal a distinctly Australian response. Organisations are placing particular emphasis on critical infrastructure resilience, supplier security and operational technology, while showing comparatively strong implementation of some enterprise data controls. 

AI presents a more uneven picture. It remains Australia's leading cyber investment priority, but Australian organisations are directing AI towards automation and operational efficiency more heavily than some front-line detection capabilities. At the same time, questions of reliability, accountability and explainability are constraining greater autonomy for AI agents. 

The opportunity for Australian leaders is to connect these capabilities: strengthening the foundations beneath AI, extending resilience across the enterprise and ensuring investment translates into trusted cyber capability. 

The 2027 Digital Trust Insights Survey captures the views of 3,934 business and technology leaders across 71 territories, including 128 Australian respondents, on the cybersecurity challenges and opportunities they expect over the next 12 months. 

Reliability and explainability are Australia's biggest barriers to adopting agentic AI cyber defence

Australian organisations identify reliability and maturity of AI technology (48%) and accountability, explainability and liability (47%) as their biggest barriers to increasing AI-agent autonomy. These are also the two leading barriers globally, showing that Australia's challenge is not simply adopting AI, but establishing sufficient trust and control to allow it to act.

Critical infrastructure resilience has moved to the front of Australia's geopolitical response

Half of Australian respondents are prioritising changes to critical infrastructure location, resilience and redundancy in response to the geopolitical landscape. At 50%, this ranks equal first in Australia, compared with fourth globally at 43%. Vendor and third-party supply-chain risk management is also selected by 50% of Australian respondents.

Supplier security is becoming more contractual

Australian organisations are putting greater emphasis on formal security requirements across their supply chains. 49% plan to tighten contractual security requirements over the next 12 months, compared with 39% globally. The measure ranks first among Australian respondents, versus fifth globally.

OT and IIoT exposure is firmly on the Australian risk radar 

41% of Australian respondents identify gaps in understanding their OT (Operational Technology) and IIoT (Industrial Internet of Things) cyber-risk exposure as a top challenge, compared with 34% globally. Australia also reports pressure around the skills and resources required to deliver OT and IIoT cybersecurity initiatives, cited by 32%.

Data protection is showing signs of maturity

More than half — 54% — of Australian organisations report having implemented data encryption, tokenisation and/or anonymisation capabilities at scale across the organisation. The equivalent global figure is 42%, putting Australia 12 percentage points higher on this measure.

AI leads cyber investment — but Australia's allocation is lower

AI remains the number-one cyber-budget investment priority for Australian respondents. However, 49% select it as a priority compared with 58% globally. The finding suggests AI has secured its place on the Australian cyber investment agenda, while the scale of prioritisation remains below the global result.

Australia's AI defence priorities differ from the global picture

Australian organisations place greater emphasis on SOC reporting (46% vs global 38%) and automated playbook execution (41% vs global 25%), while phishing detection and response receives less emphasis than globally with only 27% of Australian respondents prioritise AI for phishing detection and response, compared with the global 42%. The findings suggest Australia is leaning more heavily towards AI-enabled execution and operational efficiency than some front-line detection use cases.

Quantum planning has started — readiness remains the next test 

Only 5% of Australian respondents report that they have not started considering quantum-resistant security and have no plans to do so, half the global result of 10%. The finding suggests Australian organisations are engaging with the issue earlier, although starting the journey should not be confused with completing it. 

Cyber needs a more consistent place in board conversations 

Only 38% of Australian respondents strongly agree that cyber risk is a standing agenda item at their organisation's board, compared with 47% globally. Australian respondents also place relatively greater weight on industry benchmark and peer comparison when demonstrating cyber-risk reduction to leadership: 41% versus 33% globally. 

The 2027 findings show Australian organisations responding to geopolitical uncertainty through resilience, supply-chain controls and a sharper focus on critical infrastructure.

Half of Australian respondents say their cyber strategy is changing through adjustments to critical infrastructure location, resilience and redundancy. This is Australia's equal highest-ranked response to the geopolitical landscape, compared with fourth globally. Changes to vendor, third-party and supply-chain risk management are also selected by 50%. 

That attention carries into supplier relationships. 49% of Australian respondents plan to tighten contractual security requirements to manage supply-chain cyber risk, ten percentage points above the global result. 

Operational technology is another pressure point. 41% identify gaps in understanding OT and IIoT cyber-risk exposure as a challenge — Australia's highest-ranked response and 7 percentage points above the global figure. 

Together, these results show Australia's resilience agenda extending beyond traditional enterprise IT —across infrastructure, suppliers and operational environments — reinforcing the need to protect the systems on which business continuity increasingly depends. 
 

As AI becomes more deeply embedded across organisations, the security and quality of the data beneath it becomes increasingly important. Australian organisations report comparatively strong implementation of some enterprise data-risk controls, although maturity remains uneven across the seven measures surveyed. 

54% say data encryption, tokenisation and/or anonymisation capabilities at scale have been implemented across their organisation, compared with 42% globally. 

This provides an important foundation as organisations expand their use of AI, cloud and connected technologies. But resilience will increasingly depend on whether protection extends consistently across the entire data lifecycle — and into the systems and agents consuming that data.

83% of Australian security and finance leaders expect their cyber budgets to increase in 2027, almost identical to the global result of 84%. AI is Australia's leading investment priority, selected by 49% of respondents, although this sits below the global result of 58%. 

The question is therefore not simply whether Australia is spending more, but where that investment is being directed. Beyond cybersecurity, PwC's AI performance study explores how organisations can translate AI investment into business value by building the right foundations and scaling what works.

Within AI investment, Australia's priorities reveal a more distinctive picture. 40% are prioritising shadow AI detection and management, compared with 33% globally, moving this capability from fourth globally to second in Australia. 

The broader technology stack is also evolving in response to geopolitical concentration risk. In Australia, restricting data and technology access by geography or user location is a joint-highest priority at 47%. By contrast, 43% are adopting multi- or hybrid-cloud strategies to reduce single-vendor or single-jurisdiction lock-in, compared with 54% globally. 

AI is reshaping cybersecurity on both sides of the equation: creating new risks to secure while giving defenders new capabilities to respond. Australia's AI story is not simply one of adoption; the data reveals important differences in what organisations are asking AI to do. 

46% of Australian respondents prioritise AI for SOC reporting and dashboards, eight percentage points above the global result. 41% prioritise automated playbook execution, compared with only 25% globally. These capabilities can support faster workflows, greater consistency and reduced manual effort. 

Yet only 27% prioritise AI for phishing detection and response, compared with 42% globally. Australia therefore shows greater emphasis in the survey on AI-enabled execution and operational reporting than on this particular front-line detection capability. 

Autonomous agents add another dimension. The biggest barriers reported by Australian organisations to increasing AI-agent autonomy for security operations are reliability and maturity of current AI technology (48%) and accountability, explainability and liability concerns (47%). These are also the top two barriers globally. 

Managed services provide another pathway to strengthen cyber capabilities. AI is Australia’s leading managed-services priority, selected by 41% of respondents, although this trails the global result of 53%.

Australian priorities extend across foundational security capabilities, with cloud security, data protection and data trust, and network security and zero trust each selected by 38%. This points to broad demand for external support across complex, capability-intensive areas. 

92% of Australian organisations indicated that their organisation currently uses or plans to use managed services for cybersecurity over the next 12 months.

Quantum computing presents a longer-horizon security challenge, but one that requires action before cryptographically relevant quantum computers arrive. Migration can involve identifying cryptographic dependencies, understanding data lifetimes and building crypto-agility into technology transformation. 

The Australian results provide an encouraging starting signal. Only 5% of respondents say their organisation has not started considering quantum-resistant security measures and has no plans to do so, compared with 10% globally.

That does not mean Australian organisations are quantum ready. Rather, the finding indicates fewer organisations are entirely outside the planning process. The challenge now is turning awareness and exploration into prioritised implementation. 

For leaders, quantum readiness is therefore increasingly a question of sequencing: identifying where cryptographic dependencies create the greatest long-term exposure and using today's technology investment decisions to avoid creating tomorrow's migration problem.

The Australian results point to an important human dimension of cyber transformation. 

When asked which strategies they are prioritising to support cybersecurity talent development and retention, 63% of Australian respondents select providing growth opportunities. It is Australia's number-one priority and sits above the global result of 59%. 

At the same time, 45% are prioritising investment in AI-enabled tools and training people to work alongside them, compared with 53% globally. 46% prioritise supporting a strong cyber culture, versus 53% globally. This need to develop technical and human capabilities is also reflected in PwC's AI Jobs Barometer, which highlights growing demand for AI skills alongside judgement and creativity across the broader workforce.

Managed services are another part of the capability equation. AI is the highest-ranked area Australian respondents intend to prioritise for managed cyber services over the next 12 months, selected by 41%, followed by cloud security at 38%. Those priorities align with global rankings, although global selection is higher at 53% and 49% respectively. 

The leadership challenge sits alongside the talent challenge. Only 38% strongly agree cyber risk is a standing board agenda item. Building cyber capability therefore means more than adding technology or sourcing specialist expertise. It also requires stronger pathways between cyber teams, executive leadership and the board. 

Australia's 2027 findings tell a nuanced story. 

Organisations are taking tangible action around critical infrastructure, supplier security, enterprise data protection and emerging risks such as quantum computing. At the same time, the findings highlight opportunities to deepen board engagement, strengthen preparedness for AI-enabled threats and ensure AI investment reaches the areas of cyber defence where it can have the greatest impact. 

The next challenge is connecting these capabilities. Strong data foundations need to support trusted AI; investment needs to translate into effective defence; resilience needs to extend across infrastructure, suppliers and operations; and leadership and governance need to keep pace with technological change. 

The next phase of Australia's cyber journey is therefore not simply about adding more controls or technology. It is about bringing them together into a more integrated, trusted and adaptive approach to cyber resilience.