The AI cyber divide

AI is reducing the time available to act

AI is changing the pace of cyber security.

Organisations are applying AI to improve productivity, support faster decisions and create new opportunities. Threat actors can draw on the same technology to conduct research, scale social engineering and identify potential targets more efficiently.

This is creating a divide. Some organisations are strengthening their ability to understand exposure and respond quickly. Others are adopting AI faster than their security, governance and operational arrangements can adapt.

For Australian organisations, the question is not simply how quickly AI can be adopted. It’s whether cyber security and resilience arrangements can keep pace as AI becomes embedded in business processes, supplier platforms and critical services.

AI is not changing the purpose of cyber security. It’s reducing the time available to act.

Build security in early

Many organisations continue to manage cyber security as a technology responsibility and AI as an innovation initiative. That separation becomes difficult to sustain when AI influences customer interactions, internal processes, supply chains and business decisions.

Cyber security, privacy and risk teams need to be involved early enough to influence how AI is designed, procured and introduced. When these considerations are left until the end of an initiative, weaknesses may already be embedded in systems, data flows and supplier arrangements.

This does not mean subjecting every AI initiative to the same level of scrutiny. Lower-risk applications should be able to progress through a more streamlined process. Stronger oversight should apply where AI affects sensitive information, critical operations or consequential decisions.

If these questions cannot be answered, the organisation may be moving faster than it can govern effectively.

Protect human and machine access

Employees and contractors are no longer the only identities accessing digital environments.

Service accounts, automated processes, application programming interfaces, AI assistants and external platforms can all connect to systems and information. Some may hold access privileges comparable to employees but receive much less ongoing review.

As AI adoption expands, organisations need visibility over both human and non-human access. They should understand what each identity can access, why the access is required and whether it remains appropriate.

This requires more than an initial approval. Access can accumulate as systems evolve, employees change roles and business processes become more connected. Accounts and integrations that were once necessary may remain active after their original purpose has changed.

Identity governance should cover the complete lifecycle of employees, suppliers, applications and automated services. Organisations cannot protect sensitive information without knowing who or what can access it.

Use AI with clear guardrails

AI can also strengthen an organisation’s cyber security capability.

It can help security teams correlate information, prioritise alerts and accelerate investigations. This may allow teams to focus their attention on the incidents and exposures most likely to affect the organisation.

However, automation needs clear boundaries. The consequences of an incorrect recommendation are different from those of an automated action that disrupts customer services, blocks legitimate activity or changes access to a critical system.

Organisations should define where human judgement remains necessary, particularly when an action could have a material business impact. They should also test whether AI-supported decisions are accurate, reliable and operating within the organisation’s risk appetite.

The goal is to combine the speed of technology with accountable human judgement.

Prepare for faster disruption

As organisations embed AI in critical services, workplace tools and supplier platforms, failures can quickly affect decisions and operations. Disruption may arise from compromised systems, unreliable data, unexpected automated actions or an external provider outage.

Risk and resilience planning should reflect these dependencies. Organisations need to understand which critical services rely on AI, what alternatives are available and who can intervene when a system is not performing as expected. These assumptions should be tested through exercises that show whether the organisation can identify the issue, make timely decisions and maintain essential operations. Scenarios could include:

• Loss of an important AI-enabled service
• Sensitive information shared with an external platform
• An unreliable or compromised automated decision
• Misuse of a privileged machine identity
• Disruption involving a critical technology provider.

Preparedness means identifying problems early, limiting their impact and maintaining essential operations.

Seven priorities for preparedness

For Australian organisations, AI is becoming embedded across business processes, workplace tools and supplier platforms. The priority is to understand which systems, information, identities and third parties support critical services, then focus on the exposures most likely to disrupt operations.

Priority	Action and outcome
1. Map the AI environment	Map AI systems, suppliers, data sources, integrations and machine identities to identify those presenting the greatest exposure to critical services and sensitive information.
2. Assign accountable owners	Define business, technology, data and risk ownership to establish clear decision rights, responsibilities and escalation pathways.
3. Apply proportionate oversight	Match governance to risk so lower-risk initiatives can progress efficiently while higher-impact areas receive stronger oversight.
4. Protect identities and data	Apply appropriate authentication, access, logging and lifecycle controls across employees, suppliers, applications and automated services to reduce unauthorised access to systems and sensitive information.
5. Strengthen defence with AI	Apply AI to strengthen security monitoring through improved threat detection, alert prioritisation and investigation, while retaining human judgement for decisions that may materially affect the business.
6. Test under realistic conditions	Test response arrangements through scenarios involving unavailable AI services, compromised systems, unreliable automated decisions, supplier outages and misuse of privileged machine identities.
7. Measure what matters	Track material exposure, control effectiveness and response capability to demonstrate that risk is reducing and operational preparedness is improving.

 

As AI adoption expands, Australian organisations should apply these priorities according to their risk profile, with clear ownership and measurable action demonstrating reduced exposure and improved preparedness.

Awareness must lead to preparedness

Cyber Security Awareness Month reminds us that understanding emerging threats is only the starting point.

AI is accelerating innovation, decision-making and service delivery across Australian organisations, while also increasing the speed and scale of some cyber threats. Existing weaknesses in access, data governance, supplier management and incident response may therefore become more consequential as adoption expands.

Organisations should begin with what matters most: critical services, sensitive information, significant suppliers and identities with privileged access. They should then test whether their security and recovery arrangements remain effective under realistic pressure.

The organisations best positioned to benefit from AI will not necessarily be those that adopt it first. They will be those that understand their exposure, apply appropriate safeguards and are prepared to respond when something does not go as planned.

Awareness is the starting point. Preparedness is what enables organisations to keep pace.

Our cyber security team helps organisations understand AI-related exposure, strengthen risk and resilience arrangements, and embed cyber considerations into technology initiatives and strategic decision-making.