The Importance Of Organisational Resilience In The Context Of AI-Led Changes

Australian organisations are using advanced artificial intelligence (AI) models to strengthen cybersecurity, which reflects a broader shift taking place across the cybersecurity industry. As organisations increasingly adopt AI to improve security outcomes, attention is turning to a more pressing question than productivity: resilience.

Guidance recently published by the Five Eyes intelligence alliance recommends that organisations prioritise resilience before productivity when adopting agentic AI.(1) The recommendation reflects growing concern that AI capabilities are advancing faster than many organisations can govern and secure them.

While the underlying principles of cybersecurity remain largely unchanged, the speed at which threats can emerge is increasing significantly. Activities that once required significant expertise, time and resources can now be performed at machine speed.

Jon Spokes, Senior Director Cyber Advisory, LevelBlue, said, “From a threat perspective, this is changing the meantime to exploiting a vulnerability, which is now almost immediate depending on the attacker. This is the challenge that organisations defending themselves are now facing.”

The implications extend beyond speed alone. Frontier AI models are reducing the cost and effort required to identify vulnerabilities and automate complex attack techniques. This exacerbates an already asymmetric environment where attackers can scale capabilities more quickly than traditional defensive processes can adapt.

Jon Spokes said, “The concern for organisations is not just the speed of attacks; it is the collapsing of cost to identify and exploit vulnerabilities. In other words, it’s cheaper and easier than ever for malicious actors to launch successful cyberattacks.”

As AI capabilities become more accessible, organisations face growing pressure to rethink how cyber risk is managed. Traditional approaches centred primarily on prevention may no longer be sufficient in an environment where exploit timelines continue to shrink. Instead, resilience is becoming a critical priority.

Cyber resilience extends beyond technology. It encompasses an organisation’s ability to prepare for disruption, respond effectively and recover quickly when incidents occur. As cyber and operational environments become increasingly interconnected, resilience is emerging as a business issue rather than solely a security issue.

Jon Spokes said, “Cybersecurity is often viewed as a technology issue; however, resilience is fundamentally about business continuity.

“This shift is particularly important as organisations face growing volumes of vulnerabilities, increasing threat activity and greater complexity across digital environments. Existing prioritisation models are already under pressure, making it harder for security teams to determine which risks require immediate attention.”

As a result, organisations may need to place greater emphasis on detection, response and recovery capabilities alongside traditional preventative controls. Faster identification of threats, stronger incident response planning and improved recovery processes can all help reduce the operational impact of cyber incidents.

Reducing reaction time is becoming one of the defining measures of resilience. AI itself is likely to play an important role in achieving this outcome, helping security teams analyse growing volumes of data and identify threats more quickly. However, technology alone is unlikely to solve the problem.

Governance, visibility and accountability remain essential. As AI systems become embedded across organisations, leaders will need a clearer understanding of how these technologies are being used, what access they have and how associated risks are being managed.

The organisations most prepared for the next phase of AI adoption may not be those that pursue productivity gains first. Instead, they are likely to be those that strengthen resilience, reduce reaction times and build the governance required to operate confidently in a rapidly changing threat environment.

Jon Spokes said, “Ultimately, it’s this pace of change that organisations need to accept along with the requirement to communicate why they need to do things differently.”

Last Updated on June 15, 2026 by Nick Ross