Cohesity Finds Just 2% Of Australian Organisations Are Prepared For AI-Driven Cyberattacks

New research from Cohesity has found that only 2 per cent of Australian organisations believe their current recovery plans are equipped to withstand threats posed by frontier AI technologies.

The findings come from Cohesity’s 2026 Global Cyber Resilience Report, which surveyed 3,200 IT and security leaders across 12 countries. The research paints a picture of Australian organisations that are frequently targeted by cyberattacks but remain reliant on recovery plans that may not hold up under real-world conditions.

Four in five (80 per cent) Australian organisations experienced a material cyberattack in the past 12 months, compared to 73 per cent globally. More broadly, 95 per cent of Australian organisations report being impacted by a material cyberattack at some point.

Recovery plans built on assumptions

While almost every Australian organisation surveyed (99 per cent) has a cyber resilience strategy in place, the report suggests these strategies may not withstand the pressures of a live incident.

Among organisations that experienced an attack, 93 per cent still rely on recovery plans based on unproven assumptions, while 92 per cent believed they would need workarounds or improvisation to recover during an incident, compared with 88 per cent globally.

Recovery also took longer than expected. Some 87 per cent of Australian respondents reported taking longer to recover than planned – by about five hours on average – compared to 76 per cent globally. And 74 per cent found that more systems were affected than initially assessed, compared to 70 per cent globally.

The research found that most Australian organisations operate under a set of assumptions about how a cyberattack will unfold. These include that an attack will be contained before recovery begins (82 per cent), that dependencies will be understood (85 per cent), that recovery can proceed in a mostly linear sequence without significant backtracking (78 per cent), that decision makers will have adequate information (85 per cent) and that a trusted environment will be available to restart operations (84 per cent).

Over half of respondents reported gaps in their response and recovery plans. The most common gaps cited were skills and knowledge (70 per cent), managing identity and access with tools like Okta (67 per cent) and AI models, pipelines and workflow tools (65 per cent).

Minimum viable company planning still immature

The report highlights the growing relevance of a Minimum Viable Company (MVC) approach – a framework that identifies the minimum people, processes and technology required to keep essential business functions running during a disruption while broader recovery efforts are underway.

While 74 per cent of Australian organisations say they have identified the critical functions needed to operate during a disruption, just 20 per cent have both formally documented and tested an MVC plan, compared with 22 per cent globally.

Managing Director ANZ at Cohesity, James Eagleton, commented: “The challenge for leaders is no longer simply preventing an attack. It is ensuring the business can continue to operate and recover with confidence when an attack breaches the defences.”

“Australia’s focus on Minimum Viable Company planning is encouraging, but identifying critical operations is only the first step. Organisations must formally document and regularly test whether these plans can support the business under real-world attack conditions,” Eagleton added.

“That requires realistic resilience strategies as recovery is rarely straightforward – more systems may be affected than initially expected and leaders often need to make critical decisions with incomplete information.”

AI adoption outpacing visibility

The research also reveals a gap between the rate of AI adoption and the ability of organisations to secure and recover AI systems.

Almost half (47 per cent) of Australian organisations do not have a centralised inventory or clear understanding of the AI agents, copilots and workflows operating across their businesses.

Only two in five organisations (40 per cent) say their cyber response and recovery plans comprehensively account for scenarios targeting AI systems, workflows or models. Just 38 per cent are confident they could verify the integrity of AI models and associated data after an incident.

Confidence in operational AI resilience is also limited. Only 44 per cent of Australian organisations say they are prepared to detect and contain unintended or incorrect actions taken by AI agents, copilots or AI workflows and recover affected systems or data.

VP and CTO APJ at Cohesity, Greg Statton, noted: “AI can help organisations move faster and improve how they identify and respond to threats. But it also expands what they need to understand, secure and recover.”

“If a business cannot identify the AI systems and workflows it relies on or verify the integrity of the data and models behind them, it’s difficult to trust that the data after an incident is actually safe and clean – and ultimately, trusted AI depends on trusted data,” Statton added.

Research methodology

The fifth annual Cohesity Global Cyber Resilience Report was conducted in July 2026 by independent research firm, Vanson Bourne, on behalf of Cohesity. The study surveyed 3,200 IT and security leaders across Australia, Brazil, France, Germany, India, Japan, Singapore, South Korea, the United Arab Emirates, Saudi Arabia, the United Kingdom and the United States.

For the purposes of the survey, a material cyberattack was defined as an attack having a measurable financial, reputational, operational or customer churn impact on an organisation.

Last Updated on September 18, 2026 by Nick Ross