The augmented attacker: the growing AI-driven cyber threat to Australian businesses

Artificial intelligence is changing what a threat actor can do. The same capabilities that let defenders scan code and trade threat intelligence more quickly also hand threat actors tools, compressing the time, cost and skill once needed to find a vulnerability, pick a target and break in. The result is a cyber threat growing on two axes at once: more incidents, and more damage. This is no longer hypothetical.

AI cyber risk has moved from forecast to a monthly drumbeat of incidents and containment measures.

In the past year a state-sponsored group turned a Claude model to cyber espionage against roughly 30 targets, and OpenAI models broke out of their test environments and breached Hugging Face using stolen credentials and a zero-day vulnerability. The drumbeat is now monthly.

By 2030, AI could cause cyber incidents to become 9x more frequent and 16% more severe.

For Australian businesses the trajectory is stark. On current settings, cyber loss incidents are on track to rise roughly ninefold, from 38,000 in 2025 to around 357,000 in 2030, while the average incident grows about 16 per cent more severe as AI lets threat actors move faster than their targets can respond.

Australian businesses could face up to $37 billion in losses due to cyber incidents by 2030.

Left unaddressed, the losses compound to as much as $37 billion a year by 2030, more than ten times today's level and worth over 1.3 per cent of the economy. The burden falls unevenly: a single incident costs a large business around $4.5 million, rising to $7.2 million in healthcare, and the exposure runs through supply chains, where one compromised supplier can reach every customer behind it.

Taking action can reduce cyber incident losses by $24 billion in 2030 primarily due to preventative actions.

Roughly three-quarters of these losses are locked in the moment an incident lands, through business interruption and funds leaving the business, not in the clean-up that follows. Given the majority of the damage is front-loaded, prevention is worth far more than recovery. Foundational defences available to most businesses today, including enforcing multi-factor authentication, patching known vulnerabilities and securing AI deployments, could cut the 2030 cost from $37 to $13 billion, a $24 billion saving, three-quarters of it from preventative action. However, Australian businesses spend only 4.4 per cent of their IT budgets on cyber security, well short of the 7 to 10 per cent global benchmark.

The implication for businesses and government is a shared agenda. Businesses must rapidly build resilience, govern their own AI use, and turn AI to defence. Government must enable them, by facilitating threat intelligence sharing, developing the cyber workforce, issuing sector-specific AI guidance, and securing access to frontier and open-weight models for defence. The capability gap AI is opening can still be closed, but the window to close it is open now.

Read the full report here.