The Insurance Council of Australia (ICA) is urging an expansion of business cybersecurity obligations, warning that AI-driven automated cyber-attacks and other emerging risks could undermine the cyber resilience of Australian businesses.
In its submission to the Department of Home Affairs’ Horizon 2 of Australia’s 2023–2030 Cyber Security Strategy, the ICA highlighted AI, quantum computing and consumer-managed personal data stores as critical vulnerabilities that could pose significant threats to Australia’s cybersecurity landscape.
Small and medium-sized businesses (SMBs) face distinct cybersecurity vulnerabilities, as technologies like automated malware make them particularly exposed to large-scale AI-driven attacks, unlike the targeted threats that typically affect larger enterprises, ICA reported.
The ICA’s submission calls for coordinated action between government and industry to bolster Australia’s digital defences, including:
- Technology Provider Accountability: Imposing greater obligations on developers of widely used off-the-shelf technologies, with a government-endorsed framework aimed at reducing the direct cybersecurity burden on SMBs.
- Workforce Development: Creating cross-sector placement programs to rotate cybersecurity professionals from government and large organisations through SMBs, building expertise and embedding sustainable cyber practices.
- Enhanced Ransomware Protection: Expanding ransomware reporting requirements to cover a wider range of entities.
ICA said insurers, together with government and large organisations, can help strengthen SMB cyber resilience by using existing touchpoints such as insurance policy renewals to reinforce consistent government cybersecurity messaging.