Reputational damage, financial loss and business interruption were seen as significant potential negative impacts of cyberattacks on organisations. In 2023, ASIC, the corporate regulator, added the risk of regulatory fines and penalties through its successful prosecution of a company who failed to take adequate steps to protect its systems and customer data from attack.
Insurance companies, investors, employees and customers are acutely aware of the risks cyber events present, and want to understand how systems and personal data are protected.
Company directors have duties to ensure that reasonable steps are taken to protect their organisations against losses caused by cyberattacks. The cybercriminals continue to evolve with the sophistication of their attacks, fueled by advancements in AI, requiring a continual improvement approach be adopted by cyber defences.
Cybersecurity is a specialist field, often outside the skill set and capability of internal IT teams. It's a whole-of-business problem that deserves appropriate resourcing, funding and oversight to adequately manage the risks for all organisations today.