The report reveals that Australian organisations are facing a new frontier of cyber risk, where traditional defences are being outpaced by the speed and sophistication of AI-driven threats.

“AI is no longer a future threat—it’s a present-day reality,” said Adam Peckman, head of risk consulting and cyber solutions in APAC and global head of cyber risk consulting at Aon. “We’re seeing relatively unsophisticated actors now wielding tools that rival state-sponsored capabilities. The barrier to entry has dropped dramatically, and the velocity of attacks is only increasing.”

One of the most concerning developments is the emergence of AI-powered social engineering attacks. Last year saw an incident involving the theft of USD $25 million from a large UK engineering firm through a deepfake-enabled scam—an attack that has since been replicated onshore in Australia at smaller financial scale. These incidents underscore the growing accessibility and replicability of such tactics.

In addition to AI threats, the report identifies technology supply chains as a critical vulnerability. A number of high-profile Australian breaches have stemmed from third-party compromises, where attackers exploit weaker security standards in vendors with privileged access to client systems.

“Organisations must start treating their vendors as part of their own attack surface,” added Joerg Schmitz, Cyber Risk Quantification and Analytics Leader for APAC at Aon. “The most lucrative attacks are those that can be scaled across multiple targets through a single compromised supplier. This is a wake-up call for Australian businesses to reassess how they manage third-party risk.”

Despite continued investment in cyber security, the report warns that core controls are being circumvented or rendered obsolete by evolving tactics. The use of AI to optimise every stage of the attack chain—from reconnaissance to execution—demands a fundamental rethink of defensive strategies.

Aon’s 2025 Cyber Risk Report draws on CyQu data from over 3,000 clients globally and analyses more than 1,400 cyber events to identify emerging trends. The platform enables organisations to benchmark their cyber maturity, align insurance and security strategies, and make more informed, data-driven decisions.

Aon’s 2025 Cyber Risk Report can be found here.

Hashtag: #Aon

The issuer is solely responsible for the content of this announcement.

About Aon

Aon plc (NYSE: AON) exists to shape decisions for the better — to protect and enrich the lives of people around the world. Through actionable analytic insight, globally integrated Risk Capital and Human Capital expertise, and locally relevant solutions, our colleagues provide clients in over 120 countries with the clarity and confidence to make better risk and people decisions that protect and grow their businesses.

Follow Aon on newsroom and sign up for news alerts here.