Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Frontier AI has handed attackers something they have never had before: the ability to move at machine speed. Attacks that once took days to craft now take minutes. Threats have not just evolved to be automated, adaptive, and operational around the clock. They have also changed category. We surveyed more than 850 IT and cybersecurity professionals across Australia and New Zealand to understand how organisations are keeping up. What the data reveals is not a capability problem. It is a pace problem.

A mid-sized SOC can have endpoint telemetry in one platform, cloud logs in another, vulnerability findings in a third, and identity alerts somewhere else entirely. Analysts switch consoles, normalize the same event repeatedly, and still miss the incident that required context from several systems. The problem usually isn't a lack of detection technology. It's the absence of a shared data model, disciplined correlation, and evidence that security and compliance teams can use together.

83% of organizations reported moderate or major delays from manual compliance work in 2026, while 53% said one full-time employee's worth of effort is spent on evidence collection, according to the 2026 State of Continuous Compliance Monitoring report. Those figures describe the operational problem more accurately than another promise of an audit-ready dashboard.

Insider threat models have historically had one thing in common: somewhere in the chain, there is a person. That person may be malicious or negligent. Their credentials may have been compromised. Their actions may be intentional or accidental. But there is still a human principal at the center of the risk. Agentic AI is beginning to challenge that assumption.

Enterprises missed 60% of incidents because their existing tools produced no high-confidence alerts, according to Kaspersky's 2025 compromise-assessment findings. An indicator of compromise is useful, but static matching alone won't reliably reveal an attacker who has learned how to blend into normal activity.

A SOC analyst starts a shift with a queue full of alerts. The first few investigations reveal repeated authentication failures from the same service account, blocked network scans from a known internal scanner, and endpoint events that three different sensors reported separately. Somewhere in that queue may be a real compromise, but the analyst has to work through the noise before finding it.

The most popular advice about living off the land attacks is also the least useful when it stands alone: hunt for suspicious PowerShell, block LOLBins, and alert whenever a signed Microsoft binary behaves unexpectedly. Those controls have value, but they don't solve the operational problem. PowerShell, WMI, certutil.exe, and bitsadmin.exe are legitimate administrative utilities, and attackers abuse them precisely because security teams can't remove them without disrupting normal work.

Adversaries are using AI to launch cyber attacks in record time, forcing security teams to measure responses in minutes instead of months. Phishing campaigns built with large language models (LLMs) achieve click-through rates 4.5 times higher than traditional methods,1 and the average time between initial compromise and lateral movement has fallen to just 29 minutes.2 This is a 65% increase from the prior year.2 State and local governments and higher education institutions are at an inflection point.