ASIC Calls for Enhanced Cyber Resilience in Australian Insurance Sector

ASIC Commissioner Simone Constant highlighted that the advent of advanced AI technologies has significantly transformed cyber threats, making them more sophisticated and challenging to counter. She urged insurers to proactively strengthen their cyber defences without awaiting further clarity on these emerging risks.

Recent incidents, such as the Qantas data breach in July 2025, which compromised nearly six million customer records, illustrate the critical importance of robust cyber security measures. This breach not only affected internal systems but also highlighted vulnerabilities in third-party partnerships, prompting regulators to intensify their focus on cyber risk management.

ASIC's directive includes several key recommendations for insurers:

• Reassess and update existing cyber security plans to address current and emerging threats.
• Implement comprehensive protection strategies for critical assets and minimise potential attack vectors.
• Ensure timely patching of systems to mitigate vulnerabilities.
• Adopt layered defence mechanisms to enhance overall security posture.
• Regularly review user access privileges to mitigate insider threats.
• Strengthen third-party risk management practices, given the interconnected nature of the insurance industry.

Furthermore, ASIC emphasised the importance of governance in cyber risk management. Boards are encouraged to demand tangible evidence of cyber resilience efforts, including test results, independent audits, and lessons learned from past incidents. This proactive approach is essential, as only a small percentage of organisations currently consider themselves fully prepared for AI deployment, with many struggling to keep pace with rapid technological advancements.

In conclusion, ASIC's call to action serves as a critical reminder for Australian insurers to prioritise cyber resilience. By addressing these challenges head-on, the industry can better protect itself and its customers from the escalating risks associated with AI-driven cyber threats.