How Australian Financial Services Can Combat Evolving Cyber Risks

Written by Shaun Nesbitt | June 3, 2025

The Australian financial services industry holds a treasure trove of sensitive client data, making it an attractive target for cybercriminals. As the threat landscape continues to evolve, financial firms must stay vigilant to safeguard their operations and clients. In the first part of our two-part series, we explore the growing cyber threats and what they mean for the Australian financial services sector.

Understanding the Cyber Risk Landscape

Risk awareness is the first step to strengthen your cyber defences. Cyber threats are constantly evolving, with attackers becoming more sophisticated in their methods. Among the most pressing concerns are:

Ransomware Attacks remain a persistent threat that can cripple operations and result in significant financial losses.

Phishing Attacks are often disguised as legitimate emails or messages, tricking employees into revealing sensitive information.

Supply Chain Vulnerabilities are a growing concern, with cybercriminals increasingly targeting third-party vendors, exploiting their access to primary targets.

The Growing Threat in the Financial Sector

Figure 1: Source ACSC Annual Cyber Report 2023-2024

The Australian Cyber Security Centre (ACSC) Annual Cyber Threat Report consistently highlights the increasing frequency and severity of cyber incidents across all industries. The financial services sector remains one of the most targeted, with rising concerns for small and medium-sized businesses (SMBs).

Small businesses are often seen as easier targets due to perceived weaker security postures, but this assumption is dangerous. Financial services firms—whether large or small—handle highly sensitive client data, making it crucial to strengthen cyber resilience across the board.

Learning from Real-World Incidents: The Case of RI Advice

While many cyber incidents may not be publicly disclosed, we can learn from incidents in the broader financial sector. A noteworthy example is the RI Advice case, brought to light by ASIC. The Federal Court ruled that RI Advice lacked adequate cybersecurity risk management practices. In one instance, criminals were able to remain logged into a financial practice’s server for over 155 hours due to poor password practices. This case serves as a stark reminder that cybersecurity is not just an IT issue—it’s a core component of overall risk management.

Firms in the financial sector must remember that failing to implement robust cybersecurity measures can have legal and reputational consequences. Moreover, due diligence should extend to third-party providers, as they too can present significant risks to your network security.

Proactive Cybersecurity Measures for Financial Firms

The evolving threat landscape, coupled with regulatory scrutiny as demonstrated by the RI Advice case, demands a proactive and comprehensive approach to cybersecurity. To begin strengthening your defences, here are some initial recommendations:

Conduct a thorough risk assessment: Identify your firm’s most valuable assets and the potential threats they face.
Review cybersecurity policies and procedures:  Ensure your cybersecurity policies are up to date and aligned with industry best practices, such as the Essential 8 framework.
Provide regular cybersecurity training:  Employee error is a frequent vulnerability in the security chain. Regular training can help reduce human error.
Implement multi-factor authentication:  Adding an extra layer of security can significantly reduce the risk of unauthorized access.
Regularly update your systems:  Stay on top of security patches and system updates to prevent attacks exploiting known vulnerabilities.

Building a strong cyber defence requires ongoing effort. While these initial steps are essential, the journey towards robust cybersecurity requires a strategic, long-term commitment.

In Part 2 of this series, we will dive deeper into specific actions financial services firms can take to strengthen their security posture—exploring vulnerability management, data encryption, access control, and incident response planning.

Want to enhance your clients’ data security? Talk with us to learn how we can help strengthen your firm’s cybersecurity posture.

View full post