Australian Securities and Investments Commission warns AI-driven cyber threats are entering a ‘new era’

Australian Securities and Investments Commission (ASIC) has issued an urgent warning to financial firms and licensed entities, calling for immediate action to strengthen cyber resilience as artificial intelligence rapidly accelerates cyber threats across the financial sector.

In an open letter addressed to industry participants, ASIC said frontier AI models are fundamentally reshaping the cyber risk landscape by increasing the speed, scale, and sophistication of attacks. The regulator warned that vulnerabilities once considered isolated can now be exploited far more easily, potentially triggering broader system-wide consequences.

ASIC Commissioner Simone Constant described the current environment as a turning point for cyber risk management, warning that firms should not treat cyber resilience as merely an IT issue, but as a core licensing and governance obligation.

The regulator stressed that firms should not wait for more advanced AI systems before acting. Instead, ASIC urged organisations to strengthen existing cyber security fundamentals, including governance, access controls, patch management, incident response planning, and third-party risk oversight.

Among the key concerns highlighted by ASIC is the growing ability of AI systems to rapidly identify and exploit vulnerabilities, lowering the barrier for malicious actors to launch sophisticated attacks. The regulator also pointed to increasing insider threats and warned that even basic phishing attempts can now become significantly more dangerous when combined with AI-enhanced tactics.

ASIC called on boards and senior executives to take direct responsibility for cyber preparedness, ensuring that cyber risk frameworks are proportionate to the evolving threat environment and supported by meaningful testing, audit findings, and independent validation.

The warning follows ASIC’s recent legal action against FIIG Securities Limited, which reinforced expectations that cyber risk controls must be demonstrably effective and aligned with the size and complexity of a business.

ASIC also encouraged firms to use guidance from the Australian Signals Directorate and highlighted the Australian Government’s Cyber Health Check program as part of broader efforts to improve cyber resilience across the financial system.

The regulator said it will continue working with domestic and international agencies to monitor emerging AI-related risks and strengthen cyber security expectations throughout the financial sector.