Cybersecurity is no longer just an IT concern. According to the Australian Signals Directorate (ASD), cybercrime reports increased by 11% in the last year.
Large businesses reported a 219% rise in self-reported losses. That is more than triple the cost reported in the previous report. This makes cyber risk a financial risk. Finance teams need to treat it that way.
5 reasons finance must own the cyber risk response
The ASD’s 2024–25 Annual Cyber Threat Report outlines why the finance function is now on the front line. Below are the most urgent takeaways for CFOs, finance managers and AP leaders.
1. Costs are spiking, especially for large organisations
The cost of cyber incidents rose sharply across all sectors:
- Small businesses: $56,600 average cost (up 14%)
- Medium businesses: $97,200 (up 55%)
- Large businesses: $202,700 (up 219%)
These figures reflect direct operational and financial damage. For large organisations, the average cost has more than tripled year-on-year. This signals that attackers are shifting toward higher-value targets.
2. Threats are getting stealthier, not just louder
The ASD notes a continued rise in quiet, persistent threats such as:
- Living off the land (LOTL), where attackers use legitimate tools already inside your systems to move around undetected
- Credential reuse, when stolen passwords from unrelated breaches are used to access your systems
- Info-stealing malware, malicious software that silently captures logins, emails or banking data
These threats are harder to detect and often go unnoticed until financial damage occurs. Many are also amplified by generative AI.
Finance teams should operate with the assumption that compromise is already in progress. Every vendor and every payment must be verified before approval.
3. Critical infrastructure is under pressure
Critical infrastructure incidents rose 111% year-on-year, with over 190 notifications issued. The most common attack types were:
- Scanning and reconnaissance (41%), where attackers probe systems for weaknesses and map out vulnerabilities before a larger attack
- Denial of service (31%), a tactic that overwhelms systems with traffic and takes them offline
- Phishing (20%), where emails trick staff into revealing passwords or approving payments
Sectors like energy, telecom and healthcare are frequent targets. Many rely on complex vendor networks, which means third-party risk extends far beyond IT.
4. Generative AI is supercharging cybercrime
AI-driven phishing, deepfake audio and pretexting scams are scaling rapidly. The ASD warns that these tactics are reducing the skill barrier for attackers.
Every payment process should now be hardened against social engineering. That includes strengthening call-back procedures, sourcing supplier data from trusted sources and implementing real-time monitoring.
Want to test your team’s resilience? Take the deepfake quiz or explore the finance guide to deepfakes.
5. ASD's four big moves need finance's support
The ASD calls on Australian organisations to prioritise:
- Best-practice logging
- Replacing legacy IT systems
- Managing third-party risk
- Preparing for post-quantum cryptography
None of these can be achieved without funding, governance and cross-functional buy-in. Finance must play an active role in prioritising and resourcing these initiatives.
Vendor risk is a practical starting point.
What Eftsure recommends
Finance teams should adopt a "trust but verify" approach to payments. Eftsure helps finance and AP leaders:
- Verify vendor details before onboarding
- Monitor for changes in payment data
- Detect anomalies before money leaves your account
Cyber resilience is not just an IT project. It is a finance issue. Eftsure makes it easier to protect your organisation from preventable payment fraud.
Book a demo to see how Eftsure can help you validate every payment.
