Cyberattack - Global Storage

Cyber insurance in ANZ: Why compliance is your best ally

While you may think of cyber insurance as just one more thing to add to the “things we should do but probably don’t really need,’ now’s the time to think again.

Cybersecurity in Australia can no longer be considered “best practice” or an IT hygiene issue. It’s now directly linked to your legal, regulatory, and director obligations, with multiple regimes converging around risk management, incident reporting, and governance.

The 2025 Veeam Ransomware Trends Report says that 69% of organisations experienced at least one ransomware attack in the past year. And many were attacked multiple times. Which means that for the majority, cyber insurance could well be a financial lifesaver in times of crisis.

But insurers are no pushovers. They demand that you are genuinely doing your best (and can prove it) to protect your business and its data.

The hardline approach

As expected, cyber insurance is a rapidly growing market. Insurance Business Mag reported in late 2025 that sectors more vulnerable to attack (such as healthcare) may face higher premiums and more restrictive terms. And as AI plays an increasing role in cybercrime, insurers’ policies are likely to be further enhanced for all policyholders.

What’s important to note is that there’s no wriggle room in cyber insurance. Claim denial is real, and adherence requirements are strict.

If you think that ANZ organisations have it tough by global standards for cyber insurance, you’re right. When Arctic Wolf surveyed 400 cyber insurance brokers and carriers worldwide, they found that ANZ insurers require an average of six security controls to qualify for cyber insurance. The rest of the world only requires five.

Why are our controls more rigorous?

That same Arctic Wolf research mentioned early cites two key drivers for the demand for six controls:

We’re an attractive target: Organisations in Australia and New Zealand are 9% more likely to experience a significant cyberattack than the global average.
The penalties are high: High‑profile regional breaches and stronger regulatory expectations (e.g., Privacy Act, APRA CPS 234 influence)

Multiple independent reports also say that as well as our control number being higher than the global average, our insurers take a stricter approach to the depth of verification.

The widely reported trend in ANZ‑specific market analysis and broker commentary is that our underwriters are increasingly scanning external attack surfaces, validating MFA coverage depth, requesting evidence of EDR deployment and backup immutability and logging, and re-verifying controls at claim time.

The Essential Eight enforced?

While not a mandatory government requirement (although strongly advised), alignment with the Essential Eight is now being driven by our insurers.

Most now require controls that map directly to the Essential Eight maturity levels – and some won’t even provide quotes unless you can say ‘absolutely – yes!’ to the following questions – and partial implementation is often treated as non‑compliance:

Do you first use MFA across all cloud and remote access points?
Have you enforced application allowlisting?
Is your patching done within the recommended timeframes?
Do you have EDR (endpoint detection and response) on all your workstations and servers?
Do you do daily backups with offline or immutable copies?
Do you enforce user access reviews and privileged account controls?
Are your people supported and educated with security awareness training?

But it;s no use just being able to say ‘yes’ to these questions; insurers will often ask you to demonstrate that you have these controls in place.

And after several high-profile vendor-linked breaches here in Australia, they’re also throwing in questions about your supply chain risk: how you assess it, whether your vendors meet baseline security requirements, and what controls your managed IT provider enforces.

Lining up your cybersecurity ducks

Compliance is key not only to keeping your organisation safe but also to being eligible for cyber insurance, to start with, and even influencing your premiums.

The six security controls you must enforce to be compliant and insurance ready are:

Email security – preventing phishing, malware, and other malicious emails before they reach users.
Identity and access management (IAM) – enforcing strict control over who can access systems, applications, and data.
Multi‑Factor Authentication (MFA) – strengthening login security across all systems, with priority on remote access and privileged accounts.
Endpoint Detection and Response (EDR) – continuously monitoring endpoints (workstations and servers) to rapidly detect, contain, and stop threats.
Regular, secure backups – maintaining encrypted, tested backups that are isolated from the network to minimise ransomware impact.
Patch management – keeping operating systems and software up to date to address vulnerabilities before they can be exploited.

Insurers also consider advanced protections, such as 24/7 security operations centres (SOCs) and managed detection and response services, as highly impactful.

Resilience is better than regret

While it might not feel like it at the time, ensuring your cybersecurity controls meet insurers’ expectations and requirements also pays off for your organisation.

Your premiums are likely to be lower, and your diligence in maintaining and improving those controls in the face of high regional risk helps mature your security posture.

You have everything to gain, and nothing to lose.

AI. The great cloud optimiser.

Wondering how AI will transform cloud services? Here it is, from the horse’s mouth (Gartner):

“The adoption of AI within cloud services is poised to revolutionize IT operations, embedding AI as a fundamental element across everything from infrastructure management to application deployment.” ~ Dennis Smith, Distinguished VP Analyst, Gartner.

So, what could go wrong?

Why AI is driving up the cost of cloud

While AI-infused cloud services are set to revolutionise IT operations, this transformation will come at a high cost.

Gartner warns that not only will energy demands due to the need to handle AI requirements potentially increase by more than 300% in the next four years, but “by 2030, companies that fail to optimize the underlying AI compute environment will pay over 50% more than those that do.”

With Gartner additionally predicting that “over 80% of enterprises will deploy industry-specific AI agents in support of critical business objectives by 2023” (compared with less than 10% today), and that “more than 60% will conduct intensive AI model activity across multiple clouds”, the heat is on. But on whom?

The impact on data centres? A total overhaul of power and cooling infrastructures.

The impact on your organisation? The ongoing challenge of balancing the cost of AI workloads within a financial management framework. In other words, you’ll need to diligently measure the business value and ROI of AI-enabled cloud solutions to avoid overspending.

“Gartner predicts that by 2030, over 80% of enterprises will deploy industry-specific AI agents in support of critical business objectives, up from less than 10% today, and more than 60% will conduct intensive AI model activity across multiple clouds.

But on the other hand…

Adopting AI cloud services may have the potential to blow out your IT budget, but the good news is that AI-powered tools also have the superpower to slash it.

How? Let’s count (just some of) the ways.

AI-powered cloud management tools can reduce costs through several mechanisms:

1. Demand forecasting, right-sizing

Using AI, you can analyse your current versus historical cloud usage, seasonal patterns, and workload queues to proactively predict your future demand. With this information, you’ll always be able to provision just the right amount of resources. No more over-allocation and no waste!

That right-sizing can also be applied to your instances and services. AI can compare your actual utilisation (CPU, memory, I/O) to your instance sizes and recommend smaller or more appropriate types. Again, you can reduce expensive over-provisioning without hurting performance.

2. Leveraging discounts

Based on your forecasted usage, AI can also show you where you can get more value by maximising long-term discounts (via reserved and savings plans) and not making the mistake of underutilising them. AI can combine real-time telemetry with ML (machine learning) to scale resources up or down before demand spikes – so you never end up under-provisioning (and over-spending) during peaks.

And of course, you can automate all of this reporting and recommendations to reduce human input to reviewing and decision-making.

3. Opportunity hunting (for savings) and troubleshooting

AI tools can also save your organisation money and effort by spotting and pre-empting potential issues. For example, it can identify a workload that won’t be affected if you shift it to a cheaper spot – and schedule it.

AI can flag suspicious or unusual spend patterns (like sudden traffic increases) that can send costs spiralling if unchecked. You can set flags for a range of deviations so you’re warned in good time, and can immediately stop and remediate the activity.

In situations where you have high-spend areas, AI can identify the owner (s) and allocate costs per department. And it can spot and clean up those money wasters like idle databases, unattached volumes, unused snapshots, and stale backups. So you’ve got transparency of all the things you’re potentially paying for, but not using, and can put them under the financial microscope.

Why is this all so important?

27% of cloud spend is wasted, according to Flexera in their “2024 State of the Cloud Report,” 2024. And that’s something few organisations can afford.

In their 2025 report, Flexera report that 84% of respondents believe that managing cloud spend is the top cloud challenge for today’s organisations. Understandably, with cloud spend expected to increase by 28% in the coming year (2026), it’s apparent that many are rethinking their existing cloud cost management strategies.

While 87% of Flexera’s respondents name cost efficiency/savings as their #1 cloud goal, a focus on cost avoidance has gone from 28% (2024) to 64% (2025). Cost avoidance, of course, is the practice of not incurring preventable and unnecessary expenses in the first place – which is something that AI tools (notably AI-driven FinOp tools) excel at.

While the potential for cloud cost reduction and ROI varies across vendors and research agencies, what is clear is that AI and automation are critical enablers of such reductions.

As the journey to an AI-enabled workplace accelerates and we turn to AI to control the costs it generates as a byproduct, the old saying “Doctor, heal thyself” seems all too fitting – and an essential strategy for survival.

What are the best practices for building a resilient DR plan in 2026?

If there’s one thing we’re all hyperaware of these days, it’s that nothing is set and forget.

A new year typically signals that it’s time to review our disaster recovery (DR) processes, practices and technology. For most of us, it’s not because we ‘got it wrong’ last year, but because the pace of change means we need to re-evaluate what we got right, see what we can learn from others less fortunate, advances in technology, and what we can take on board and apply to our own organisations.

With a significant array of external forces – from cybercrime to floods to system failures – keeping us on our toes and second-guessing our own vulnerability, a near-enough DR plan isn’t nearly good enough.

Three key strategies to ensure business continuity

1. Make it (semi) permanent

An investment in immutable backups as part of your disaster recovery strategy will dramatically improve your organisation’s resilience.

You’ve likely already got backup under control with your 3-2-1-1 strategy. The 3-2-1-1, of course, refers to the best-practice approach of making three copies of your data, which you store on two different media: one copy off-site and the other a cloud-based, immutable or air-gapped backup.

It’s tweaking that last backup option that’s potentially a game-changer for your business.

If you’ve opted for air-gapped backups, then you’re relying on the practice of disconnecting your storage medium from your systems – it’s completely offline and safe from malware, viruses or ransomware. The only problem is that, even though it’s not connected to your network, a disgruntled admin or a malicious actor planted within your company can still sign in to the server and delete, corrupt, or encrypt your data.

Whereas, if you opt for immutable backup, you’re locking that data down. This approach uses write-once, read-many (WORM) policies or object-lock technology to make your data impervious to change. Yes, it can be accessed and read on demand, but it can’t ever be overwritten or altered – regardless of the user’s permissions.

The data lockdown period can be set (to say, 90 days), and at the end of that period, it’s unlocked, and your data is no longer immutable. While you can choose to lock it down permanently, since out-of-date data is generally of no use, it’s neither recommended nor necessary.

Some key benefits of immutable backups include:

Audit trails to show who accesses the data and controls to determine who can access it.
Your data is protected from ransomware or someone trying to make malicious changes.
You’ll always have clean, trustworthy data
The integrity of your data is guaranteed – no bit-rot (the slow, silent corruption of digital data over time), corruption or accidental overwrites
Ticks all the compliance boxes for immutability or retention requirements for a wide range of industry frameworks (HIPAA, etc.)
Easy and fast recovery with data that’s never corrupted and always ready to use
Reduced operational and human error risks with accidental deletion impossible
Lower costs with cloud-based immutable solutions

2. Set realistic targets, and stick to them

Your DR strategy should never reflect unrealistic and unachievable expectations. It should reflect realistic, appropriate RTOs (recovery time objectives) and RPOs (recovery point objectives) that together will protect your business and boost its resilience.

Here’s why – together – they’re important:

1. They protect your bottom line

Every minute of downtime counts. The inability to operate can lead to significant financial losses, especially for e-commerce, financial services, or SaaS companies. Lower RPO values mean you’ve lost less data between backups. And having no gaps in your data is critical for maintaining data integrity, meeting regulatory or compliance requirements, and retaining customer trust.

2. It’s all about balance (the right balance, that is)

The relationship between RTO/RPO and cost is exponential. If you want to achieve a near-zero target, then you need to make a significant investment in your infrastructure and resources. So, the key is finding targets that align with your actual real-world business needs (and budget) rather than pursuing goals that simply make you look good.

For example, you could consider a tiered approach where, for your mission-critical systems, you have an RTO of between one and four hours and an RPO of 15 minutes. Whereas for your non-critical systems, an RTO of 48 hours and RPO of 24 hours may be perfectly acceptable.

In terms of best practice, get the balance right by:

Carrying out a business impact analysis to determine your business’s actual (not imagined) tolerance for downtime and data loss
Base your targets on the requirements of your business, not just your IT capabilities
Test regularly to ensure your targets are achievable in real scenarios as well as on paper
Communicate the costs to your leadership team so they understand the trade-offs you’re recommending
Review your RTO/RPO annually (or if you’re going through a significant phase of change or growth)

The goal isn’t to have the most aggressive targets possible – few businesses can either afford them or even need them. As long as your targets are achievable and appropriate, you’ll still deliver operational resilience without breaking the bank.

3. Test, don’t guess

Thoughts and prayers are never enough if you’re planning to survive a cyberattack or a natural disaster. And guesswork is not your friend either.

What looks and sounds like best practice on paper doesn’t necessarily translate into a smooth, successful, and reliable recovery in real life. An untested disaster recovery plan is…a disaster waiting to happen when you can least afford it.

The roll over into a new year is the ideal time to put your current plan through its paces – and put theories to the test. Only testing will reveal if your disaster recovery plan has critical flaws, including:

Configuration errors in your backup systems or failover procedures
Documentation that’s out of date and doesn’t capture your current infrastructure
Overlooked dependencies between your systems
Not enough resources in terms of bandwidth or storage capacity
Team members who aren’t clear about their responses and responsibilities
System vulnerabilities that no one expected

It’s only by applying the lens of best practice and diligently testing your disaster recovery plan regularly that you can transform it into a reliable lifeline when disaster strikes.

What next?

If you’re even the slightest bit unsure whether those best laid plans will help you survive a disaster, then let’s chat. Improvement is always possible, and adding resilience is rarely regretted.

The dawn of a new era – AI vs. cybercrime

If you spend enough time reading cybersecurity headlines, you might be forgiven for thinking artificial intelligence (AI) is purely a weapon for the bad guys.

And to be fair, the statistics tell a clear story. Since the rise of generative AI, we’ve seen a staggering 1,200% global surge in phishing attacks.

It’s a topic we’ve covered before at Global Storage, specifically regarding how AI is shaping the future of cybersecurity risks. But focusing solely on AI as a threat vector ignores the other side of the coin. AI could also be the most potent shield we have.

For Australian technology decision-makers, the conversation is shifting from ‘how do we defend against AI?’ to ‘how do we use AI to defend ourselves?’

With 2026 projected to be a pivotal year for autonomous systems and digital sovereignty in our region, leveraging AI for breach response readiness isn’t just a competitive advantage – it’s fast becoming a regulatory necessity.

The autonomous shift in Australia and New Zealand

Change is happening at pace and has been for a while. But technology leaders anticipate that 2026 will bring a transition towards increasingly autonomous AI systems in Australia and New Zealand.

This goes beyond faster chatbots – it’s about creating systems that can reason, plan, and handle security tasks with minimal delay and little need for human intervention.

This shift coincides with stricter regulatory measures driving a stronger convergence between IT and security. In a world where digital sovereignty is a priority, organisations must prove they can detect and neutralise threats instantly, keeping Australian data safe on Australian shores.

Speed is the new compliance currency

Regulatory frameworks in Australia have teeth, and they operate on strict timelines. Consider the Security of Critical Infrastructure (SOCI) Act, which requires reporting significant impact incidents within 12 hours.

Or APRA CPS 234, which demands notification within 72 hours of a material incident.

In the second half of 2024 alone, the OAIC received 595 data breach notifications, with 69% caused by malicious attacks. While 66% of breaches were identified in less than 30 days, that timeline is nowhere near fast enough to meet a 12-hour or 72-hour reporting window.

This is where AI can become your compliance engine. Humans simply cannot sift through terabytes of log data fast enough to identify a patient zero event within 12 hours.

AI, however, excels at this. It enables predictive threat detection and automated response, ensuring that when you do notify the regulator, you have the full picture, not just a guess.

It’s no surprise that 93% of organisations indicate AI will influence their cybersecurity investment decisions over the next year.

Outsmarting the supercharged social engineer

The modern threat actor is no longer sending typo-riddled emails from a ‘prince in Nigeria’. They are using generative AI to create hyper-personalised, error-free campaigns.

Recent reports indicate that AI-powered spear phishing attacks now have a 47% success rate against trained security experts. A notable development is the rise of deepfake business email compromise (BEC). In one instance, a UK engineering firm lost USD $25 million after an employee was duped by a deepfake video conference that mimicked their CFO perfectly.

To embrace proactive cyber defence, we must fight fire with fire. Traditional signature-based detection (looking for known bad code) is useless against a unique, AI-generated email. We need AI-driven behavioural analysis. These tools establish a baseline of normal behaviour for your users – when they log in, what files they access, and how they write emails.

When an account suddenly deviates from that pattern (even if they have the correct password), the AI flags it instantly. It is the difference between finding a breach in 200 days versus 2 minutes.

The necessity of keeping a human in the loop

Despite the power of automation, AI is not a set-and-forget magic wand. It is a force multiplier, not a replacement for human judgment.

Arctic Wolf correctly notes that full automation without oversight is rarely advisable. AI models require fine-tuning to avoid false positives – you don’t want your automated response system quarantining your CEO’s laptop during a board meeting because they logged in from a new iPad.

There is also a trust gap to bridge. Interestingly, research shows that Australians and New Zealanders are ready for AI in critical sectors like emergency response, but only when they are aware of how it is being used. Trust increases significantly with awareness.

The same logic applies to your internal stakeholders. To leverage AI effectively for compliance, you need a strategy that blends algorithmic speed with human strategic oversight.

This ensures your defence is nuanced enough to understand business context, but fast enough to stop a machine-speed attack.

Moving beyond experimental AI

As we dive into 2026, AI in cybersecurity is moving beyond the experimental phase and into full operational maturity.

By integrating AI into your breach response strategy, you aren’t just ticking a box for the SOCI Act or APRA. You are building a resilient organisation capable of withstanding the next generation of threats.

SOC vs. MDR: Why your cyber strategy needs both to survive

In the world of cybersecurity, acronyms are everywhere. For tech decision-makers trying to prevent a breach, the distinction between these acronyms isn’t just semantics – it’s the difference between a secure network and a very expensive headache.

Two of the most commonly confused terms are MDR (Managed Detection and Response) and SOC (Security Operations Centre).

While they are often sold as interchangeable silver bullets, they are fundamentally different disciplines. Relying on one without the other is a bit like installing a high-tech alarm system but leaving your front door wide open.

To build true cyber resilience, you need to cut through the noise and understand why SOC and MDR are simply better together.

What is Managed Detection and Response (MDR)?

At its core, MDR is a service designed to hunt, investigate, and respond to threats. It is, by nature, reactive. It assumes that the ‘bad thing’ has already happened or is currently happening, and its job is to detect it, capture it, and respond to it.

Think of MDR as the digital equivalent of reviewing security footage after a break-in. You can see exactly how the intruder got in, what they touched, and where they went. It is vital for understanding the scope of an attack and remediating it, but it is often retrospective.

You can purchase off-the-shelf MDR solutions from vendors like Arctic Wolf or CrowdStrike. These tools are excellent at investigating incidents – answering the ‘what,’ ‘how,’ and ‘who’ of a breach.

However, according to the 2025 Security Operations Report from Arctic Wolf, attackers are increasingly launching their assaults during “off-business hours.” The report highlights that 51% of security alerts are now triggered outside of the standard workday, making continuous, 24×7 visibility across the entire IT environment an absolute necessity, not just a nice-to-have.

What is a Security Operations Centre (SOC)?

If MDR is the team reviewing the footage after the fact, then the SOC is the security guard watching the live monitors 24/7, patrolling the perimeter, and checking that the windows are locked before anyone tries to climb through.

A SOC is proactive. It scans your entire environment – looking at logs, traffic analysis, and telemetry data – to ask, ‘Where are our vulnerabilities?’ and ‘Is this behaviour normal?’

Unlike a standalone MDR tool that might flag a specific malware signature, a SOC looks at the bigger picture. It might notice an open port that shouldn’t be there or user behaviour that deviates slightly from the norm. It leverages SIEM (Security Information and Event Management) data to aggregate logs and identify patterns that a single lens of telemetry might miss..

The power of combining MDR and SOC

As mentioned, the belief that deploying an endpoint MDR agent provides total coverage is a risky misconception.

When you rely solely on MDR, you are often looking at the world through a limited perspective. You might see what’s happening on the endpoint, but you’re missing the network traffic, the cloud logs, and the identity management data. You are effectively blind to the ‘grey area’ activity that precedes an attack.

Conversely, a SOC without strong response capabilities can suffer from ‘analysis paralysis’ – identifying threats but lacking the tooling or authority to stop them instantly.

As noted in recent industry analysis, while MDR focuses on rapid detection and containment, a SOC provides the broader organisational oversight required to maintain a hardened security posture.

The most secure organisations don’t choose between MDR and SOC – they combine them to build a stronger defence. Here’s why this integration is essential:.

Clear insights
A SOC collects data from your entire infrastructure – firewalls, servers, cloud environments, and Intrusion Detection and Prevention System (IDPS). When you layer MDR on top of this, you give your ‘hunters’ a complete map of the terrain. They aren’t just seeing a virus alert – they are seeing the traffic that led to the download and the user account that authorised it.
Proactive and reactive mindset
You need someone checking the locks (SOC) and someone ready to tackle the intruder (MDR). A SOC ensures your environment is hardened against attacks by identifying vulnerabilities proactively. If a sophisticated actor does slip through, the MDR capability kicks in to contain the threat immediately.
Smarter threat containment
One of the critical advantages of a combined approach is the ability to take an endpoint offline safely. In a standalone scenario, isolating a critical server might cause more business disruption than the attack itself. With the telemetry and context provided by a SOC, an MDR team can make informed decisions about containment – cutting off the attacker without cutting off your business.

The verdict

The message is clear. To keep your data safe in a landscape populated by increasingly sophisticated threats, you need the proactive vigilance of a SOC combined with the reactive speed of MDR.

It’s not an ‘either/or’ decision. It’s about ensuring that when you leave the house, the doors are locked, the alarm is on, and someone is watching the cameras.

Beyond the firewall: Embrace proactive cyber defence

In the world of cybersecurity, the old saying ‘forewarned is forearmed’ has never been more relevant. Yet, too many organisations still operate on a ‘wait and see’ basis, only reacting to threats once the damage is done.

This traditional, reactionary approach is like installing a smoke detector but having no plan for an actual fire. It’s a strategy that’s becoming increasingly ineffective against the sophisticated and persistent nature of modern cyberattacks.

As cyber threats grow more sophisticated, cyberattacks have shifted from a potential threat to an unavoidable certainty. Despite massive global investment in cybersecurity, data breaches continue to be widespread.

The Veeam 2025 Ransomware Trends and Proactive Strategies report highlights this trend, showing that 94% of companies plan to increase their recovery budgets for 2025, and 95% are allocating more funds toward prevention.

The problem is, even with bigger budgets, many are still on the back foot. Instead, a proactive stance is essential for genuine cyber resilience.

Let’s explore what proactive threat detection involves and how your organisation can shift from merely reacting to threats to actively hunting them down before they can cause significant harm.

The overconfidence trap

It’s easy to believe you’re more prepared than you actually are. In fact, Veeam’s 2025 Risk to Resilience Report reveals a stark reality: while 69% of ransomware victims felt prepared before an attack, that confidence plummeted by over 20% after the incident.

This gap between perceived readiness and actual recovery capability highlights a critical flaw in many cybersecurity plans.

Waiting for an alert means the adversary is already inside your network. A proactive strategy, on the other hand, assumes that threats may have already bypassed initial defences and actively seeks them out.

This is the core principle of proactive threat detection.

From defence to offence: The role of threat hunting

Proactive threat detection involves a practice known as cyber threat hunting. Instead of waiting for automated security tools to flag a problem, threat hunting is the process of actively searching for cyber threats that are lurking undetected within a network.

Think of it as the difference between a security guard who only responds to alarms and one who actively patrols the premises, looking for anything out of the ordinary.

Threat hunters operate on the assumption that attackers may already be inside. They use their expertise, supported by advanced tools and threat intelligence, to uncover stealthy malicious actors who have slipped past initial defences.

These adversaries can remain hidden for months, quietly gathering data, escalating privileges, and preparing for a larger attack. Threat hunting is crucial for finding them before they succeed.

Adopting a Continuous Threat Exposure Management (CTEM) program

To operationalise proactive detection, organisations are turning to structured approaches like Continuous Threat Exposure Management (CTEM). Gartner defines CTEM as ‘a pragmatic and systemic approach that organisations can use to continually evaluate the accessibility, exposure, and exploitability of their digital and physical assets.’

Instead of just scanning infrastructure for vulnerabilities, a CTEM program aligns its focus with specific threat vectors or business projects.

This allows for a more realistic assessment of risk and helps prioritise remediation efforts where they matter most. It highlights both patchable vulnerabilities and unpatchable threats that require different mitigation strategies.

The potential impact is significant. Gartner predicts that by 2026, organisations that prioritise their security investments based on a CTEM program will experience a two-thirds reduction in breaches.

Security leaders must consistently oversee their hybrid digital environments to quickly identify and effectively prioritise vulnerabilities, strengthening the organisation’s defences against potential attacks.

Don’t forget the shared responsibility model

A common misconception, particularly with the widespread adoption of cloud services, is that the cloud provider handles all aspects of security. This is dangerously incorrect.

The shared responsibility model is a fundamental concept in cloud security that outlines the division of responsibilities between the cloud service provider (CSP) and the customer.

While the CSP is responsible for the security of the cloud (i.e., the underlying infrastructure), the customer is responsible for security in the cloud.

This includes securing your data, applications, access management, and network configurations.

People often assume that because their data is in the cloud, it’s automatically backed up and protected from all threats. It is not.

For example, with Microsoft 365, Microsoft ensures the service is running, but you are responsible for protecting your data from accidental deletion, internal threats, or ransomware attacks.

This is why having a robust, third-party backup and disaster recovery strategy is non-negotiable, even for cloud-based data. It’s a critical component of your proactive defence, ensuring you can recover your data no matter what happens.

Build a proactive defence today

Moving from a reactive to a proactive cybersecurity posture is a strategic shift that requires expertise, the right tools, and a deep understanding of the threat landscape.

Don’t wait for an attack to reveal the gaps in your defence. Take a proactive stance and build a security strategy that is as dynamic and relentless as the threats you face.

Fortify your defences against ransomware

Ransomware isn’t what it used to be – if it were a game, it’s evolved from an informal backyard sport into a gladiator-type contest. And with Australia now being the fourth most targeted nation for cyber threats on critical infrastructure, cybersecurity professionals have their work cut out for them.

An additional concern is the gap between perceived readiness and actual resilience. Many organisations feel prepared because they react quickly after an incident, but true cyber resilience means getting ahead of threats before they materialise.

According to the Veeam Ransomware Trends Report 2025, ransomware attacks are becoming faster, more sophisticated, and more painful for victims.

One interesting trend the report highlights is that the percentage of organisations impacted by ransomware attacks resulting in data encryption or exfiltration has dipped from 75% to 69%.

At first glance, this might feel like we’re winning a battle. However, the real takeaway is that organisations are stepping up their defence, understanding that the burden is squarely on their teams to adapt and fortify themselves with a cyber resilience strategy that delivers.

Paying ransom is a gamble – and often a losing one

One of the main shifts in the ransomware landscape is the growing hesitance among victims to pay ransom demands.

The data backs this up. Of organisations that paid ransoms, 17% still couldn’t recover their data, and 69% of paying victims found themselves targeted again.

Regulatory changes add to the pressure not to settle ransom demands. For example, mandatory reporting laws force organisations to disclose ransom payments, inviting both scrutiny and reputational risk.

Governments are sharing the same message – several countries, including the United States, now strongly discourage or even prohibit certain organisations from paying ransoms..

Brand damage and PR nightmares

Beyond the astronomical financial burden, being hit by ransomware has damaging ripple effects on a company’s reputation. A successful attack signals a failure to protect critical assets, undermining customer trust and confidence.

For IT decision-makers, this isn’t just a technical problem – it’s a brand problem. Operational downtime, lost productivity, and fines or lawsuits add insult to injury.

Building true cyber resilience

Organisations that recover successfully from ransomware attacks have one key factor in common: preparation. It’s not just about backups; it’s about building resilience into IT and security practices.

The Veeam report outlines a few key strategies that are proven to boost recovery success rates:

Develop an incident response plan: Define roles to eliminate delays during an attack.
Use the 3-2-1-1-0 backup strategy: Three copies of data, two media types, one offsite, one immutable, and zero errors.
Train teams: Human error is a major entry point – security awareness is essential.
Harden security: Adopt zero-trust, enforce access controls, and keep systems updated.
Invest in detection and recovery tools: Combine security tools with resilience features for stronger defence.

Prevention, not payment, must be the priority

For organisations ready to fortify against ransomware—and emerge victims no more—the Global Storage team is here to help. From tailored cyber resilience strategies to advanced disaster recovery plans, we specialise in keeping your data (and sanity) intact.

Ransomware may have changed the rules, but with the right preparation, you can still win the game.

Written in partnership with

How AI is shaping the future of cybersecurity

AI is revolutionising business at lightning speed – but are we ready for the risks it brings? Cybercriminals are already leveraging generative AI to craft phishing attacks that are nearly undetectable and to spread highly convincing disinformation.

Cybersecurity has entered a new era, and while adopting AI is no longer optional, the real challenge lies in doing so responsibly without compromising your organisation’s cyber resilience.

The stakes are high: 57% of organisations have limited their Generative AI (GenAI) rollout to low-risk users, and 40% have delayed deployment by three months or more due to data security and governance concerns.

GenAI is cybercrime’s new weapon

In their 2025 Global Threat Report, CrowdStrike highlights how GenAI has rapidly emerged as a preferred tool for cybercriminals, owing to its accessibility and ease of use.

In 2024, GenAI played a bigger role in cyberattacks, especially in social engineering and information operations. Cybercriminals used GenAI to create realistic, convincing content without needing much training or effort, making it perfect for spreading deception on a large scale.

For example, the North Korean group FAMOUS CHOLLIMA used GenAI to create fake LinkedIn profiles and trick recruiters, even using it to generate responses during interviews. Cybercriminals have also leveraged GenAI for financial scams. In 2024, cases included deepfake videos of executives used to steal millions of dollars and voice cloning to pull off business email compromise (BEC) schemes.

The connection between GenAI and social engineering is becoming clearer in malware trends. For example, GoldPickaxe, a mobile malware targeting biometric data, has been used in the Asia Pacific to create deepfake videos since late 2023.

On top of that, research shows LLMs are better than humans at crafting phishing emails, with much higher success rates. These trends highlight how GenAI is changing the threat landscape and why strong defences against its misuse are critical.

Top insights from Gartner’s AI risk report

Gartner’s latest Market Guide for AI Trust, Risk and Security Management also dives into the challenges of adopting AI without proper governance – scenarios that impact every facet of business, including data management.

Their findings highlight the importance of trust, risk, and security management (TRiSM) in AI systems (more about that later). For now, here is a summary of Gartner’s key findings:

Organisations face various risks when using AI, with top concerns including data breaches, risks from third-party systems, and inaccurate or harmful outputs.
While attacks targeting enterprise AI are still rare, incidents involving uncontrolled, harmful chatbots and internal data sharing issues are frequently reported.
Layered measures for managing AI TRiSM apply to all types of AI, including built-in, custom-built, and advanced autonomous systems. These measures work alongside traditional security technologies.
A new market is forming around AI governance and enforcement tools, with unique offerings specifically designed to address AI-related risks.
The demand for GenAI TRiSM tools is growing, drawing competition from vendors of all sizes. Some vendors focus on security and risk mitigation, while others prioritise ethical practices, safety, and meeting compliance requirements. However, no single solution currently addresses all AI risks and challenges.
Managing AI trust and security often highlights gaps between organisational teams, prompting them to work together across departments to find effective solutions.

How TRiSM is forecast to shape AI in business

Gartner’s Market Guide for AI TRiSM recommends proactively managing AI risks by establishing a TRiSM framework that ensures responsible AI adoption before deployment.

Their AI TRiSM model is built on four key layers of technical capabilities, supported by a foundational fifth layer that includes more conventional technology controls, like network, endpoint, and cloud security solutions.

Making up the top two layers of Gartner’s AI TRiSM framework are newer additions to the party: AI governance and runtime solutions. These two functions are merging to create a new market segment, designed to oversee AI interactions more effectively.

By combining AI inventory management and continuous evaluations with runtime inspection and enforcement, teams can perform real-time risk analysis of AI systems that tie back to a continuously updated risk-scored inventory.

This new category builds on the foundation of traditional tools found in the bottom layers of AI TRiSM, which focus on AI information and workloads.

Building cyber resilience for tomorrow

Looking ahead, it’s clear that the future of AI isn’t just about innovation – it’s about finding the sweet spot between moving fast and staying accountable. AI is evolving rapidly, bringing incredible opportunities, as well as big responsibilities.

Gartner predicts that by 2027, ‘AI TRiSM as a service’ will emerge as a viable outsourced option for organisations lacking resources to implement comprehensive AI TRiSM services internally.

Additionally, by 2028 they expect that 25% of large organisations will establish consolidated information governance teams – up from less than 1% in 2023.

These predictions highlight a critical reality: The organisations that thrive will be those that view AI risk management not as a barrier to innovation, but as an enabler of responsible, scalable AI adoption.

Cyber resilience: Why playing defence after the whistle won’t win

The latest ransomware statistics are sobering, but here’s the hard truth: if you’re waiting for an attack to happen before strengthening your defences, you’ve already lost.

Veeam’s 2025 Risk to Resilience Report reveals a stark reality. While 69% of ransomware victims believed they were prepared before being attacked, that confidence dropped by over 20% after the incident.

The gap between perceived readiness and actual resilience highlights a critical flaw: too many organisations treat cybersecurity as reactive instead of proactive.

Ransomware is a battle against time and tactics

Law enforcement took down major ransomware groups like LockBit and BlackCat in 2024. However, this has led to the rise of smaller, more agile threat actors. These groups operate with alarming efficiency, reducing dwell time—the period between compromise and attack execution—from weeks to mere hours.

In Q2 2024, two of the top three ransomware groups had average dwell times under 24 hours, leaving organisations little time to detect and respond.

Australia’s experience with data breaches highlights this urgency. The Office of the Australian Information Commissioner reports that the health, Australian government, and finance services are among the top sectors for data breaches.

These aren’t just numbers – they represent real organisations facing real consequences.

The ransom payment trap

Some organisations see paying ransoms as a quick fix, but the reality is far riskier. Of those who paid, 69% were attacked again, effectively funding future criminal activity while painting a target on themselves.

The approach to incident response matters too. Companies with expert incident response teams were far less likely to pay ransoms – just 25%, compared to organisations handling incidents internally, which were 156% more likely to pay.

This reflects the difference between panic-driven reactions and well-prepared strategies.

Beyond backup: building true resilience

Traditional backup methods, while essential, are no longer enough to combat modern ransomware. The Veeam report found that 89% of organisations had their backup repositories targeted during attacks, with 34% on average being modified or deleted.

Relying on outdated backup strategies is like bringing water pistols to a gunfight.

Effective organisations embed resilience into daily operations through key practices:

Immutable backups: Prevent attackers from altering recovery data. Only 32% of organisations use them, despite their reliability.
Sandbox restoration protocols: Ensure data integrity by testing in a secure environment before returning to production. Yet, only 28% do this, while 39% restore directly to production – a risky gamble.
Cross-team collaboration: Strong coordination between IT and security teams significantly improves outcomes, yet 52% of organisations need major improvements here.

Human expertise matters

Technology alone isn’t enough. Resilience also depends on human factors like clear chains of command, defined protocols for ransom decisions, and comprehensive training.

Only 30% of organisations have clear chains of command, and just 26% have formalised ransom payment decisions.

While 98% of organisations claimed to have playbooks, fewer than half included critical elements like backup verification or containment plans.

Having a plan isn’t enough – it has to be the right plan. And it should be in place before disaster strikes.

Making resilience your competitive advantage

Defending against ransomware can’t be an afterthought. Resilience must be a daily priority, built into your organisation’s operations. It’s about more than avoiding downtime or protecting data – it’s about maintaining trust in a world where cyber attacks can destroy customer confidence overnight.

True data resilience requires a mindset shift from reactive response to proactive defence. It demands investment in both technology and people, creating systems that assume compromise rather than hoping to prevent it.

The question isn’t whether your organisation will face a cyber attack – it’s whether you’ll be ready when it happens. In cybersecurity, as in most aspects of business, preparation separates the survivors from the statistics.

Written in partnership with

The art of damage control: Reducing cyberattack blast radius

Cyberattacks are no longer a hypothetical risk – they’re an inevitable reality. Despite significant global investments in cybersecurity, breaches continue to happen. In fact, 94% of organizations have increased their recovery budgets for 2025, while 95% have boosted their prevention spending, according to the Veeam From Risk to Resilience 2025 Ransomware Trends and Proactive Strategies report.

When attackers gain access, the severity of their impact depends greatly on how an organisation manages its data, access, and recovery strategies. This is where the concept of reducing the ‘blast radius’ of a cyberattack becomes invaluable.

Much like a controlled explosion to limit damage, thoughtful data governance and recovery planning can help businesses contain and minimise the harm of a breach.

How data organisation and access controls stop breaches

No organisation is immune to breaches – it’s not a matter of if, but when. What separates resilient companies from those caught unprepared is their approach to data organisation and access controls.

The more segmented, well-managed, and strategically isolated your data is, the harder it is for a breach to cascade into a full-blown disaster.

Start by ensuring that sensitive information is separated from less critical data. While it’s tempting to centralise everything for ‘ease of access’, poorly organised data is like leaving all the keys to your kingdom on a coffee table for anyone to grab.

Don’t hand hackers the opportunity to exploit sprawling, unchecked data repositories. By segmenting high-value data, regularly revalidating data significance, and removing outdated information, organisations can deny attackers a wider attack surface.

Equally, establish strong access controls. Implement a policy of least privilege, ensuring that individuals, applications, or systems have access only to the data they require – nothing more, nothing less. Regularly audit permissions to prevent lingering access paths that may be exploited.

And no, this isn’t paranoia – it’s prudence. The idea isn’t to become paranoid about attackers, but to accept the reality that robust precautionary measures can neutralise many threats before they escalate.

Zero Trust as a cyber resilience game-changer

A Zero Trust framework isn’t simply a buzzword – it’s a paradigm shift in how organisations handle security. At its core, Zero Trust assumes that every user, application, or device—even those within your network—could be malicious.

This flips the script on traditional perimeter-based defences, which fail to address internal threats or sophisticated breaches.

To truly limit the blast radius of a cyberattack, organisations should prioritise implementing a Zero Trust model for data management. Zero Trust enforces strict identity verification and continuous monitoring, ensuring that any movement within your environment is carefully scrutinised.

With the right technology solutions, it’s entirely possible to isolate users, devices, or workloads as soon as unusual activity is detected.

Yes, implementing Zero Trust can seem daunting. But when you weigh the costs of a data breach—regulatory fines, reputation damage, and operational downtime—the upfront investments seem like a bargain. Security isn’t just an IT issue – it’s a business resilience strategy.

Less data, less problems

Here’s some food for thought: the more data you have, the more it costs to manage, store, and recover. Sounds obvious, right? Yet shockingly, many organisations fail to address the consequences of ‘data hoarding’.

Not only does redundant or obsolete data drive up hosting and backup costs, but it also increases the footprint a hacker can exploit. Mismanaged or unnecessary data can become a liability, introducing compliance risk and further complicating disaster recovery.

Modernising your approach to data management means implementing data lifecycle policies and ensuring data governance practices are up to scratch.

Tech decision-makers should ask themselves two critical questions before backing up or securing any dataset:

Do we really need this data?
What would the cost be if it were breached or lost?

Adopting proper data retention policies is both fiscally and operationally savvy.

The myth of free cloud backup

One persistent misconception is that storing data in the cloud automatically means it’s backed up. Spoiler alert – it’s not.

Cloud providers operate on a shared responsibility model, where they manage the infrastructure, and you, the customer, are responsible for safeguarding your actual data. It’s a little like owning a safety deposit box at a bank – they protect the vault, but keeping the contents secure from negligence is squarely on you.

Many organisations fall victim to the false sense of security that data in the cloud is indestructible. The reality? Without proactive backup and disaster recovery strategies, cloud-based data is just as vulnerable to deletion, corruption, or theft as data stored on-premises.

Partnering with experts in disaster recovery services is critical to ensuring that the responsibility gaps are adequately addressed.

Turning breaches into blueprints for resilience

Every breach tells a story. For some organisations, it’s a cautionary tale of neglect. For others, it’s a demonstration of watertight planning and resilient recovery.

The ultimate takeaway? With strategic foresight and security-first practices, business leaders can significantly shrink the blast radius of cyberattacks. Cyber resilience isn’t just about preventing attackers from getting in. It’s about preparing for when they do.

Disaster Recovery as a Service

Backup as a Service

M365 Backup as a Service

SaaS Backup as a Service

Security as a Service

Security Operations Center as a Service

Data Governance Risk Compliance as a Service

Infrastructure as a Service

Public Cloud as a Service