Senior cyber, risk, and business leaders gathered in Sydney on November 2, 2026, for a cyber crisis preparedness event co-hosted by QBE Insurance Group and crisis management platform CYGNVS.
The event, titled Leading through a Cyber Crisis, focused on the leadership decisions required during a major cyber incident. Attendees took part in panel discussions and a live crisis simulation.
QBE group chief executive officer Andrew Horton opened proceedings by framing cyber incidents as inevitable for most organisations.
“One of the realities of modern business is that cyber incidents are no longer rare events. For most organisations, it’s not a matter of if an incident will occur, but when,” Horton said.
“The organisations that respond best to cyber incidents are the ones that have invested in preparation, leadership and practice before a crisis occurs. Put simply, cyber resilience is built long before it is needed,” he added.
Read more: Australian businesses struggle to recover from cyberattacks as planned
The Australian Signals Directorate’s (ASD) Annual Cyber Threat Report 2024-25 recorded more than 84,700 cybercrime reports over the reporting period, an average of one every six minutes. The ASD responded to more than 1,200 cyber incidents, up 11% from the previous year.
The average self-reported cost of cybercrime across all business sizes reached $80,850 per incident, a 50% increase. Small businesses reported an average cost of $56,600 (up 14%), medium businesses $97,200 (up 55%), and large businesses $202,700 (up 219%).
Email compromise without financial loss accounted for 19% of business cybercrime reports, followed by business email compromise (BEC) fraud with financial loss at 15% and identity fraud at 11%.
The Office of the Australian Information Commissioner (OAIC) recorded 1,205 data breach notifications in 2025, the highest since the mandatory Notifiable Data Breaches scheme began in 2018 and an 8% year-on-year increase.
A Cohesity study published in September 2026 found that 80% of Australian organisations surveyed had experienced a material cyberattack in the past year, compared with 73% globally.
Of those attacked, 92% said their recovery required workarounds or improvisation, and 87% took longer to recover than expected. While 99% of respondents reported having a cyber resilience strategy, only 20% had formally documented and tested one.
That disconnect between planning and execution was a focus of the Sydney event. Arvind Parthasarathi, founder and chief executive officer of CYGNVS, led an interactive crisis simulation in which participants worked through a realistic incident scenario covering escalation, regulatory notification, and external communications.
“Exercises like these help organisations identify gaps, challenge assumptions and build that muscle memory, helping organisations turn business-critical incidents into business-as-usual,” Parthasarathi said.
Mike Wilkins, chair of Medibank and former QBE group board chair, also addressed attendees on leadership accountability and governance during high-pressure situations.
Read more: Cyber visibility high, recovery plans missing across Australia
Cyber insurance penetration in Australia remains low. The Australian Prudential Regulation Authority (APRA) recorded $32 million in cyber gross written premium in the March 2026 quarter, under 0.2% of total industry premium and covering roughly 6,000 risks. The Insurance Council of Australia (ICA) estimates around one in five small and medium enterprises hold cyber cover.
The Australian Institute of Criminology’s (AIC) Cybercrime in Australia 2025 report found that 25% of SME owners said cybercrime had affected their business in the prior 12 months.
Andrew Brett, director of Adelaide-based cyber insurance brokerage Infosure Insurance, has pointed to a persistent gap between client awareness and purchasing decisions.
“The same person who spends $17,000 on building insurance won’t spend $3,500 on a cyber policy,” Brett said.
With self-reported cyber costs up 50% and four in five Australian organisations reporting a material attack in the past year, the case for brokers to move cyber from an optional add-on to a core part of the risk conversation continues to build.
