Suncorp says people remain its strongest defence against cyber threats, even as artificial intelligence makes attacks harder to spot.
Keith Howard, the insurer’s executive general manager for cyber security and risk, made the case in an article published for Cyber Security Action Month. He said the biggest effect of AI is not only the volume of threats but how convincing and authentic they can look.
Suncorp said scam messages, fake websites and impersonation attempts increasingly resemble legitimate communications. It said this makes cyber security a human challenge as well as a technology one.
“AI is creating opportunities, but it’s also enabling attacks that are faster, more targeted and increasingly difficult to identify,” Howard said. “The challenge is no longer simply recognising familiar warning signs. It’s helping people and systems respond effectively when those signs are less obvious.”
Howard said AI is also changing how organisations defend themselves. “Used responsibly, AI can help identify potential threats earlier, detect patterns that humans might miss, and support faster responses when incidents occur,” he said. “The organisations that succeed will be those that combine technology with strong governance, human expertise, and a commitment to continuous learning.”
Suncorp has been expanding its own use of AI. The insurer announced a five-year partnership with Microsoft to expand AI and cloud use in its operations after a December 2024 announcement.
Suncorp listed four everyday steps: turn on multi-factor authentication, use a unique passphrase for every account, keep software updated, and review privacy settings. It said multi-factor authentication can help stop unauthorised access even if a password is compromised. For customers, it said safer habits can be as simple as pausing before clicking a link or sharing personal information.
“Take a second. Stay secure.” is the theme of this year’s campaign, which the National Office of Cyber Security leads. The government’s cyber.gov.au site recommends organisations prepare for AI-enabled cyber threats and choose secure-by-design products.
Scam figures point to the same mix of progress and risk. Information Age reported in August that Scamwatch received 91,767 reports in the first half of 2026, with $156.6 million lost. Another 30,783 victims reported $397.5 million in losses through ReportCyber, bringing the total to $554.1 million.
The publication said reports fell 11% while losses rose 1%. It said this suggests more people are avoiding scams but some are losing more to elaborate ones, many shaped with generative AI.
Meridian Lawyers said in early September that human error remains a significant contributor to cyber incidents and data breaches in Australia, and that criminals often rely on speed, distraction and pressure.
For brokers advising on cyber cover, the same themes show up in policy wordings. Insurance Business reported that many Australian policies exclude losses from business email compromise or invoice fraud where no system was compromised, with social engineering cover often sold as an optional add-on.
In a separate roundtable summary, one cyber underwriter advised brokers to scrutinise computer crime wordings so cover extends to reverse social engineering, invoice manipulation and loss of third-party funds.
Allianz’s 2026 Risk Barometer ranks AI as Australia’s top business risk, ahead of cyber incidents in second place.
Insurer expectations may also line up with Suncorp’s checklist. UpCover said baseline expectations now include multi-factor authentication across email and remote access, tested offline backups and evidence of staff training on phishing and social engineering.
Suncorp noted technology alone cannot build resilience. It said advanced security, informed decision-making and simple everyday habits together remain among the most effective defences against cyber crime.
