Cybersecurity in a Shifting World: Key Trends and Stats for the 2024–2025 Financial Year

As we move through 2025, the cyber threat landscape remains shaped by ongoing global tensions and rapid tech change. The Australian Signals Directorate notes that “the Indo-Pacific continues to face entrenched strategic competition, Russia’s invasion of Ukraine has entered its third year and conflict continues to unfold in the Middle East,” driving an uptick in state-sponsored cyber operations (cyber.gov.au). Against this backdrop, Australian organisations face a complex mix of nation-state activity, cybercrime and emerging risks.

Key Trends in 2024–25 So Far

1. High volume of reports and incidents
   During FY 2023–24, ASD received over 36,700 calls to its Cyber Security Hotline (up 12 percent) and responded to more than 1,100 cyber security incidents. It also saw over 87,400 cybercrime reports via ReportCyber—an average of one report every six minutes (cyber.gov.au).
2. Ransomware remains pervasive
   66 percent of organisations reported ransomware incidents in 2023 (deloitte.com), and ASD found 11 percent of all incidents it responded to involved ransomware, a 3 percent increase on the year before (cyber.gov.au).
3. Credential abuse and social engineering
   Abuse of valid credentials accounted for 44.7 percent of breaches globally (deloitte.com). Meanwhile, 68 percent of breaches involved a non-malicious human element—falling for phishing, vishing or simple errors (dmarcian.com).
4. IoT malware and shadow data
   IoT malware attacks jumped 400 percent across industries in 2023, with manufacturing hardest hit (deloitte.com). And IBM found one in three breaches involved shadow data—untracked information stored across multiple environments (ibm.com).
5. Generative AI risks
   As gen AI projects proliferate, only 24 percent of initiatives are secured, exposing sensitive models and training data to potential breaches (ibm.com).
6. Supply chain and vulnerability exploits
   Third-party supplier compromises accounted for 15 percent of incidents (dmarcian.com), while publicly reported CVEs rose 31 percent in FY 2023–24, feeding exploit-based attacks (cyber.gov.au).

Geopolitical Impact on Cyber Threats

Ongoing conflicts continue to fuel state-sponsored espionage and destructive campaigns. In FY 2023–24, over 11 percent of ASD-responded incidents targeted critical infrastructure—highlighting adversaries’ aim to disrupt essential services (cyber.gov.au). Grey-zone operations, disinformation and pre-positioning on networks are now standard tactics.

Statistics: People & Social Engineering

• Human-centric risks: 68 percent of breaches involve a human element, whether via social engineering or simple mistakes (dmarcian.com).
• Pretexting dominance: Half of all social engineering attacks rely on pretexting—fabricating plausible scenarios to pressure victims into handing over data (rhisac.org).
• Initial access vectors: Phishing, stolen credentials and business email compromise remain the top gateways for intruders—underscoring the need for robust authentication and ongoing awareness training.

Other Emerging Threats

• Shadow IT expansion: One in three breaches now stems from shadow data, making it harder to secure all sensitive information (ibm.com).
• Cloud misconfigurations: Breaches in public cloud environments incur the highest average cost at USD 5.17 million (ibm.com).
• Supply chain compromises: Continuous vendor risk management is vital as attackers exploit third-party code and firmware to gain access.

Planning Your Security Roadmap

1. Assess & prioritise: Map assets, people, processes and likely attack paths in a tailored risk assessment.
2. Layered defences: Adopt the Essential Eight—regular patching, multi-factor authentication, application allowlisting and more.
3. Zero Trust mindset: Verify every user, device and connection, regardless of location.
4. Security awareness: Run phishing simulations, table-top exercises and executive briefings.
5. Automate & monitor: Leverage XDR, DSPM and AI-powered analytics for real-time threat detection.
6. Incident preparedness: Update playbooks, test your response plan regularly and maintain offline, encrypted backups.
7. Third-party oversight: Vet suppliers, enforce security baselines and scan for vulnerabilities continuously.

How Securitribe Can Help

Our SheepDog CISO approach is built for this evolving landscape. We offer:

• Virtual CISO & Advisory: Strategic planning, risk reporting and board-level insights.
• GRC & Compliance: Alignment to ISO 27001, ASD’s ISM, NIS 2 and privacy laws.
• Threat Detection & Response: 24/7 SOC-as-a-Service, dark web monitoring and rapid IR.
• Pentesting & DSPM: Proactive assessments, Concentric AI for data discovery and governance.
• Awareness & Training: Tailored programmes to strengthen your human firewall.

Security is not set-and-forget. Let’s work together under #SecurityTogether—reach out for a complimentary cyber health review and roadmap session.