Cyber resilience fundamentals: what ASIC and APRA expect you to have right
ASIC's May 2026 open letter to licensees and market participants did not introduce new cyber expectations. Its message was more pointed than that: resilience depends on consistent execution of well-established controls, and in an environment where AI is accelerating both the speed and sophistication of cyber attacks, inconsistent execution of the basics is no longer a tolerable position. Boards and executives are being asked to evidence that the foundations are in place - not just to assert it.
The challenge
The cyber threat landscape has materially changed. AI is increasing the speed and scale of attacks, enabling more sophisticated phishing, accelerating vulnerability discovery and exploitation, and lowering the barrier to entry for a wider range of threat actors. Against this backdrop, ASIC observed that small weaknesses - which might previously have been manageable in isolation - can now be rapidly drawn together into a serious incident. The margin for inconsistency in cyber basics has effectively disappeared.
Key insights
Known vulnerabilities are still the primary attack vector - and they are being exploited faster
ASIC noted that too many cyber attacks succeed because known vulnerabilities are exploited. AI is accelerating vulnerability discovery on both sides - attackers are finding and exploiting gaps faster than many entities can remediate them. Patching and configuration management are not exciting governance topics, but they are where most incidents originate. ASIC expects timely patching, reduced attack surfaces and prioritised remediation - with governance structures that can make and execute those decisions at pace.
Identity and access management has not adapted to AI agents
APRA specifically observed that identity and access management capabilities have not yet adjusted to non-human actors such as AI agents. Where AI systems interact with enterprise platforms, access credentials, data stores and external services, the same rigour applied to human access must apply to these agents - or stronger. Privileged access management for agentic workflows is an emerging gap that entities need to address explicitly, not defer to the next technology refresh cycle.
Shadow AI use is a control failure, not just a cultural one
APRA observed that enterprise AI tools are being used by staff outside approved control frameworks. It also noted that preventative controls were frequently absent, with entities relying on policy direction or detective measures rather than enforceable technical restrictions. Policy alone is not a control. Where staff are using unapproved AI tools to process business data, the risk exposure is real and immediate. Entities need technical controls that enforce boundaries, not just policies that describe them.
Third-party and concentration risk must be actively managed
ASIC called out third-party risk management - particularly where services introduce concentration or systemic exposure - as an area requiring active attention. Where a cyber incident affects a commonly used platform or provider, multiple entities can be impacted simultaneously. Regulated entities need to understand their exposure to shared infrastructure, assess what a provider failure or compromise would mean for critical services, and maintain incident response plans that account for scenarios where a third party is the source of the incident.
Governance must be evidenced, not just asserted
ASIC's expectations for boards and senior executives are specific: understand your organisation's cyber position, ask the right questions, and be able to evidence the basis for your assurance. Governance that relies only on management assurances - without test results, audit findings, lessons from incidents or independent validation - will not withstand regulatory scrutiny. The distinction ASIC draws is between knowing that controls exist and being able to demonstrate that they are working effectively.
What this means for your organisation
Encompass supports regulated entities in assessing their cyber governance posture against the expectations ASIC and APRA have now made explicit. This includes reviewing board reporting quality, mapping control frameworks against current threat scenarios, and designing governance structures that can evidence effectiveness - not just intent. In a landscape where the basics are being tested harder than ever, having them demonstrably right is the minimum acceptable position.