For years, enterprise cybersecurity has been defined by an inventory mindset: What tools do you own? Which compliance boxes are checked? How many layers sit on your perimeter? Today, with cyber disruption across the global 2000 companies reaching an estimated $600 billion in annual downtime costs (with roughly one in three incidents tied directly to cybersecurity failures, according to Splunk’s Hidden Costs of Downtime report), that approach is fundamentally breaking down.
The critical question for technology leaders has shifted from “Are you ready to defend?” (measuring what you own) to “Can you actually defend?” (measuring what you can do in real time).
This week, Cisco released the Relentless Defence Report 2026, which surveyed 8,000 security and IT practitioners across 30 global markets (including 300 in Australia). Rather than measuring theoretical readiness, this study evaluates operational execution across three practical dimensions: coverage (what you protect), speed (how fast you act), and friction (the internal organisational hurdles that get in the way).
The findings reveal an urgent reality: 93% of Australian organisations experienced a material, business-disrupting incident in the past 12 months, with over a third (37%) involving an AI-enhanced attack. Yet when we look at the top tier of resilient organisations globally, an elite 8% whom we define as ‘Relentless Defenders’ (representing just 5% in Australia), they are distinguished not by bigger budgets, but by how ruthlessly they eliminate internal friction.
Here are the key takeaways from the research and what they mean for technology leaders navigating the AI era:
The Biggest Threat to Security May Be Your Own Organisation
When we asked practitioners what single change would make the biggest difference during an active incident, the answers weren’t about buying another tool. They pointed overwhelmingly to optimising internal operations: speeding up approvals, removing silos, cleaning data, unifying visibility, and improving cross-team collaboration.
In Australia, that operational friction is actively undermining defence:
- Team silos: Over half of Australian organisations (54%) do not operate as a single coordinated team across SecOps, NetOps, and IT with shared tooling.
- Data blindness: 42% report that critical security insights are missed because relevant data remains trapped in disconnected systems.
- Correlation drag: 40% of security professionals spend more time collecting and correlating logs across disjointed tools than dealing with the active threat itself.
This disconnect creates severe exposure because machine-speed attacks ruthlessly exploit human-speed handoffs. When an automated threat hits an enterprise, cross-team ticketing delays and siloed telemetry turn what should be sub-second containment into hours of manual triage, reinforcing why organisations must transition from isolated operations toward unified SecOps and NetOps teams built on a common, real-time data fabric.
The non-human identity blind spot in the AI era
As enterprises deploy autonomous AI agents to manipulate files, run local models, and call production APIs, the threat surface is expanding rapidly from human users to non-human machine identities.
Our research reveals a striking paradox across the Australian market: 62% of Australian organisations feel very confident they could detect and respond to a compromised AI agent, yet only 36% actually have mature governance in place for non-human machine identities (such as AI agents, service accounts, and automated scripts). That leaves nearly two-thirds (64%) of local enterprises adopting AI capabilities without the baseline controls needed to govern autonomous agents, a stark contrast to 86% of elite Relentless Defenders who enforce strict non-human identity governance.
This gap is critical because confidence without identity governance is false security. Autonomous AI agents operate faster than human oversight can track; if an agent’s credentials are hijacked via prompt injection or compromised API tokens, perimeter defences cannot distinguish legitimate actions from automated data exfiltration. Closing this exposure requires extending Zero Trust beyond human users to continuous, behavioural governance over every non-human entity across the enterprise.
The spending paradox: why more tools don’t equal less risk
A key finding of our research is what we call the Spending Paradox. Over the past two years, 89% of Australian organisations increased their cybersecurity spend, a rate virtually identical to global Relentless Defenders (91%). Yet their outcomes could not be more different: 45% of Australian organisations that increased spend saw incidents stay the same (33%) or rise anyway (12%), with only 44% seeing incidents decline.
This happens because layering new point products onto existing silos amplifies complexity, alert fatigue, and integration overhead rather than reducing risk. Relentless Defenders achieve dramatically better ROI because they eliminate friction before adding technology:
- 83% operate security, networking, and IT as a single coordinated unit (vs. only 46% in Australia).
- 98% maintain a single, real-time view of security data across their environment (vs. 52% in Australia).
- 74% enforce consistent security controls across cloud, network, and application layers (vs. 39% in Australia).
What This Means for Technology & Security Leaders
Moving from reactive defence to relentless resilience points to four clear operational priorities:
- Unify SecOps, NetOps, and IT workflows: Disband the operational boundaries between infrastructure and security teams. Shared telemetry and coordinated playbooks eliminate the 40% time drain on manual log correlation.
- Close the machine identity gap: Establish explicit ownership, least-privilege scoping, and continuous behavioural inspection for every API token, service account, and autonomous AI agent.
- Consolidate on an open telemetry fabric: Break down data silos so analysts and automated systems have a single, real-time view across cloud, endpoint, and network telemetry.
- Bridge the boardroom communication divide: With 40% of practitioners reporting their metrics are too technical to influence executive decisions, translate technical data into business downtime prevention and commercial resilience.
The bottom line: speed is a culture, not a product
If our research reveals anything, it is that technology alone will not save an organisation trapped in its own red tape. The defenders winning in the AI era aren’t holding secret tools or infinite budgets, they have simply built the operational muscle to act without hesitation. When machine-speed attacks strike, closing the gap isn’t about running another procurement cycle; it is about having the courage to tear down internal silos, take control of the autonomous agents entering your environment, and design operations to respond in milliseconds. In this new landscape, hesitation is your biggest vulnerability, and relentless execution is your only real defence.
View the Australian announcement of the Relentless Defence Report here.
