Human error cited for some cybersecurity incidents in Australia
More than a third of Australian organisations have reported employees misusing generative AI over the past year, as AI-related cyber threats increasingly come from inside the workplace as well as from external attackers, according to new research.
The ESET Enterprise Cybersecurity Report 2026, conducted by Blackbox Research, found that 66% of organisations in Australia experienced at least one AI-related cyber threat in the past 12 months.
Employee misuse of generative AI was the most commonly cited threat at 34%, followed by data leakage through AI platforms at 33%.
AI-generated phishing or impersonation attacks affected 30% of organisations, while 29% experienced AI-enabled deepfake or voice cloning attacks.
The findings come as 92% of organisations use or pilot AI in at least one business function, including 25% that use it in human resources or recruitment.
"AI is becoming deeply embedded in how businesses operate. As we give it access to more data and greater influence over decisions, organisations must ensure the right oversight and safeguards are in place. Trusting AI also means knowing how and where it is being used", said Parvinder Walia, president of the APAC region at ESET.
Most organisations (89 per cent) had at least one safeguard in place or planned to reduce AI-related risks, led by monitoring of AI tool access and outputs (49 per cent). However, 11 per cent had none in place yet.
"As employees increasingly use AI tools, sensitive information may be inadvertently exposed through everyday activities such as creating presentations or business content," Tony Anscombe, chief security evangelist at ESET, wrote in the report.
Human error behind incidents
Beyond AI, 72% of Australian organisations experienced at least one major cybersecurity incident in the past year.
Among them, 34% cited user actions or human error as a cause, the same proportion that cited phishing or social engineering. Only weak, stolen or compromised passwords ranked higher, at 37%.
Among organisations that linked incidents to human error, reusing or weak passwords was the most common behaviour (54%), followed by clicking phishing links or opening malicious attachments (48%).
Training is widespread, yet human risk remains the leading concern. While 92% of organisations provide cybersecurity training at least annually, employee awareness and training was the top cybersecurity challenge, cited by 50% of respondents.
"Phishing and social engineering continue to demonstrate why the human layer of cybersecurity cannot be overlooked. As AI makes malicious communications more convincing and personalised, organisations need to continuously build employee awareness through relevant training and realistic simulations. Technology can stop many threats, but a well-prepared employee can help stop the one that gets through," Walia said.
Anscombe noted that attackers often time their campaigns around moments that draw employees' attention.
"Cybercriminals routinely take advantage of seasonal events and moments that naturally capture employees' attention, from tax filing to HR announcements and major events such as the World Cup," he wrote.
He added that the goal "is not simply to train more often, but to deliver the right training at the right time, based on how threats are evolving and what employees are most likely to encounter."
Walia said organisations must treat cybersecurity as central to operations.
"Cybersecurity is now essential to keeping businesses running. As AI and connected technologies grow, organisations need to understand where their risks are, react quickly when something goes wrong, and adopt new technology with confidence," he said.
