Rubrik (NYSE: RBRK), the Security and AI Operations Company, released the results of its latest Rubrik Zero Labs’ report “Identity Crisis: Understanding & Building Resilience Against Identity-Driven Threats.”
Australia Moving from AI Experimentation to Implementation
The report reveals that 99 per cent of Australian organisations have integrated or plan to integrate AI models or AI agents into their identity infrastructure. Meanwhile, 98 per cent of local security leaders report identity-driven attacks as their top concern—the highest globally. The report findings are particularly concerning because AI agents, if compromised, grant threat actors direct access to sensitive systems and data, increasing the scale and speed of potential attacks. Therefore, organisations must prioritise securing AI agent identities and access controls to prevent devastating breaches.
“AI agents are a force multiplier – the only question is whether that force is positive or negative,” said Kavitha Mariappan, Chief Transformation Officer, Rubrik. “When compromised and used maliciously, AI agents can cause 10 times the damage in one-tenth of the time. We’ve already seen the impact compromised human identities can have, and it’s clear agentic identities are the next frontier.”
Kavitha Mariappan, Chief Transformation Officer at Rubrik
A Costly Reality Check
One of the most notable findings in this year’s report was that Australian organisations experienced the highest proportion of ransomware attacks globally (35 per cent). One reason for the high rate of ransomware attacks in the country appears to be because local organisations continue to pay their attackers. Of Australian organisations that experienced a ransomware attack in the past 12 months, 95 per cent reported paying a ransom to recover data or halt the attack, ranking second only to Singapore at 97 per cent.
“The figures in this report underline a sobering reality – ransomware remains one of Australia’s most persistent and costly cyber threats. Traditional defences clearly aren’t enough,” said David Rajkovic, Vice President, Rubrik A/NZ. “It is critical for Australian organisations to adopt a proactive security posture, one that prioritises rapid recovery, because paying ransoms only fuels the criminal ecosystem.”
David Rajkovic, Vice President at Rubrik ANZ
Prolonged Recovery
Despite nearly all Australian ransomware victims paying their attackers, the report finds that not a single Australian organisation (0 per cent) was able to recover and resume normal operations in less than an hour. Almost a quarter (23 per cent) took more than 24 hours to recover.
No Australian organisation (0 per cent) believes they could recover full service operations in under 12 hours, and 34 per cent believe it would take at least a week to do so. In trying to recover identity infrastructure post compromise, more than three quarters (78 per cent) of Australian organisations believe it would take them more than 24 hours.
Australian organisations are, however, looking to implement better resilience measures, with 92 per cent planning to hire professionals specifically to manage or improve digital identity management. Australian respondents also widely reported shifting toward using more cloud and SaaS-based services than any other nation (88 per cent).
“The report highlights a nation that understands the threats and is keen to forge ahead with innovation, but unfortunately our nation lacks investment into appropriate security controls,” said Rajkovic. “To prevent innovation from outpacing risk management as organisations adopt AI, mechanisms to monitor and audit agentic actions, enforce real-time guardrails for agentic changes, fine-tune agents for accuracy and, finally, undo agent mistakes will be critical.”
To read the full report, visit https://zerolabs.rubrik.com/.
Methodology
The Rubrik Zero Labs Survey was conducted by Wakefield Research among 1,625 IT Security Decision-Makers at companies of 500 or more employees with a 50/50 split of Directors/VPs and CIOs/CISOs. The research was conducted in three regions: US, EMEA (UK, France, Germany, Italy, Netherlands), and APAC (Japan, Australia, Singapore, India), between September 18th and September 29th, 2025, using an email invitation and an online survey.
Results of any sample are subject to sampling variation. The magnitude of the variation is measurable and is affected by the number of interviews and the level of the percentages expressing the results. For the interviews conducted in this particular study, the chances are 95 in 100 that a survey result does not vary, plus or minus, by more than 3.9 percentage points for the EMEA region, and 4.4 percentage points for the APAC and US regions, from the result that would be obtained if interviews had been conducted with all persons in the universe represented by the sample.
