Australian organisations are adopting AI at extraordinary speed. Copilots are writing code, agents are moving through business systems and employees are putting company data into public tools, often before security teams have had a say. Attackers are using the same technology to sharpen phishing, automate reconnaissance and identify weaknesses faster. 

Cyber security and the people responsible for it, has moved firmly up the board agenda. The question is whether boards and executive teams are backing their concern with the investment and capability required to manage the risk.

Cybersecurity is no longer just an IT responsibility. In many organisations, it has become the foundation upon which digital transformation, customer trust and operational resilience are built. While it was once viewed as the digital equivalent of locking the front door, cybersecurity is now embedded in every aspect of business performance and growth.

AI is expanding the cyber threat landscape

Every new AI tool, integration and agent creates another potential way in. Proofpoint's 2026 Voice of the CISO report found 85% of Australian CISOs view generative AI as a security risk, up nine points in a year, while 83% believe employees are likely to use AI in ways that could expose sensitive data.

The cost is rising too. The Australian Signals Directorate received more than 84,700 cybercrime reports in 2024–25, while the average self-reported cost per report for a large business rose 219% to $202,700.

From Peoplebank's perspective, this makes cyber security as much a workforce challenge as a technology one. As AI expands the risk landscape, technology investment must be matched by investment in people who can secure it, govern its use and build resilience. 

How boards are navigating the evolving risk landscape 

The AICD's Director Sentiment Index for the first half of 2026 ranked cyber crime and data security among directors' top three concerns, while more than half said AI adoption was moving faster than their organisation could keep up.

Boards are increasingly treating AI and cyber as connected risks. The conversation is shifting from "are we compliant?" to "what happens if this goes wrong?" Security leaders are expected to explain the potential impact on enterprise value, operations, reputation and data. 

Yet the expertise to challenge those answers can be missing. A 2025 Diligent Institute and Governance Institute of Australia survey found 53% of Australian boards named cyber security their top strategic priority, but only 13% had recruited AI-savvy directors and 21% mandated AI training.  Diligent via KBI.Media ASIC has similarly warned that governance risks falling behind AI adoption. ASIC 

Peoplebank sees this as much a capability challenge as a governance one. Strong oversight depends on having expertise across the boardroom and the business to translate emerging AI and cyber risks into informed decisions and effective controls. 

Are boards approving more budget? 

Largely, yes. Gartner forecasts Australian information security spending will exceed AU$7.5 billion in 2026, up 9.5% on 2025, with AI adoption and AI-enabled attacks among the drivers. PwC's 2026 Digital Trust Insights found nearly three in four Australian organisations expected cyber budgets to rise, with 37% naming AI as their top cyber budget priority.

But more budget does not automatically deliver more capability. Proofpoint found 79% of Australian CISOs are managing expanding AI risks without a proportional increase in resources or expertise. The tools are being bought, but the people needed to secure and govern them remain harder to find.

Peoplebank identify a continuing talent shortage and a growing need for AI-literate security staff. The tools are being bought; the people needed to run and govern them are harder to find.

What Peoplebank is seeing in executive hiring 

One sign that organisations are taking AI-driven cyber risk seriously is movement at the top of the security function. Peoplebank is seeing increased activity at CISO level, alongside greater appetite to build the teams beneath them.

Demand for dedicated CISOs and Heads of Cyber has grown by around 20% year on year across Australian enterprise, government and SME organisations, with hiring activity particularly concentrated in Sydney and Melbourne.

Peoplebank data shows that around 60–70% of executive briefs for CISO and Head of Cyber roles now explicitly include AI governance, AI threat mitigation or responsible AI adoption among their core responsibilities.

The CISO role has expanded. Security leaders are increasingly expected to secure AI alongside the wider technology environment, from employee use and vendor risk to agents accessing business data.

Security leaders are also open to moving. The IANS and Artico Search 2026 State of the CISO report found nearly seven in ten CISOs were open to a career move within the next year, while 52% said their scope was no longer fully manageable.

New security leaders often arrive with a mandate to close capability gaps, creating demand further down the function for architects, engineers and governance specialists who can design controls, secure AI platforms and establish appropriate policy and assurance.

The bigger picture for cyber talent and how it's shifting 

The most in-demand cyber security roles Peoplebank worked on in FY26 were Security Engineers, Security Architects and cyber security support professionals. Demand also remains strong across cloud security, security operations, identity and access management, and governance, risk and compliance. 

The wider skills challenge is significant. ACS Digital Pulse 2026 backs this finding, showing 84% of workers had used AI tools, but only 7% demonstrated advanced AI literacy.

Peoplebank data shows cyber security roles take an average of 33 days to fill, eight days longer than broader technology roles. In FY26, 84% of Peoplebank's cyber security placements were contract engagements and 16% permanent. 

That model reflects how many organisations are accessing specialist capability. AI security requirements are often tied to defined programs, from securing new platforms to establishing AI governance, making contract specialists, project teams and salaried consultant models valuable ways to access capability quickly. 

Turning investment into capability 

For boards approving greater cyber investment, the challenge is turning that budget into capability. The organisations that do this well: 

• Get the leadership right. A CISO with a clear mandate, reporting line and budget can turn investment into a coherent security program. 
• Link hiring to risk. If AI data exposure is a priority, fund roles with the expertise to address it. 
• Blend contract and permanent talent. Bring in specialists for urgent programs while building a permanent core that retains knowledge. 
• Invest in existing people. Upskilling security and risk teams in AI can complement external hiring for scarce skills. 
• Move quickly. With cyber positions taking longer to fill, slow approvals and lengthy interview processes increase the risk of losing strong candidates. 

AI will continue to reshape the threat landscape. Leadership teams that invest in the people, not just the platforms, will be better placed to adopt it safely and turn cyber investment into genuine resilience. 

How Peoplebank can help 

Peoplebank partners with organisations across Australia to source cyber security capability across permanent, contract and workforce solutions, from analysts and engineers to architects, security leaders and project teams. 

Whether you're appointing a security leader, securing an AI platform or building internal capability, our specialists can help you find the right people. 

Contact Peoplebank to discuss your cyber security hiring requirements.