Claroty research: ANZ OT cyberattacks cost $2.04m on average, nearly double global figure
Cyberattacks on operational environments are costing organisations in Australia and New Zealand an average of $2.04 million per incident—almost double the global average of $1.04 million—according to new research published by cyber-physical systems security company Claroty.
The research is based on a global survey of 2,000 business and technology leaders across more than 40 countries. Claroty said the survey examined how organisations are securing operational environments including cyber-physical systems (CPS), operational technology (OT), internet of things (IoT), internet of medical things (IoMT) and building management systems (BMS), amid increasing connectivity and the growing use of AI.
Claroty reported that 80% of organisations in Australia and New Zealand experienced a cyberattack on their operational environments in the past 12 months. When asked to identify the most significant impacts of their most serious incident, respondents cited operational downtime (41%), safety incidents or hazards (37%), and reputational damage (32%).
The survey results indicated downtime from incidents was typically measured in hours, with organisations reporting about two hours of operational downtime on average from their most significant cyber incident. However, 18% said the disruption lasted more than three days.
Third-party access was identified as a prominent risk factor in the findings. Claroty said 88% of ANZ organisations experienced at least one cybersecurity incident originating from third-party remote access in the past year, with respondents reporting an average of more than three incidents linked to third-party access. The report also found that 52% of organisations had only partial or no monitoring of third-party connections into CPS/OT environments.
Jason Pearce, Field CTO – APJ at Claroty, said the ANZ results suggested organisations were dealing with larger financial consequences from operational environment cyber incidents than peers overseas.
“The ANZ findings are particularly significant because local organisations are experiencing an average financial impact that is almost twice the global average. That reinforces why operational resilience needs to be treated as a business priority, not simply a cybersecurity objective,” Pearce said.
The research also linked operational security challenges with the rapid uptake of AI. Claroty said 83% of organisations across ANZ were already using AI in some capacity, while 45% of respondents said AI had introduced new cybersecurity and compliance risks. When asked about the biggest threats currently facing operational environments, 32% pointed to AI-powered cyberattacks, followed by vulnerable legacy OT systems (30%).
On compliance, the report found 74% of ANZ organisations said they took a proactive or structured approach to cybersecurity compliance in operational environments. However, respondents identified barriers to achieving full compliance, including lack of IT/OT alignment (31%), limited visibility (23%) and third-party risk (23%).
Claroty said the findings highlighted a need for organisations to move beyond “tick-box” compliance and focus on operational resilience—particularly where digital systems interact with physical processes and disruptions can have safety and continuity implications.
You can read the full report here.
About Author
