CISO - Wave of Change™ March 2025

The CISO Wave of Change reveals the shifting priorities and persistent challenges faced by cybersecurity leaders in Australia. As they navigate evolving threat landscapes, these leaders are increasingly data-driven and focused on infrastructure modernisation, yet must contend with tight budgets, talent shortages, and complex ICT environments. Strategic IT decision-making is being reshaped by identity security, endpoint defense, and AI-powered solutions, while cloud security and Zero Trust frameworks gain traction. Role ambiguity in ICT decision-making, integration complexity, and compliance pressures further complicate scaling initiatives. Leaders are calling for more agile, cost-effective, and interoperable solutions to drive transformation

Key Findings:

• Security Leaders Are Data-Informed but Budget-Constrained: Most have embraced data-driven decision-making, yet securing adequate budget remains their top challenge, especially when balancing cost with risk mitigation and ROI. ‍
• Modernisation Profiles Vary Widely: Nearly half of security leaders are "Challengers" modernising infrastructure amid legacy hurdles, while only 9% see their organisations as "Leaders" in security maturity. ‍
• Identity, Intelligence & End-Point Defense Shape Strategy: These technologies dominate current IT strategies, with AI and Zero Trust gaining interest but hindered by skills gaps and integration hurdles. ‍
• Scaling ICT Initiatives Faces Structural Barriers: Budget limits, system complexity, and workforce shortages significantly slow digital transformation efforts, calling for interoperable, cloud-based architectures. ‍
• Decision-Making Is Multi-Stakeholder & Role-Blurred: While CIOs and CTOs often have final say, cybersecurity, compliance, and risk officers heavily influence decisions - though their authority can be ambiguous. ‍
• AI and Automation Are Reshaping Security Approaches: As threats evolve, leaders are moving from reactive to proactive strategies, investing in AI, automation, and Zero Trust to improve resilience and reduce manual overhead.