Why Australia’s falling cyber attack count offers limited reassurance

Australia’s monthly cyber attack decline still warrants caution

Australian organisations faced fewer cyber attacks in October than in September, but activity remained well above the previous year’s level. Check Point Research recorded an average of 2,117 attacks per organisation each week, down 9% from September and up 39% from the same month a year earlier. The monthly decline sits within a longer period of increased activity. Check Point, the cybersecurity company behind the research, sells protection against these threats and has a commercial interest in organisations maintaining or increasing their security investment.

The longer-term increase underlies the warning from Omer Dembinsky, Data Research Manager at Check Point Research. “A lower monthly figure should not be mistaken for a lower level of risk, as attacks are still running about a third above where they were a year ago,” he said. To decide what the monthly decline means for defensive priorities, leaders need to understand what each measure describes. Check Point Research’s findings cover attack frequency, malicious email, sensitive information submitted to generative AI tools and publicly claimed ransomware victims.

Attack volume and growth point to different priorities

The international figures put Australia’s monthly decline in context. Check Point Research recorded a global average of 2,550 attacks per organisation per week in October, down from September but 32% above the previous year’s level. Australia therefore had a lower weekly average than the global figure, alongside faster annual growth. Volume shows how much activity organisations faced, while annual growth shows how quickly it changed.

New Zealand also saw a monthly improvement alongside an annual increase. Check Point Research recorded an average of 1,913 attacks a week against its organisations, down 7% from September but 16% above October last year. As in Australia, the decline left activity above its earlier level, so leaders reviewing monthly reports need both comparisons to judge the scale and direction of change.

The regional figures add geographic context to those national averages. Check Point Research found the highest weekly attack volume in Africa, followed by Latin America and Asia-Pacific, although an individual organisation’s experience can differ from its regional average. Its ranking was:

Annual growth produced a different regional ranking in Check Point Research’s findings. Africa’s attack activity increased 38%, while Europe recorded the fastest regional increase at 39%; North America’s increase was 33%. Africa therefore led on weekly volume, and Europe on growth. A security review may need to address a high existing workload, a rapid increase in activity, or both.

The sector results also separate volume from growth. Check Point Research found that Education had the highest weekly average, at 5,934 attacks per organisation, up 33% annually. Agriculture ranked second at 3,218, but its 93% annual increase was the steepest among the leading sectors. Education faced the greatest measured volume; Agriculture saw the fastest increase among those sectors.

In Check Point Research’s sector ranking, Telecommunications followed Agriculture with 3,068 weekly attacks per organisation, up 19% annually. Government, Energy and Utilities, and Healthcare and Medical also appeared in the upper half of the rankings, while every tracked sector recorded double-digit annual growth. These differences mean organisations need to consider their sector when interpreting Australia’s overall result. But attack volume alone cannot describe every form of exposure.

Phishing rates show a different sector pattern

Email exposure illustrates that difference, even though it also improved during October. Check Point Research identified one malicious email in every 128 emails, equivalent to 0.78%, compared with one in 91, or 1.10%, in the previous month. This measures the malicious share of email traffic, whereas the attack figures count attacks per organisation per week. Both declined, but they describe different activity.

Within those malicious emails, Check Point Research found that 79% contained a link and 14% carried an attachment. Links therefore remained central to email threat assessment even as the overall malicious share fell. These percentages describe message content and help email teams examine delivery methods.

The sector distribution gives email teams another reason to examine their exposure separately. In Check Point Research’s phishing results, which concern messages designed to trick recipients into revealing information or taking an unsafe action, Construction and Engineering had the highest rate at 1.72%, followed by Real Estate, Rentals and Leasing at 1.05%, then Associations and Nonprofits at 0.97%. North America recorded the highest regional rate, at 0.81%. Using the Education-led attack-volume ranking as the sole guide would miss these concentrations of malicious email.

Generative AI exposure depends on what employees submit

While the email findings concern incoming threats, employee use of generative AI creates exposure through information sent to external tools. Check Point Research found that 2.9% of enterprise generative AI prompts, the requests users submit, carried a high risk of sensitive-data leakage in October. Those high-risk submissions appeared at 90% of organisations that regularly used the tools. The prompt percentage measures frequency within submissions; the organisation percentage shows how widely the exposure was spread.

Both can be true because most submissions at an organisation may fall outside the high-risk category even when some qualify. The prompt rate alone would miss how broadly the exposure reached regular users of enterprise AI. The organisation rate alone would obscure how often high-risk submissions occurred within the total, so a review needs both denominators: prompts and organisations.

Beyond its spread across organisations, Check Point Research found that the high-risk share had risen for three consecutive months, from 2.3% in August to 2.5% in September and 2.9% in October. A further 12% of prompts contained information that could be sensitive, a separate category from the high-risk group. These findings describe the information submitted and its risk. They do not measure confirmed data leaks.

The usage figures show how this exposure can arise through routine work. Check Point Research recorded an average of 91 prompts per user during the month and seven generative AI tools per organisation. Repeated submissions across several services make the contents of employee requests an operational security concern. Reviewing that activity requires attention to both the information included and the services receiving it.

The information categories make that review more specific. Check Point Research found financial information in prompts at 71% of organisations; legal and regulatory material together with network and IT infrastructure details were reported at 70%. HR and employee data appeared at 67%, while personally identifiable information, data that can identify an individual, appeared at 62%. These figures describe the organisations where each category appeared, showing the reach of financial, legal, technical and personal information across users of the tools.

Sector and regional rates show where high-risk submissions were concentrated. Check Point Research found the highest sector rate in Business Services at 5.4%, followed by Government at 4.6% and Financial Services at 4.5%. The listed regional rates were 3.8% in Latin America, 3.3% in North America and 2.5% in Asia-Pacific. These measures bring employee information-sharing behaviour into the security assessment independently of changes in incoming attack volume.

Ransomware claims reached a dataset high as group rankings changed

Alongside that employee-driven exposure, Check Point Research recorded an increase in publicly reported extortion activity. It counted 1,063 victims publicly claimed by ransomware groups, which demand payment over stolen data or blocked access, in October, up 35% from the same month a year earlier and the highest monthly total in its dataset. A publicly claimed victim is an organisation an extortion group names as a victim in a published claim. The total and its sector, geographic and group distributions all measure those claims.

In Check Point Research’s findings, Business Services accounted for the largest sector share of claimed victims at 31.5%, followed by Consumer Goods and Services at 14.9% and Industrial Manufacturing at 11.6%. Business Services also led the high-risk AI prompt ranking, but the matching position describes separate forms of exposure: information employees submit to AI tools and organisations named by extortion groups. Leaders in that sector have two issues to examine. The shared ranking does not establish a causal link between them.

The geographic distribution shows where the claimed victims were located. Check Point Research recorded 48% in North America, 22% in Europe and 18% in Asia-Pacific. At country level, the United States represented 44.3% of the total, Germany 5.2% and Canada 4.0%. Keeping country and regional shares separate allows comparisons within each classification.

The group rankings show how activity was distributed among operators. The Gentlemen led Check Point Research’s named ranking, linked to 13% of published attacks in October, with Qilin close behind at 12%. The newer operator n0n moved into third place at 8%, up from 2% in September. Its rise shows why changes in individual groups matter alongside the total number operating.

The number of groups was broadly unchanged over the past three months, according to Check Point Research, even as new operators appeared and others became inactive. A stable count therefore concealed changes in membership and each group’s share of published attacks. Tracking those changes makes the count more useful: activity can shift towards a newer operator such as n0n while the overall group population stays similar in size.

Check Point Research described n0n as an operation focused on stealing data and using it for extortion, with heavy reliance on AI-assisted tools. Here, AI supports attackers’ operations, a separate mechanism from employees submitting sensitive information to AI services. The two findings inform different security decisions: how to assess an extortion group’s operations and what information leaves an organisation through employee requests.

Dembinsky recommends coordinated prevention, an approach aligned with Check Point’s commercial interest in selling cybersecurity protection. “Every region is seeing more attacks than in 2025, employees are sharing sensitive data with GenAI tools at a growing rate, and ransomware groups are building AI into their operations. Defenders need to prevent attacks earlier, with AI-powered protection and shared intelligence working together across networks, cloud, email, endpoints and AI services,” he said. His proposal requires protection and threat information to work across those environments, including endpoints, the computers and other devices employees use, and the AI services receiving their requests.

Key takeaways for decision-makers

• Read monthly declines alongside annual growth: Australia’s weekly cyber attacks fell 9% in October but remained 39% above the previous year. Security leaders reviewing defensive priorities need both comparisons, alongside sector-specific attack volumes.
• Assess email exposure separately: Malicious emails fell to 0.78% of traffic, with Construction and Engineering recording the highest phishing rate. Email security teams need their own sector benchmarks and delivery-method analysis, including the links present in 79% of malicious messages.
• Review information submitted to AI tools: High-risk prompts rose for three consecutive months to 2.9% of submissions and appeared at 90% of organisations regularly using generative AI. Security and data governance teams need visibility into prompt contents and the services receiving them; these figures measure exposure rather than confirmed leaks.
• Track ransomware operators alongside victim claims: Publicly claimed ransomware victims reached a dataset high of 1,063, up 35% annually, while newer operator n0n’s share rose from 2% to 8% in a month. Threat intelligence teams need to track operator activity and sector exposure, keeping published claims distinct from confirmed incidents.