Security Report · raw.githubusercontent.com

Zscaler Report Highlights AI Security Risks and Testing Failures in Australia and New Zealand

Oct 21, 2026 · Original Report (PDF) ↗

Report discovered via Awesome Annual Security Reports.

Summary

Zscaler ThreatLabz’s 2026 executive report covers AI security risks in Australia and New Zealand, citing red-team tests in which all tested AI systems failed and recommending stronger governance, continuous testing, and least-privilege access.

Key points

The report says Australia and New Zealand recorded 15 billion and 2.5 billion AI/ML transactions, respectively, from June to December 2025.
Zscaler red-team testing found critical vulnerabilities in 90% of systems; all tested AI systems failed, with a median time to failure of 16 minutes.
The report warns that use of AI apps can expose sensitive data, including source code and personally identifiable information; it cites 18,033 terabytes transferred to AI/ML applications globally in 2025.
It identifies AI supply-chain attacks, model and dataset tampering, deepfake fraud, and AI-driven social engineering as key risks.
Its executive checklist recommends discovering AI tools, establishing governance, continuously red-teaming systems, and applying least-privilege access.
The report calls for board-level accountability and stronger AI risk oversight, while advocating Zero Trust as an operational standard.

Article Details

Publisher: Zscaler ThreatLabz
Report Period: 2025 data (June–December 2025); 2026 outlook
Scope: AI security risks and security maturity in Australia and New Zealand (ANZ)
Key Statistics: Zscaler red-team testing found critical vulnerabilities in 90% of systems tested; 100% of AI systems tested failed. Median time to first critical vulnerability was 1 hour 27 minutes; median time to failure was 16 minutes, with the fastest observed failure at 1 second.
ANZ AI/ML transactions in June–December 2025: Australia, 15 billion; New Zealand, 2.5 billion.
Globally, 18,033 terabytes of data were transferred to AI/ML applications in 2025.
60% of Oceania technology leaders identified AI-driven social engineering as their top threat for 2026.
Average cybercrime costs for large Australian businesses increased 219%; the average cyberattack cost exceeded AU$202,000, while the average New Zealand SME data-breach cost was NZD$173,000.
Recommendations: Continuously catalog GenAI tools and SaaS tools with inline AI features, and inspect AI/ML traffic to prevent malicious data exfiltration.
Establish internal AI rules of engagement and board-level oversight; assess and disable risky defaults until risk reviews are complete.
Continuously red-team AI systems and remediate discovered vulnerabilities.
Apply least-privilege access to every user, service, and system interacting with an AI model.

Vendors

ZscalerThis report is a snapshot of the latest data from Zscaler’s ThreatLabz AI Security Report 2026, with a laser focus on ANZ.

Products

Zscaler AI Security PlatformThe Zscaler AI Security Platform delivers end-to-end protection, from AI asset discovery and risk posture assessments to continuous red teaming and runtime guardrails, enabling AI governance and compliance at scale.

Countries

AustraliaAI adoption in Australia and New Zealand (ANZ) has moved from ‘new’ to ‘normalised’.New ZealandAI adoption in Australia and New Zealand (ANZ) has moved from ‘new’ to ‘normalised’.

Industries