Are you getting enough cyber security for your AI strategy?

Family businesses are underestimating cyber threats

Australian family businesses rank AI adoption well ahead of cyber security as a concern – a wider gap than most global peers. The KPMG Global family business report 2026 shows 50% of Australian respondents cite AI adoption and governance as a top short-term challenge, against 37% for cyber security. That 13-point gap does not simply indicate a difference in priority. It signals Australian family businesses entering the highest-risk phase of AI adoption: active deployment without proportionate governance, with cyber treated as secondary rather than a precondition.

Short-term challenges for family business

Family businesses are right to pursue the productivity and growth opportunities AI can unlock, but cyber governance must move at the same pace as adoption. Boards that treat cybersecurity as a standing strategic agenda item — not a technical afterthought — will be better placed to protect trust, reputation and long-term value as AI becomes embedded across the business.

Dominika Zerbe-Anders

KPMG Partner, Cyber & Business Resilience

KPMG Australia

Implications for Australian family businesses

Confidence gap
Incident rates
Risk ownership
Investment maturity
AI and cyber

Implication 1: The confidence gap is a false comfort

Every market surveyed except China shows cyber concern trailing AI concern, and in every market except China both are expected to fade over the next decade. The assumption seems to be that addressing a challenge in the short term retires it long term. That doesn’t hold for AI-driven cyber exposure: the attack surface expands continuously as AI is embedded deeper into operations; it doesn’t stabilise once deployment is complete. A declining concern curve against a rising risk curve is exactly the condition in which governance gaps go unnoticed until an incident forces the issue.

Key action for boards

Treat a ‘declining concern’ trend as a warning sign, not reassurance. If cyber concern is cooling while AI deployment accelerates, escalate that divergence itself as a standing board item.

Implication 2: Reported incident rates are the wrong number to plan around

Only 24% of family businesses globally reported a cyber incident in the past 12 months, rising to 28% across ASPAC and 39% in Japan, with Australia close to the regional figure. KPMG’s own reading is that this understates real exposure, and potentially, a function of how few family enterprises treat cyber as a board-level risk, and a plausible reluctance to disclose incidents at all. Boards using this range to set risk appetite are very likely underestimating true exposure.

Key action for boards

Don’t treat a low self-reported incident rate as evidence of low risk. Commission an independent cyber maturity assessment rather than relying on internal incident logs.

Implication 3: ‘IT’s problem’ thinking is the real governance failure

Globally, 43% of family businesses still frame cyber security primarily as a technology or IT concern rather than a board-level risk. In the ASPAC region that percentage is higher, at 48%. KPMG’s Global family business report 2026 considers this to be the single most consequential governance gap in the sector.

Australia’s figures suggest a higher recognition of the risk but still less than half are contemplating adding cyber security to the board agenda in the next 12 months, and just 45% regard it as a critical risk requiring board oversight. Both measures are higher than reported across ASPAC as a region, however, the concern is that while awareness is rising, it has not yet converted into board ownership.

A risk sitting with IT is managed technically; a risk sitting with the board is managed strategically, with resourcing, escalation paths, and accountability attached.

Key action for boards

Add cyber security oversight explicitly to the board charter or risk committee terms of reference. Test whether the board could answer, without checking with IT or an outsourced provider, what its current exposure is, who owns it, and what triggers escalation.

Implication 4: Infrastructure and governance maturity move at different speeds

China frames cyber risk as largely a technology issue (68%) rather than a board one, yet has invested far more in underlying controls. In China, 82% report taking action to update software and network security settings, against 50% in Australia. In addition, 73% report upskilling and retraining staff in cyber security and safety, whereas only 58% report having done so in Australia.

Australia holds a stronger position on documenting risk frameworks (50%, ahead of China’s 36%) suggesting that Australian family businesses have been better at writing down what should happen than actually doing it. The inference being that Australia’s formal controls may exist but their capacity to be deployed may be weaker than boards realise.

Key action for boards

Check whether your risk framework describes controls actually deployed, or aspirational ones. A policy referencing multi-factor authentication, network segmentation or incident playbooks that don’t yet exist in practice isn’t a mitigant – it’s a false sense of security.

Implication 5: AI and cyber investment are no longer separable line items

The KPMG Global tech report 2026 found that improved cyber security management is now the most expected benefit of technology investment among private companies, signalling that cyber and AI value are fusing in leadership thinking, rather than competing for budget.

The warning for Australian family businesses is that an AI investment case, without a proportionate cyber security allocation is incomplete. Boards approving AI budgets without an accompanying cyber line item are, in effect, approving a strategy with a risk they haven’t priced.

Key action for boards

Require every material AI investment proposal to include an explicit, costed cyber security and data protection component as a condition of sign-off.

Key actions for Australian family businesses to consider

None of this requires a large new budget to begin. It requires moving cyber from an IT concern to a standing board discipline, with the same visibility already given to AI-driven growth. For family businesses built over generations, that shift is not defensive, it is a pre-condition on which the AI opportunity can be pursued safely at all.

Add cyber to the board agenda

Elevate cyber to a standing board agenda item, with defined ownership, reporting cadence and escalation thresholds.
Organise independent cyber maturity assessment

Commission an independent cyber maturity assessment rather than relying on self-reported incident history.
Pair AI and cyber security investment

Pair every AI investment decision with a costed cyber security component, approved together, not sequentially.
Reconcile policy with technical controls

Reconcile documented risk policy with deployed technical controls, closing whichever gap is wider in your organisation.
Stay vigilant about cyber scurity

Treat any decline in long-term cyber concern as a prompt to look harder, not relax.

See how KPMG Mid-Market & Private can help you thrive

Have a question or want to explore how we can support your business? Complete the form to submit your enquiry to KPMG Australia – Family, Private & Mid-Market. One of our team will be in touch as soon as possible to help you take the next step.