[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Is the ASX 200 Resilient to Cyber Threats? Our Report Says No.](/blog/asx-200-report-key-findings) Publish date February 13, 2025 {x} minute read # Is the ASX 200 Resilient to Cyber Threats? Our Report Says No. [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Greg Pollock](/team/greg-pollock) Director of Research and Insights Greg is a CISA-certified cybersecurity researcher who holds multiple patents for data leak detection. His findings have been featured in The New York Times, Forbes, and Wired. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) In today’s rapidly evolving digital landscape, managing cyber risk has become essential for sustaining corporate growth and resilience. Cyber risk management requires balancing corporate growth against the evolving tactics of threat actors and governmental regulations – a daunting task that requires continuous measurement and strategic reflection. Our latest report, [State of Cybersecurity 2024 | ASX 200](https://www.upguard.com/state-of-cybersecurity-asx-200), examines these factors across Australia’s largest companies, identifying technological elements that relate to known threats and upcoming legislation, such as the Cyber Security Bill 2024. By calculating a cyber risk score based on those technical factors, we go further to compare risk between companies, across industries, and over time. This report is designed for those focused on strengthening Australia's cyber defenses, including: * Technology implementers looking to identify the most important risk factors and their technical controls. * Executives looking to benchmark their organizations against peers listed on the ASX or standards like the Protective Security Policy Framework. * Policy makers looking to understand the key risks impacting Australian industries and critical infrastructure. In this year’s report, we utilize data from UpGuard’s proprietary scanning technology to identify areas of vulnerability across the ASX and with specific industries. Some highlights include: * Over 50% of ASX companies show various issues with TLS connections for encrypting traffic, like weak ciphers that “[nation-state and sufficiently resourced actors are able to exploit](https://media.defense.gov/2021/Jan/05/2002560140/-1/-1/0/ELIMINATING_OBSOLETE_TLS_UOO197443-20.PDF)”, expired certificates, or simply no encryption at all. TLS is a well-established best practice, and gaps in TLS implementation have a strong correlation with security incidents.  * 46% of ASX 200 companies lack DMARC, an email authentication method used to prevent phishing. In May 2024, the [U.S. Department of State reported](https://media.defense.gov/2024/May/02/2003455483/-1/-1/0/CSA-NORTH-KOREAN-ACTORS-EXPLOIT-WEAK-DMARC.PDF) that North Korean groups were actively exploiting organizations with inadequate or non-existent DMARC policies.  * Overall, we observe improvements in the cyber risk scores of ASX 200 companies and in their industry groupings, but this pattern is not universal. For each industry, we highlight the companies that have improved or declined the most. Notably, one of the two industries to show a collective decline is Utilities – part of Australia’s critical infrastructure covered by the upcoming Cybersecurity Bill.  In addition to the selected key findings, the report provides an extensive analysis of each of the 11 industries – how they compare to each other, their year-over-year performance, which security domains contribute the most to their risk score, and detailed scoring for the best and worst performers.  These companies not only represent the largest concentration of capital in Australia, but also represent key vendors for other businesses and consumers. By highlighting both strengths and weaknesses, we aim to advance the shared mission of enhancing Australia’s cyber resilience. [Download the report today.](https://www.upguard.com/state-of-cybersecurity-asx-200) eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) October 29, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)