##### Press release # UpGuard’s ASX 200 Cybersecurity Report: 1 in 10 ASX 200 Companies Already Infected by Dark Web Infostealers ##### [UpGuard Team](#) May 19, 2026 ##### *Although there was a slight improvement in the ASX 200’s security rating, it was driven by post-incident security fixes, not proactive strategy* ‍ **Hobart, Tasmania - May 20, 2026** -  [UpGuard](https://www.upguard.com/), a leader in cybersecurity and risk management, released its annual ASX 200 Cybersecurity Report, which measures the cyber risk exposure of Australia’s largest listed companies. Based on daily scanning of billions of data points, UpGuard benchmarked external security posture on a 0–950 scale, finding the average score for the ASX 200 was 728.5 in 2025, equating to a B rating, and showing a 1.58 percent improvement from 2024. However, the report also found that 10 percent of the ASX 200 had active, verified infostealer infections. In addition, the research identified a trend where security scores typically remain stagnant until a major global security issue, such as the CrowdStrike outage, triggers a brief spike in remediation activity. However, these reactive security improvements often subside within months as organizational priorities shift.   ‍ **Key Findings from the 2025 Report:** * **Identity is the primary attack vector: **1 in 10 ASX 200 companies had high confidence that credentials were circulating in infostealer logs, with 71 percent of these infections concentrated in the largest organizations.   * **Supply chain cascade risk: **The majority of ASX 200 rely on the same core SaaS platforms, creating a cascade effect where a single vendor vulnerability can exploit hundreds of companies. * **Encryption is the weakest link for the second year running: **Encryption is the lowest-scoring technical category, leaving data privacy at significant risk. * **Sector leaders and laggards: **Information Technology (776) and Utilities (769) lead the index, while the Materials sector (673) continues to rank lowest in overall security posture. * **Attack surface volatility: **In every security category, nearly a third of companies ended up in a worse position than in 2024. ‍ “Even as companies in the ASX 200 continue their efforts to improve security, our research shows that the rise of sophisticated identity threats like infostealers, and new mandates under Australia’s Cyber Security Act 2024 mean that periodic security checks are no longer enough," said **Greg Pollock, director of Research and Insights at UpGuard**. “Maintaining robust cybersecurity standards requires a shift to continuous, comprehensive cyber risk posture management that reflects a true end-to-end security posture. Success will be determined by three factors: awareness of change, time to remediation, and security fundamentals.”  ‍ Real security posture requires total visibility across an organization’s attack surface, vendors, and threat exposure. To address the challenges in the current threat landscape, ASX 200 organizations need to have a unified system that addresses those three key risk dimensions. Recommendations include: * Implement continuous external scanning to know what is visible on the public Internet.  * Transition to real-time vendor risk monitoring. * Deploy dedicated dark web monitoring and credential exposure detection. ‍ **Methodology:** UpGuard’s analysis is derived from UpGuard’s Cyber Risk Posture Management (CRPM) Platform, which provides security ratings based on a quantitative assessment of external cybersecurity posture. This is done using a proprietary, subtractive scoring algorithm that benchmarks performance on a 0–950 scale, with assets starting at a perfect score and deductions applied based on the weighted severity of identified risks and vulnerabilities. ‍ To download the full report, visit [here](https://hubs.li/Q04h3KQk0).  ‍ **UpGuard Summit:** To learn more industry insights and explore the future of cyber risk, UpGuard is holding its quarterly APAC Summit May 21 at 1:00 PM AEST. To register for this online event, visit:   ‍ **About UpGuard** Founded in 2012, [UpGuard](https://www.upguard.com/) is a leader in cybersecurity and risk management. The company's AI-powered platform for Cyber Risk Posture Management (CRPM) provides a centralized, actionable view of cyber risk across an organization's vendors, attack surface, and workforce. Trusted by thousands of companies, UpGuard's platform is designed to help security teams manage cyber risk with confidence and efficiency. UpGuard is headquartered in Hobart, Tasmania with US headquarters in Mountain View, California. To learn more, visit www\.upguard.com. ‍ To learn more, visit [www.upguard.com](http://www.upguard.com). ‍ **MEDIA CONTACT** Julie Huang   ‍ ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ## UpGuard blog Learn about the latest issues in cybersecurity. #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 #### [The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management](/blog/upguard-named-leader-in-idc-marketscape) UpGuard has been named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Services 2026 Vendor Assessment. Find out why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 18, 2026 #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 11, 2026 #### [We Researched Four AI Evidence Analysis Tools for TPRM. Here’s What We Found.](/blog/ai-evidence-analysis-tools-for-tprm) We researched four AI evidence-parsing tools against four criteria that security teams often overlook. None nailed all four. [](/team/cassy-van-eeden) [Cassy van Eeden](#) September 29, 2026 #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 11, 2026 [View all blog posts](/blog) ## See UpGuard In Action Book a free, personalized onboarding call with one of our cybersecurity experts. [Contact sales](/demo) [Free demo](/demo) ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)