APRA Just Called AI Cyber Threats a Team Sport. Here’s What That Means for Your Small Business.

Australia’s banking regulator doesn’t usually make news by quoting spy agencies. But at the 2026 AFIA Risk Summit in Melbourne this week, APRA member Therese McCarthy Hockey did exactly that, and the message was pointed enough that small business owners in finance, accounting, and law should be paying attention.

The speech centred on Anthropic’s Mythos AI model, which the company says has surpassed “all but the most skilled humans at finding and exploiting software vulnerabilities.” That’s not a vendor boast buried in a product launch. That’s a prudential regulator citing it as the reason Australia’s financial system needs to rethink its entire approach to cyber risk.

What APRA actually said

McCarthy Hockey called Mythos a “model shift” in cyber risk, then put that in concrete terms. The UK’s AI Security Institute has confirmed the model can autonomously chain together minor vulnerabilities to create a major breach. Bugs that used to sit safely at the bottom of a patching queue are now attack surfaces.

More striking was the Five Eyes citation. The joint statement from Australia, the US, UK, Canada, and New Zealand’s cyber agencies, a rare move in itself, put it bluntly: “The timeline is not years, it is months.”

McCarthy Hockey also flagged that APRA’s own review of 11 financial institutions found AI governance at regulated entities “not keeping up” with the pace of adoption. Boards are approving AI tools faster than risk frameworks are being built around them. That’s the internal problem. Mythos is the external one.

Why this matters if you’re not APRA-regulated

Most small businesses in finance, accounting, or legal services aren’t supervised by APRA. That’s the common assumption that makes this speech easy to dismiss, and the wrong one to make.

The speech makes the supply chain argument plainly: in an interconnected financial system, “our financial system is only as resilient to cyber-attacks as the weakest link in the chain.” The big banks and super funds McCarthy Hockey was addressing all have suppliers, service providers, and professional advisers. That web includes your firm.

A World Economic Forum white paper cited in the speech found that 77% of organisations are now using AI in cybersecurity. But it also found that smaller entities consistently lag behind because of “financial constraints, skills availability, and data maturity.” APRA knows this. The “Team Australia” framing is a direct response to it, larger organisations that gain early access to frontier AI models are expected to share what they learn with smaller peers and suppliers.

APRA, ASIC, and the Australian Signals Directorate (ASD) are already running joint roundtables to push threat intelligence down through the system. Some of Australia’s biggest financial institutions have volunteered to share technical expertise with smaller organisations. The expectation is clear: the big end of town will share; the small end needs to be ready to receive and act on that information.

Four things you can do right now

McCarthy Hockey was direct on this: “Don’t wait for the latest and greatest technology or mistake access to frontier AI models for resilience.” Here’s what that looks like for an SMB with limited resources:

Start with patching. Mythos can find and chain vulnerabilities that have sat undetected for years. If your firm runs software that hasn’t been updated recently, that’s where to start. Prioritise anything client-facing or connected to financial data.

Map your third-party dependencies. Work out what vendors you rely on, what data they hold, and what happens if one of them is breached or goes offline. Suppliers get targeted precisely because they’re the path of least resistance into bigger organisations.

The ASD has also set a deadline on post-quantum cryptography: have a migration plan in place by end of 2025 and begin the transition by end of 2028. That’s closer than it sounds. Ask your IT provider now what it means for your current setup.

Finally, if you work with APRA-regulated entities, watch for threat intelligence coming down through that chain. The roundtables McCarthy Hockey described are designed to push information from the big end of town toward smaller suppliers. Make sure the right person at your firm is positioned to act on it when it arrives.

The speech closed with a line worth sitting with: “Real resilience comes from the governance, controls, data discipline, testing and contingency planning that sit around the technology.” Not the technology itself. The disciplines around it. For SMBs without a dedicated security team, that’s actually good news, these are organisational problems, not just technical ones, and they’re solvable with planning.

Sources: APRA, Therese McCarthy Hockey’s remarks to the 2026 AFIA Risk Summit | HCA Magazine, APRA calls for ‘Team Australia’ approach to AI cyber threat

📖

📖 More deep dives: News Deep Dives

📊 Compare AI tools side by side | 💼 Free resources & AI prompt packs

📖 More deep dives: News Deep Dives →

More hot takes: Hot Takes →