How Cybersecurity Is Becoming the Australia’s Next Big Investment Frontier
The launch of Horizon 2 of the 2023–2030 Australian Cyber Security Strategy in June 2026 underlines this transition.
Australia is entering a new phase in the development of its cybersecurity economy. What was once largely viewed as an information technology expense is now being positioned as an essential national capability and an increasingly attractive investment market. The change is being driven by a powerful combination of rising cyber threats, tougher regulatory expectations, rapid artificial intelligence adoption and growing concern over the security of critical infrastructure. For government, investors and businesses, cybersecurity is no longer simply about preventing a data breach. It is becoming part of the economic architecture required to support a more digital Australia.
The launch of Horizon 2 of the 2023–2030 Australian Cyber Security Strategy in June 2026 underlines this transition. The new phase is designed to expand cyber maturity across the economy and includes 19 actions and 64 initiatives to be delivered by the end of 2028. Its focus stretches from strengthening the workforce to protecting critical infrastructure and securing emerging technologies. The investment is also becoming more visible in public spending. Australia’s 2026–27 Budget provides A$89.3 million over four years to sustain and enhance initiatives under Horizon 2, adding to the A$586 million previously committed to the broader national cybersecurity strategy. This signals that cybersecurity is increasingly being treated as long-term strategic infrastructure rather than a short-term policy response.
The business case for greater cybersecurity investment is becoming difficult to ignore. Gartner forecasts that Australian organisations will spend more than A$7.5 billion on information security in 2026, representing growth of 9.5 per cent from the previous year. Demand is being fuelled not only by persistent threats but also by the expansion of AI, cloud computing and increasingly complex digital supply chains. This creates a substantial commercial opportunity across security software, managed services, consulting, cloud protection and infrastructure security. Victoria alone estimates that its cybersecurity sector contributes around A$2.9 billion in gross value added, supports more than 150 cybersecurity firms and employs over 17,000 professionals. Nearly half of the sector’s revenue is generated through exports, illustrating the industry’s potential to become more than a domestic defensive market.
For Australia, the opportunity lies in building companies and technologies that can serve both domestic customers and the wider Asia-Pacific market. Austrade has identified cyber technology as one of the industries important to Australia’s long-term economic prospects and sees the country as a regional base for developing and scaling new security products and services. That matters because cybersecurity has increasingly become intertwined with Australia’s broader technology ambitions. AI systems, quantum technologies, digital identity platforms and large-scale data centres all create new economic possibilities, but each also introduces new vulnerabilities. Investment in cybersecurity is therefore becoming an enabling investment: without trusted and resilient digital systems, the growth of these industries becomes more difficult.
Australia’s growing focus on cybersecurity is also a direct response to the scale of the threat. During the 2024–25 financial year, the Australian Signals Directorate’s Australian Cyber Security Centre received more than 84,700 cybercrime reports, equivalent to roughly one every six minutes. It responded to more than 1,200 cybersecurity incidents, an increase of 11 per cent on the previous year. The average self-reported cost of cybercrime to businesses also rose sharply, with large businesses reporting an average cost of more than A$202,000 per incident. The pressure is not confined to major corporations. Small and medium-sized enterprises are also increasingly exposed, particularly as cybercriminals exploit email systems, supply chains and stolen digital identities. At the same time, state-sponsored actors continue to target government networks, businesses and critical infrastructure for strategic and geopolitical purposes.
The result is a wider recognition that cyber resilience cannot be concentrated only among banks, technology companies or government agencies. It must extend across the economy. That requirement creates an expanding market for cybersecurity providers capable of serving organisations that do not have large internal security teams. Managed security services, automated threat detection, identity protection and cloud security are therefore likely to attract increasing attention as businesses search for practical ways to improve their resilience.
One of the most significant aspects of Horizon 2 is its emphasis on collaboration between government and industry. The strategy explicitly recognises that Australia cannot meet its cybersecurity objectives through public institutions alone. The new action plan includes support for domestic cyber industry growth, including continued assistance for cybersecurity start-ups and small and medium-sized enterprises developing solutions to emerging security challenges. This builds on earlier initiatives such as the Cyber Security Industry Challenge programme and could provide a stronger pathway between research, innovation and commercialisation.
The policy agenda is also widening into areas that have traditionally received less attention. Horizon 2 includes stronger work around cyber supply chains, drone security and subsea cables, reflecting the growing overlap between digital security, physical infrastructure and national resilience. This creates opportunities for companies operating in specialised areas where cybersecurity meets defence, telecommunications, logistics and critical infrastructure. Investors are likely to pay closer attention to businesses developing sovereign capabilities rather than relying entirely on imported technology.
The Australian government’s longer-term objective is ambitious: to position the country as a world leader in cybersecurity by 2030. Achieving that goal will require more than public funding. It will depend on the ability of Australian companies to develop commercially viable products, attract skilled talent and compete internationally. Artificial intelligence is adding another layer of urgency to the cybersecurity market. AI can help security teams detect vulnerabilities, identify suspicious behaviour and respond more quickly to incidents. However, the same technology can also enhance the capabilities of cybercriminals, making phishing, fraud and other attacks more sophisticated and scalable.
Australian regulators are already recognising this challenge. APRA has warned of the potential for widespread cyber impacts associated with highly advanced AI models and has emphasised the need for a continued uplift in cyber capabilities. This creates a new investment cycle. As organisations deploy AI across customer service, operations and decision-making, cybersecurity will need to evolve alongside it. Demand is likely to grow for AI security, application protection, identity management and technologies capable of monitoring increasingly complex digital environments. Victoria’s investment agency forecasts that Australia’s cybersecurity software segment will continue expanding, while security software spending is expected to reach approximately A$3.3 billion in 2026.
Despite the strong investment case, Australia still faces significant obstacles. The cybersecurity sector requires specialised talent, and competition for experienced professionals is intense. The government’s Horizon 2 strategy recognises the workforce challenge by placing people at the centre of its programme, describing workers as an important part of the country’s “human firewall”.There is also a question of whether Australia can convert strong research capabilities into globally successful cybersecurity companies. Building innovative technology is one challenge; scaling it into an internationally competitive business is another. The investment environment will therefore need to support companies beyond the start-up stage. Greater access to growth capital, stronger procurement pathways and closer cooperation between government, universities, investors and industry could become increasingly important.
