The State of Cybersecurity 2024 | ASX 200 finds that while the overall cyber resilience of Australian organisations holds strong, some of the country’s largest corporations are struggling to keep pace with the evolving threat landscape
SYDNEY, AUSTRALIA — 19 NOVEMBER 2024 — UpGuard, the global leader in cybersecurity ratings and risk management, has unveiled its 2024 ASX 200 Security Report, revealing that sectors such as Energy and Consumer Discretionary—key drivers of the national economy—are struggling to keep pace with evolving cyber threats as the Australian government rolls out stricter data privacy regulations.
While the report shows an overall improvement in security postures among Australia’s top listed companies, with average scores rising from 759 in 2023 to 773 (out of 950) in 2024, significant vulnerabilities persist in critical sectors like Healthcare, which recorded an average score of 763, and Utilities, which has seen only a 2-point increase.
The report, which audits the security standards of Australia’s largest 200 companies by market capitalisation across email, networks, website, and overall security, found that while sectors like Materials and Real Estate have made progress, 46% of ASX 200 companies still lack DMARC (Domain-based Message Authentication, Reporting & Conformance) policies, leaving them vulnerable to phishing—a common entry point for larger breaches. Additionally, 29% of these companies operate websites without any encryption, raising serious concerns about data security in critical industries.
“As some of the largest companies in Australia, members of the ASX 200 have a responsibility to maintain robust cybersecurity standards, particularly firms that are critical to the Australian way of life and the health of the economy at large,” said UpGuard Head of Research and Insights, Greg Pollock.
Key findings from the 2024 ASX 200 Security Report:
- 9 of the top 10 most common risks to ASX 200 companies involve website security
- Materials, Communication Services and Real Estate improved the most with 30+ point gains.
- Energy and Consumer Discretionary sectors dropped 12 points and 14 points respectively.
- 29 companies on the ASX 200 have perfect email scores. These organisations have managed to establish effective SPF and DMARC policies across their domains.
- The Information Technology sector increased its average score by 20 points from last year, bringing it up over 800. Much of this improvement was made in the email vector, with a gain of 123 points
“Many organisations still lack fundamental protections in critical areas like their supply chain and email ecosystems, despite high-profile breaches such as Optus, Latitude Financial, and Medibank in recent years,” said Greg Pollock, UpGuard Research and Insights. “These gaps leave businesses exposed to serious threats, from phishing attacks to unauthorised data access and identity fraud, compromising both their operations and customer trust. This isn’t just about compliance; it’s about building resilience and maintaining trust in an increasingly hostile digital landscape.”
The 2024 report also highlights significant website and network security concerns among ASX 200 companies. Nine of the top 10 most common risks to ASX 200 companies involve website security, with almost a quarter (24%) using expired or invalid certificates and 50% relying on weak encryption methods—risks that are most prominent in the Financial Services, Manufacturing, Insurance, and Energy & Utilities sectors. Network vulnerabilities are also a concern, with 55% of companies exposed to risks such as open FTP ports, which pose critical threats if left unaddressed.
“The recent CrowdStrike outage serves as a reminder that even well-prepared companies can face disruption,” added Pollock. “When incidents occur, they ripple through entire supply chains, with impacts that extend beyond the company itself to affect the national economy and security. Regulations alone can’t do the job—it's up to companies to roll up their sleeves, close those lingering security gaps, and stay on their toes as new threats emerge. It’s this kind of continuous effort that will carry us through the challenges of 2025 and beyond.”
Recommendations for companies:
- Improve encryption practices
- Inventory and decommission outdated internet-facing systems.
- Regularly update certificates to current encryption standards (e.g., TLS 1.3).
- Enforce encrypted connections and replace unencrypted services like FTP with secure alternatives.
- Improve phishing protection
- Set up SPF, DKIM, and properly configured DMARC policies to block fraudulent emails.
- Ensure DMARC applies to all subdomains and rejects unauthorised emails.
- User education
- Conduct regular phishing training and run test phishing scenarios.
- Establish clear protocols for handling sensitive information to reduce risks.
NOTES TO EDITORS
- Data sourced from public records collected between May 2023 and August 2024 with insights developed using UpGuard’s proprietary cyber risk assessment tools.
- All data and insights have been validated by cyber security and data experts.
- A full copy of the ASX 200 Security Report can be found HERE
METHODOLOGY
This report draws on data from the UpGuard platform, which scans publicly available information to evaluate the security posture of ASX 200 companies. The data highlights how well these organisations manage key risk areas, such as email security, website security, and network security, all of which are critical in preventing cyber threats. UpGuard assigns a Security Rating by analysing various risk factors, with lower scores given more weight to reflect the importance of addressing weaknesses. Each company’s score is calculated on a scale of 0 to 950 and grouped into letter grades, where an ‘A’ represents strong cybersecurity performance. The report assesses 10 risk categories and includes a year-over-year comparison to assess the overall security performance of the ASX 200.
ABOUT UPGUARD
Born in Hobart, Australia and scaled in Silicon Valley, UpGuard is a cybersecurity platform that helps global organisations prevent data breaches, monitor third-party vendors, and improve their security posture. Using proprietary security ratings, world-class data leak detection capabilities, and powerful remediation workflows, UpGuard proactively identifies security vulnerabilities for organisations of all sizes.
PRESS CONTACT
Charlotte Hartley-Wilson
PR Manager
charlotte.hartley-wilson@upguard.com
