UpGuard’s ASX 200 Cybersecurity Report: 1 in 10 ASX 200 Companies Already Infected by Dark Web Infostealers

https://uk.finance.yahoo.com/news/upguards-asx-200-cybersecurity-report-225000231.html

Publish Date: 2026-05-19 18:50:00

Although there was a slight improvement in the ASX 200’s security rating, it was driven by post-incident security fixes, not proactive strategy

HOBART, Australia, May 20, 2026 /PRNewswire/ — UpGuard, a leader in cybersecurity and risk management, released its annual ASX 200 Cybersecurity Report, which measures the cyber risk exposure of Australia’s largest listed companies. Based on daily scanning of billions of data points, UpGuard benchmarked external security posture on a 0–950 scale, finding the average score for the ASX 200 was 728.5 in 2025, equating to a B rating, and showing a 1.58 percent improvement from 2024. However, the report also found that 10 percent of the ASX 200 had active, verified infostealer infections. In addition, the research identified a trend where security scores typically remain stagnant until a major global security issue, such as the CrowdStrike outage, triggers a brief spike in remediation activity. However, these reactive security improvements often subside within months as organizational priorities shift.

UpGuard

Key Findings from the 2025 Report:

Identity is the primary attack vector: 1 in 10 ASX 200 companies had high confidence that credentials were circulating in infostealer logs, with 71 percent of these infections concentrated in the largest organizations.
Supply chain cascade risk: The majority of ASX 200 rely on the same core SaaS platforms, creating a cascade effect where a single vendor vulnerability can exploit hundreds of companies.
Encryption is the weakest link for the second year running: Encryption is the lowest-scoring technical category, leaving data privacy at significant risk.
Sector leaders and laggards: Information Technology (776) and Utilities (769) lead the index, while the Materials sector (673) continues to rank lowest in overall security posture.
Attack surface volatility: In every security category, nearly a third of companies ended up in a worse position than in 2024.

…

Source