Australian firms face cyber supply chain risk gaps

BSI has found that 40% of Australian organisations suffered cyber incidents that affected their supply chains in the past 12 months. The research also found that 60% still manage supply chain risk reactively.

The findings point to a gap between expectations and operational readiness. While 87% of respondents expected to be better prepared for disruption over the next 12 months, only 21% said they could act on the same day a disruption hit. A further 27% said they did not follow a pre-agreed crisis plan during their most recent disruption.

BSI's study drew on responses from more than 1,400 managers in supply chain, finance, procurement, operations and legal roles across several markets, including Australia. Australian organisations also faced climate-related disruption, geopolitical instability, transport disruption and raw material shortages over the past year.

Cyber risk stood out alongside those physical pressures. Two-thirds of business leaders surveyed, or 67%, said artificial intelligence would increase the risk of theft and cybercrime in supply chains. Fewer than half, or 44%, said they felt fully prepared to handle severe technology failures or cyber incidents.

Visibility gaps

Weak visibility across supplier networks is limiting companies' ability to respond quickly. Only 34% of organisations said they had complete visibility of supplier locations and geographic exposure, while 35% cited a lack of timely and accurate data as a barrier to responding to supply chain threats.

Internal coordination was another weak point. Four in 10 organisations said silos and poor cross-functional coordination hindered effective decision-making, while 20% reported conflicting priorities between teams and departments.

Clear communication procedures were also often missing. Just 37% said they had clear protocols for cross-functional communication when disruptions arise, meaning 63% lacked defined arrangements for crisis coordination.

Governance problems extended to formal risk processes. Nearly half of organisations, or 49%, said they did not have a documented process for managing supply chain risks, while 45% said slow or unclear approval processes were preventing decisions.

Delayed response

Even among businesses with an always-on crisis response team, activation was not always immediate. BSI found that 38% of those organisations could take up to three days to activate their response systems.

That delay can add pressure when disruption is caused by digital outages or freight interruptions in tightly connected logistics systems. In Australia, interstate freight networks rely heavily on digital tracking and automated logistics hubs, increasing the operational impact when data systems or physical infrastructure fail.

The research suggests many companies are trying to adapt their supply chains rather than simply recover from the last shock. Among respondents, 82% said they planned to increase strategic inventory stockpiles, 84% intended to change transport modes, and 79% said they were moving key operations closer to home.

Other planned responses included seeking new supplier networks, reducing product ranges and changing trade routes. At the same time, only 39% said they felt fully prepared for geopolitical shocks, 40% for raw material shortages and 44% for cyber incidents.

BSI said the findings showed a divide between stated plans and execution during live events, including the recent Iran-Israel conflict. More than a quarter of organisations surveyed said they did not follow their agreed crisis plans during that period.

Price pressure is also emerging as a likely consequence. Nearly a third of organisations, or 33%, said they planned to increase prices over the next six months to offset supply chain costs.

Tony Pelli, Practise Director of Supply Chain Resilience at BSI, said: "2026 has been the hottest summer on record for several countries, and with conditions set to remain volatile into 2027 due to El Niño patterns, the human element of these disruptions is stark. A set of unrelenting environmental and geopolitical ruptures means that supply chain breakdown directly impacts everyday lives. When networks fail, people ultimately bear the burden through rising shelf prices and an inability to access the essential goods they rely on."

Charlene Loo, Managing Director of BSI Australia, said: "The research shows that while many organisations expect to be better prepared for disruption over the next 12 months, most are still managing supply chain risk reactively. As Australia approaches another hot summer with an increased risk of severe bushfires, relying on ad hoc responses leaves businesses vulnerable to major operational bottlenecks and spiralling costs.

"Building true resilience requires closing the gap between intention and execution. For Australian businesses preparing for seasonal climate shocks, this means moving away from reactive crisis management toward strengthening scenario planning, improving cross-functional coordination, and establishing clear supply chain visibility so leaders can act quickly and decisively when disruption hits."