Internal organizational friction, not technical shortcomings, stands as the primary obstacle slowing cyber incident response, according to Cisco's new Relentless Defence Report. Roughly 63 percent of Australian cybersecurity practitioners identified coordination delays, sluggish approval processes, and restricted data access as the main barriers holding back threat defense, rather than pointing to technology gaps. The findings reveal that structural issues within organizations are draining valuable response time when security teams face active threats.
The report documents that 93 percent of Australian organizations experienced a material, business-disrupting cyber incident within the past year, with over 37 percent involving attacks enhanced by artificial intelligence. Meanwhile, 40 percent of Australian practitioners report spending more time gathering and correlating information than actually addressing the threat itself. Globally, only 8 percent of organizations qualify as "relentless defenders" who coordinate teams effectively and maintain unified security visibility, while in Australia that figure drops to just 5 percent. Among Australian organizations, only 46 percent say they operate with security, networking, and IT teams working from a shared operational picture, compared to 83 percent of global relentless defenders.
Carl Solder, CTO of Cisco Australia and New Zealand, explained that the organizational blocker typically manifests as the gap between threat detection and having the information and authority to respond. A common scenario involves a security team spotting a compromised device but requiring the networking group to isolate it, another team to provide logs, and management to greenlight the response. "If ownership is unclear or those teams work in silos, valuable time is lost while the attacker continues operating," Solder stated. The report warns that as AI-driven threats arrive faster and with greater automation, coordinated response becomes even more critical because the window to investigate and act keeps shrinking.
The report argues that security teams can't resolve this problem independently when ownership, approval authority, and operational silos span IT departments, procurement, and executive leadership. AI tools can accelerate response times, but they require reliable data flows and clear operational guardrails—adding AI to a fragmented operation won't automatically repair the underlying dysfunction, according to Solder. The issue intensifies as manual handover processes and lengthy approval chains become genuine constraints when threats demand immediate action. Without shared visibility, defined responsibilities, and agreed protocols for taking action, decision rights remain unclear and data stays fragmented across teams.
Solder recommends that leadership fix ownership structures before deploying new tools, unify teams to build a single operational picture rather than multiple conflicting views, and grant personnel clear authority to act without bureaucratic friction. Change should begin with clarifying responsibilities—which can happen quickly—while connecting systems and revising approval processes requires sustained commitment across the entire business. For technology partners, opportunities exist to guide customers toward consolidating data, clarifying cross-team roles, integrating tools, and training staff to extract more value from existing investments, helping build coordinated security operations that can investigate, contain, and recover from threats faster. Organizations that rehearse their response plans before an actual incident will avoid discovering whether their procedures work only when an attacker is already operating inside their network. The structural divide between detecting danger and having permission to stop it will only widen as threats accelerate, turning internal bureaucracy into a competitive vulnerability that no amount of advanced technology can fully offset.