Cybersecurity threats to financial advice businesses extend well beyond technology, with human behaviour, artificial intelligence and inadequate governance among the vulnerabilities advisers need to address, according to Australian cybersecurity specialist Fraser Jack.
Speaking at the 2026 Australian Advisory Conference in Adelaide recently, Jack, founder of The Cyber Collective, outlined five principal avenues through which criminals could compromise an advice business:
- Human behaviour: Exploiting employees through deception, impersonation and social engineering
- Digital systems: Targeting software, accounts and technology infrastructure
- Interception: Capturing communications or sensitive information
- Physical access: Gaining unauthorised access to premises or devices
- Supply chains: Exploiting vulnerabilities in third-party service providers
While technology attracts much of the cybersecurity budget, Jack suggested to advisers the human element deserves considerably more attention.
People remain the biggest vulnerability
He told the Australian delegates that human behaviour was involved in approximately 95% of cybersecurity incidents, citing research suggesting 60% resulted from human mistakes.
He explained how criminals research advice practices through publicly available information, including LinkedIn profiles, company websites and relationships with licensees.
This information can then be used to impersonate trusted contacts and distribute convincing fraudulent communications.
An email apparently originating from a licensee’s compliance department, urgently requesting information about a client complaint, was one example Jack provided.
He said such attacks often exploit emotional responses that override normal caution.
AI creates new threats
Jack also highlighted the increasing sophistication of AI-enabled attacks, including voice cloning, deep-fake videos and automated attempts to exploit business systems.
He demonstrated how criminals could reproduce someone’s voice using publicly available recordings, potentially impersonating business owners or colleagues to obtain confidential information.
Importantly, he warned that businesses choosing not to adopt AI were not insulated from AI-related cybersecurity threats.
A simple procedure for suspicious telephone calls: politely terminate the conversation and independently contact the organisation using a verified telephone number…
Among his practical recommendations was a simple procedure for suspicious telephone calls: politely terminate the conversation and independently contact the organisation using a verified telephone number.
Cybersecurity is a governance responsibility
Jack referred to ASIC’s proceedings against Australian financial services licensee Fortnum Private Wealth, highlighting the regulatory consequences of inadequate cybersecurity oversight and supervision.
He emphasised that the regulatory action concerned governance and risk management shortcomings, more than it did with the cyber breach itself.
Jack also cautioned advisers about vulnerabilities associated with third-party providers holding sensitive client information.
Drawing a comparison with the mining industry’s emphasis on workplace safety, Jack suggested cybersecurity should become a routine consideration across advice businesses.
He identified three essential elements of effective protection:
- Technology: Implementing appropriate cybersecurity systems and controls
- Staff education: Providing ongoing training to recognise and respond to threats
- Documentation: Maintaining evidence that cybersecurity responsibilities are being fulfilled
Jack also encouraged practices to review their cyber liability insurance arrangements, particularly whether licensee-held policies adequately protected individual advice businesses.
His overarching message was that advisers hold exceptionally sensitive client information, making cybersecurity a responsibility shared by business owners, directors and every member of the advice practice team.