Ensuring regulated entities are strengthening their resilience to AI-enabled cyber threats is APRA’s top supervision priority for 2026-27, according to the corporate plan it released on Wednesday, with APRA chair John Lonsdale warning that AI is “materially changing the global cyber threat landscape”.

“The risk management in this area is not keeping pace,” Lonsdale told a media conference that marked the plan’s release. “We also wanted to get boards and management thinking a lot more about crisis exercises and the need to get better at that.”

Lonsdale’s comments echoed those made by APRA executive director Jane Magill at the Conexus Retirement Leaders Summit on Tuesday, where she told asset owners that the emergence of frontier AI represents potential operational benefits but also amplifies risks including those posed by scams.

“For years now, APRA and other agencies have pushed trustees to strengthen their cyber controls and the persistent weaknesses exposed by last years’ credential stuffing attacks,” Magill said.

“Greater industry collaboration on this issue is important, especially in areas such as information sharing but, ultimately, you are responsible for the effectiveness of your funds’ cyber controls, the protection of your members’ assets and the ability to contain and recover from any potential attack.”

APRA is also assessing how entities identify and manage risks associated with the industry’s concentrated reliance on common technology platforms and material service providers, and will be “reinforcing minimum expectations” for managing geopolitical risk, which Lonsdale said was “the single biggest risk that’s increased recently”.

“We will be testing where entities are over the course of the year on geopolitical risks,” Lonsdale said on Wednesday. “It’s a really important set of issues in the class of non-financial risks that once upon a time was not focused on as much but which is now front and centre in APRA’s work.”

“I think what we were seeing was entities giving limited consideration to geopolitical risk as a risk class, and in particular, weren’t focusing on that as much as we wanted them to on viewing it as amplifier of existing risks.”

APRA will also be requiring selected large superannuation trustees to appoint an independent party to undertake a deep dive review of their valuation governance practices, with Lonsdale saying the work was a “continuation” of its work on investment governance.

“We’re concerned about whether the market valuations are actually the right ones, the opaqueness of the market, whether they actually performance in times of stress, and I think that’s just a continuation of the testing that we’re doing.”