Australian cyber agency urges security over keeping services online as AI speeds attacks

Keeping an online service running may have to give way to making it safe. Australia’s government urged organisations on October 26 to prepare for service disruptions and put security first, alongside the Australian Signals Directorate’s annual threat assessment. The agency warns that AI is helping attackers find and exploit weaknesses faster and at greater scale.

A faster threat environment

The 2025–26 Annual Cyber Threat Report describes AI as the defining force in the past year’s cyber threat landscape. The government says malicious actors are using it to identify vulnerabilities faster, then exploit them with greater speed, sophistication and reach. The objectives remain concrete: gathering intelligence, stealing money and disrupting systems.

The risks extend beyond criminals deliberately directing AI at a target. The government’s release also identifies unintended actions by AI agents and model testing as sources of new security risks. Separately, ASD says Australian government and private networks faced persistent breach attempts by state-based actors during the reporting year.

More than 1,500Cybersecurity incidents handled

ASD responded to more than 1,500 incidents in 2025–26, up more than 20% from the previous year and 36% over five years.

More than 4,400Notifications of potential malicious activity

Notifications rose almost 80%, including mass notifications to more than 2,100 entities.

The wider cybercrime burden also reached individuals and businesses. ASD received more than 82,000 cybercrime reports, averaging one every six minutes, and answered more than 37,500 hotline calls. Average self-reported cybercrime costs were $33,000 for individuals and $93,500 for businesses. Those figures describe reported costs, rather than an independent calculation of losses.

AI defence still needs maintained systems

ASD director general Abigail Bradshaw’s response is to bring AI into defence, not leave it solely in attackers’ hands. “We need AI tools to help automate our defences to stay ahead of AI-enabled attackers,” she said on Monday, according to the Guardian. She also called for faster modernisation of Australia’s technology and cybersecurity foundations.

The agency says integrating AI into cybersecurity could help defenders find weaknesses, spot suspicious behaviour and improve responses. These are potential defensive uses, not a guarantee that installing an AI tool will secure a network. ASD also frames cybersecurity as a core business risk and a leadership responsibility, rather than only a technical concern.

Bradshaw singled out older technology as one of the biggest risks and most attractive targets for hackers. That includes systems and devices whose makers no longer supply updates. Her warning places basic maintenance alongside advanced defensive tools: organisations are being urged to modernise the systems those tools would help protect.

The next move falls to network owners

The report sets out five essential actions for organisations. Its recommendations span immediate visibility into network activity, replacement of outdated equipment and preparation for emerging technologies. AI readiness is one part of that programme, alongside supply-chain security and the prospect that quantum computing may compromise current encryption.

• Log all cyber events.
• Replace legacy technology.
• Manage supply-chain risks.
• Strengthen AI preparedness.
• Prepare now for quantum computing.

The government is also asking entities to lower their thresholds for reporting to ASD, while the agency urges organisations to seek help and report suspicious incidents. Existing cooperation is substantial: ASD’s Cyber Security Partnership Program grew to more than 149,500 partners, and its threat-sharing network distributed more than one million indicators of compromise to hundreds of Australian partners.

For service operators, the difficult instruction concerns what happens while weaknesses are addressed. Bradshaw and defence minister Richard Marles say security should take precedence over availability. That could mean temporarily taking services offline while they are secured—a disruption the government wants businesses to prepare for, rather than treating uninterrupted access as the overriding goal.