A warning that services may go dark

The ASD annual cyber threat report carries a blunt message for Australians: more basic and important online services may go offline unexpectedly, because system security must be prioritised over system availability.

Director general Abigail Bradshaw and defence minister Richard Marles both said organisations should put the security of their systems ahead of keeping them online, a shift that could force more services offline while they are secured. ASD also warned that all network owners are facing elevated threat levels, and that cybersecurity is now a core business risk and leadership responsibility for every organisation, not merely a technical matter for IT staff.

AI on both sides of the attack

The report warns that hostile foreign governments, criminals and hackers are using AI to gather intelligence, disrupt critical infrastructure and steal money. It describes AI as enabling more dangerous threats than ever before. According to ASD, the ready availability of AI lets cybercriminals and state-based actors find vulnerabilities and launch attacks faster and more effectively, though the technology also creates positive opportunities.

Bradshaw said on Monday that AI tools were needed to automate defences against AI-enabled attackers.

She said that to strengthen Australia's cyber defences, the country must harness the technologies reshaping the threat environment. The report notes that integrating AI tools into cybersecurity functions could help identify weaknesses or suspicious behaviour and improve responses.

Incidents and state-based actors

The report, released on Tuesday, records a sharp rise in Australia cybersecurity threats over the 2025-26 year:

• •ASD responded to 1,500 cybersecurity incidents, an increase of 20% on the previous year
• •ASD notified external entities, including businesses, governments and critical infrastructure, of more than 4,400 potential malicious cyber incidents, up 80% in a year
• •Australian government and private networks experienced persistent breach attempts from state-based actors

ASD claimed state-based actors in the Indo-Pacific could be launching attacks to prepare for potential future conflicts, including future intelligence collection or disruption activities.

Legacy technology and what to do next

Bradshaw identified legacy technology, such as outdated systems or devices no longer receiving updates, as among the biggest risks and most attractive targets for hackers. The report calls for Australia to modernise its technology and cybersecurity capabilities, and says all organisations must take stronger action to ward off new threats. Bradshaw said Australia must accelerate the modernisation of its technology and cybersecurity foundations to protect everyday systems.

The urgency of that advice was underlined last week, when newly discovered vulnerabilities in PHP, a programming language underpinning most websites, triggered a rush by governments and businesses to fix the problem.

ASD urged organisations to update their systems, seek help from ASD and report suspicious incidents. Bradshaw said, "In a threat environment transformed by AI, collective action is our strongest defence".