The Australian Signals Directorate (ASD) warned that Australians should prepare for basic and important online services to go offline unexpectedly, urging that "system security must be prioritised over system availability." The agency stated that hostile foreign governments, criminals, and hackers are using artificial intelligence to gather intelligence, disrupt critical infrastructure, and steal money, advising that Australians should "fight fire with fire." The ASD's annual cyber threat report, released on Tuesday, revealed that the agency responded to 1,500 cybersecurity incidents in the 2025-26 year, marking a 20% increase from the previous year.
Furthermore, the ASD notified external entities, including businesses, governments, and critical infrastructure, of over 4,400 potential malicious cyber incidents, an 80% increase year-on-year. ASD noted that government and private networks in Australia experienced "persistent" breach attempts from state-based actors last year, with the agency claiming such actors in the Indo-Pacific could be preparing for future intelligence collection or disruption activities. ASD Director General Abigail Bradshaw stated, "We need AI tools to help automate our defences to stay ahead of AI-enabled attackers."
Bradshaw also warned that "legacy technology," such as outdated or unsupported systems, represents one of the biggest risks and most attractive targets for hackers. Defence Minister Richard Marles told reporters, "AI is here and it's real. People need to engage." The report indicated that AI has been "the defining force in the cyber threat landscape over the past year, allowing malicious actors to find vulnerabilities faster and exploit them at unprecedented scale, speed and sophistication."
The ASD also reported that in recent weeks, new threats have emerged from the unintended actions of AI agents and model testing. The agency advised that cybersecurity must now be considered a "core business risk and leadership responsibility" for all organizations, not merely a technical concern. Tony Burke, the minister for home affairs and cybersecurity, said the government was "positioning Australia to respond to the evolving threats and opportunities presented by emerging technologies."
The ASD called for all organizations to modernize technology and cybersecurity capabilities to ward off new threats, following recent vulnerabilities discovered in PHP, a programming language underpinning many websites. Bradshaw and Marles advised that organizations should prioritize system security over maintaining constant online availability. The ASD also mentioned that the agency has access to Anthropic’s Mythos model, a powerful AI tool that the frontier lab could not release publicly because it could identify unknown flaws in IT systems.
