Australia's Cyber Agency Orders Shift Toward Security Over Service Availability

The Australian Signals Directorate (ASD) released its annual cyber threat report on Tuesday, outlining a landscape where digital threats are becoming more sophisticated and frequent. The agency’s central warning is that Australians should expect key online services to go offline unexpectedly in the coming period.

ASD director general Abigail Bradshaw stated that system security must be prioritised over system availability. This directive implies that businesses and critical infrastructure operators may need to take services down to patch vulnerabilities rather than keeping them running with known weaknesses. The report marks a shift in operational guidance, moving away from a preference for constant uptime toward a preference for defensive integrity.

The report details a sharp increase in the volume of cyber activity. ASD responded to 1,500 cybersecurity incidents during the 2025-26 financial year, a 20% increase from the previous period. The agency also notified external entities, including businesses, government bodies, and critical infrastructure providers, of more than 4,400 potential malicious cyber incidents. This figure represents an 80% year-on-year rise in detected threats.

The surge in activity is linked to the growing use of artificial intelligence by hostile actors. ASD warns that foreign governments, criminal groups, and hackers are using AI to gather intelligence, disrupt infrastructure, and steal funds more rapidly. The agency argues that defenders must use similar AI tools to automate their responses and stay ahead of these AI-enabled attackers.

Specific attention was given to state-based actors, particularly those in the Indo-Pacific region. ASD reported that these actors launched persistent breach attempts against Australian government and private networks. The agency suggested these actions may be preparatory steps for future conflicts, involving intelligence collection or disruption activities. ASD characterized the current threat environment as elevated for all network owners.

The report identifies legacy technology as a primary risk factor. Bradshaw noted that outdated systems or devices no longer supported by their creators are attractive targets for hackers. The agency called for a modernisation of technology and cybersecurity foundations across the country. This includes updating systems and seeking assistance from ASD to address suspicious incidents.

The discussion of AI defence capabilities includes the use of frontier models. Bradshaw has previously discussed ASD’s access to Anthropic’s Mythos model, a tool that can identify unknown flaws in IT systems but has not been released publicly. Australian government agencies view collaboration with leading AI labs as critical to bolstering national defence. The report suggests integrating such tools can help detect weaknesses and suspicious behaviour more effectively.

The recent discovery of vulnerabilities in PHP, a programming language underlying most websites, has accelerated the push for updates. Governments and businesses rushed to fix the problem last week, illustrating the urgency of the situation. ASD urged organisations to treat cybersecurity as a core business risk and a leadership responsibility, rather than solely a technical concern.

Defence Minister Richard Marles commented on the report’s release, stating that Australians must enhance their cyber defences while harnessing the benefits of AI. Home Affairs and Cybersecurity Minister Tony Burke added that the government is positioning the country to respond to the threats and opportunities presented by emerging technologies. Both ministers supported the agency's stance that collective action is necessary in the current threat environment.

The report concludes that AI is expected to accelerate these dangers in the future. While ASD acknowledges that AI creates positive opportunities, it also allows malicious actors to find vulnerabilities and launch attacks faster. The agency’s guidance for organisations is clear: update systems, report suspicious incidents, and accept that security measures may require temporary service outages.