THE CRUNCH
Australians should expect more basic and important online services to go offline unexpectedly, the Australian Signals Directorate has warned, arguing that "system security must be prioritised over system availability". In its annual cyber threat report, released on Tuesday, the agency said artificial intelligence is enabling more dangerous threats than ever, with hostile foreign governments, criminals and hackers using AI to gather intelligence, disrupt critical infrastructure and steal money. ASD director general Abigail Bradshaw said AI tools were needed to automate defences to stay ahead of AI-enabled attackers, and that Australia must accelerate the modernisation of its technology and cybersecurity foundations.
The report recorded 1,500 cybersecurity incidents responded to in 2025-26, up 20% on the previous year, and more than 4,400 notifications to external entities about potential malicious cyber incidents, an 80% rise. AI is expected to accelerate those dangers further. The agency said government and private networks faced "persistent" breach attempts from state-based actors, and claimed actors "in the Indo-Pacific" could be launching attacks to prepare for potential future conflicts.
Bradshaw identified "legacy technology", such as outdated systems no longer receiving updates, among the biggest risks and most attractive targets for hackers. The report also pointed to a recent example of the kind of disruption in question: newly discovered vulnerabilities in PHP, the programming language that underpins most websites, last week triggered a rush by governments and businesses to patch their systems.
ASD said cybersecurity is now a "core business risk and leadership responsibility" for all organisations rather than a purely technical concern, and urged them to update systems, seek help from the agency and report suspicious incidents. Bradshaw and defence minister Richard Marles said prioritising security over availability could mean more services are forced offline while they are secured.