ASD warns of more unplanned outages as AI-enabled cyber threats rise

Australians should expect more basic and important online services to drop out without warning, the Australian Signals Directorate has said, arguing that "system security must be prioritised over system availability". The message is in ASD's annual cyber threat report, which says foreign governments, criminals and hackers are turning to AI to collect intelligence, disrupt critical infrastructure and steal money.

ASD dealt with 1,500 cybersecurity incidents in 2025-26, a rise of 20 per cent on the year before, the report says. It also alerted outside organisations, among them businesses, governments and critical infrastructure operators, to more than 4,400 potential malicious cyber incidents, an increase of 80 per cent in a year. The agency expects AI to speed up these dangers.

Networks in government and the private sector faced persistent attempts at intrusion by state-backed actors last year, ASD said. It suggested that some of those actors in the Indo-Pacific may be positioning for possible future conflicts. Greater access to AI brings opportunities, the agency said, but also helps criminals and state actors find weaknesses and strike faster and more effectively. ASD said every network owner now faces higher threat levels and that cybersecurity has become a "core business risk and leadership responsibility" rather than only a technical issue.

ASD director general Abigail Bradshaw said defenders need to use AI as well. "We need AI tools to help automate our defences to stay ahead of AI-enabled attackers," Bradshaw said. According to the report, building AI into security work can help spot weaknesses or suspicious behaviour and improve response. Bradshaw has previously said ASD has access to Anthropic's Mythos model, which the company said it could not release publicly because it can identify unknown flaws in IT systems. Australian government agencies consider access to such frontier models, and working with leading AI labs, critical to strengthening cybersecurity.

Bradshaw said legacy technology, such as outdated systems or devices their makers no longer update, is among the biggest risks and most attractive targets for hackers. ASD called on Australia to modernise its technology and cyber capabilities, and urged organisations to patch systems, seek its help and report suspicious incidents. Bradshaw and Defence Minister Richard Marles said organisations should rank the security of systems above keeping them running, which could mean more services are pulled offline while being secured. The report follows newly found vulnerabilities in PHP, which underpins most websites, that sent governments and businesses scrambling to fix the problem.