Australia's ASD Says 1,500 Cyber Incidents in 2025-26

The Australian Signals Directorate (ASD) handled 1,500 cybersecurity incidents during the 2025-26 financial year, a 20% increase over the prior year, according to its annual cyber threat report published Monday. The agency also notified businesses, government agencies, and critical infrastructure operators of more than 4,400 potentially malicious incidents, an 80% rise year over year.

The ASD warned that hostile foreign governments, criminal groups, and hackers are using artificial intelligence to gather intelligence, interfere with critical infrastructure, and steal funds. It reported persistent attempts by state-based actors to breach Australian government and private networks over the past year, and noted that actors in the Indo-Pacific could be conducting attacks in preparation for possible future conflicts, including intelligence gathering or disruption.

The report stated that AI helps attackers identify weaknesses and execute operations more quickly. It advised treating cybersecurity as a core business risk and a responsibility of organizational leaders, and urged businesses and critical infrastructure operators to adopt advanced AI models for defense, including tools that can identify vulnerabilities, detect suspicious activity, and improve incident response.

ASD director general Abigail Bradshaw said Monday that Australia needs to accelerate improvements to its technology and cybersecurity foundations. She called for AI tools to automate defensive work and help organizations keep pace with attackers using the same technology. Bradshaw previously discussed ASD's access to Anthropic's Mythos model, which the developer said it could not release publicly because of its ability to identify previously unknown flaws in IT systems.

Bradshaw identified ageing technology as a major vulnerability, particularly systems and devices whose makers no longer provide updates. The report stated such equipment presents an attractive target for hackers. Last week, newly identified weaknesses in PHP, the programming language underpinning most websites, prompted governments and businesses to address the problem.

The ASD urged organizations to keep systems updated, report suspicious incidents, and seek its assistance. Bradshaw and Defence Minister Richard Marles said security must come before keeping systems online, potentially requiring more services to be temporarily unavailable as organizations secure them.