Australian Cyber Strategy: Security Over Availability

Essential online services in Australia may experience unexpected interruptions as organizations prioritize security repairs over continuous access, the Australian Signals Directorate (ASD) stated on Monday. The agency advised that protecting systems must take precedence, even if it requires taking services offline while technical work is completed.

In its annual threat report, ASD recorded 1,500 cybersecurity incidents during the 2025-26 period. This figure represents a 20% increase compared to the previous year. The agency also notified external organizations, including businesses, governments, and critical infrastructure operators, of more than 4,400 potentially malicious incidents. This notification count rose by 80% in the same timeframe.

The report identifies hostile foreign governments, criminals, and hackers as primary threats. These actors are using artificial intelligence to gather intelligence, interfere with critical infrastructure, and steal funds. ASD noted that state-based actors made persistent attempts to breach Australian government and private networks. The agency suggested that actors in the Indo-Pacific region may be conducting attacks in preparation for future conflicts, including intelligence gathering and disruption.

ASD director general Abigail Bradshaw said on Monday that Australia must accelerate improvements to its technology and cybersecurity foundations. She called for the use of AI tools to automate defensive work and help organizations stay ahead of attackers who use the same technology. Bradshaw previously discussed ASD’s access to Anthropic’s Mythos model. The developer stated it could not release the model publicly because it can identify previously unknown flaws in IT systems.

Defence minister Richard Marles and home affairs minister Tony Burke both emphasized the importance of improving protections using AI. Marles urged Australians to strengthen their defenses while leveraging new technologies. Burke said the government is preparing for the threats and opportunities associated with emerging technologies. Government agencies view access to advanced models and cooperation with AI laboratories as key to strengthening cyber defenses.

Bradshaw identified ageing technology as a major vulnerability, specifically systems whose makers no longer provide updates. Such equipment is an attractive target for hackers. Last week, newly identified weaknesses in PHP, the programming language used by most websites, prompted governments and businesses to rush fixes. ASD urged organizations to keep systems updated, report suspicious incidents, and seek its assistance.

Bradshaw and Marles reiterated that security should come before keeping systems online. This approach may require more services to be temporarily unavailable while organizations secure them. The agency's stance marks a clear shift in operational priorities, placing defensive measures above user access during periods of high threat.