AISA warns: Fix cyber basics before buying AI security

By Elena Vasquez

The Australian Cyber Security Centre responded to more than 1,500 cyber security incidents in 2025–26, up more than 20 per cent from the previous year, the Australian Signals Directorate (ASD) reported.

Notifications to organisations about potentially malicious cyber activity rose almost 80 per cent. Australians reported cybercrime about every six minutes.

On 9 November 2026, the Australian Information Security Association (AISA) warned against putting AI cyber defence ahead of basic security work. Dr Rajiv Shah, AISA's spokesperson, put the position plainly:

"The measure of successful cyber security is how much risk you reduce, not whether you're using the latest AI tools," Shah said.

Shah's warning followed ASD's release of its annual cyber threat report. For AISA, the practical stakes are budget and staffing: leaders must reduce known exposure before adding another control that demands attention.

What is AISA warning organisations about?

AISA said many organisations still face avoidable weaknesses. The list includes unpatched vulnerabilities, unnecessary internet exposure and poor visibility across systems and software.

The association argued that leaders should address those weaknesses before committing significant resources to AI-based security products.

Shah said AI was becoming more important in both cyber attacks and defensive systems. But he cautioned that the label covers tools with different uses.

"ASD is right to highlight the growing role of AI in cyber attacks and defences.

But its advice to embrace AI for cyber defence is ambitious for organisations that are still struggling to get the fundamentals right.

They should also realise there are many different types of AI cyber defence, and not all are the right fit for every organisation.

AI offers enormous opportunities to improve our defences, particularly as criminals use automation to launch attacks faster and at greater scale.

But there's little point investing in sophisticated AI systems if you're leaving known vulnerabilities unpatched or exposing systems to the internet unnecessarily.

Organisations need to know what technology they have, what software they're running, where their vulnerabilities are and which systems actually need to be connected to the internet.

These are established cyber security practices, and they remain some of the most effective defences against increasingly automated attacks," Shah said.

That sequence defines AISA's approach. An AI purchase cannot substitute for knowing what an organisation owns, which software it runs or what remains exposed, the association said.

AI may still help, particularly as criminals automate attacks, Shah said. AISA's condition is measurable improvement, not adoption for its own sake.

Against more than 1,500 incident responses in 2025–26, AISA argued that spending should start with weaknesses defenders can name, understand and fix.

Why are staffing and support part of the risk?

AISA also used the report to highlight pressure on cyber security staff. The association said boards and executives should consider whether teams have the resources and support needed to manage a more demanding threat environment.

"Behind every cyber defence system are people who have to keep it operating, investigate threats and respond when something goes wrong.

Cyber security professionals are working in an environment where attacks are becoming faster and more complex, and the pressure to identify and respond to threats continues to grow.

Organisations cannot expect their cyber security teams to absorb that pressure indefinitely.

They need adequate staffing, access to professional development, realistic workloads and support for their wellbeing.

Before asking them to add extra tools or 'just adopt AI', organisations need to be confident these will help, not distract from their everyday challenges.

Looking after the people responsible for cyber security is an important part of maintaining effective defences," Shah said.

Shah's warning links AI adoption to operational capacity. Behind every new control, teams still need people to operate it, investigate threats and respond when something goes wrong, he said.

That makes workforce planning part of cyber security spending, AISA said. The figures showed the pressure facing organisations, but did not change the need for discipline on the basics, Shah said.

The numbers sharpen the case. ACSC's incident response total grew by more than 20 per cent, while notification activity rose almost 80 per cent.

Shah said teams need confidence that extra tools will help, not distract from their everyday challenges. That requirement applies before any further rollout of AI security systems.

What should leaders check before buying AI security?

AISA said directors and senior leaders should review existing arrangements before backing new technology spending. It pointed to asset inventories, timely patching, access controls and reducing unnecessary internet connections as areas needing immediate attention.

"Every organisation should be asking some fairly straightforward questions.

Do we have a complete inventory of our systems and software?

Are we patching vulnerabilities promptly?

Are we removing unnecessary internet connections?

Are our access controls effective?

If the answer to those questions is no, that's where the immediate attention needs to go.

AI can be an important part of the solution, but organisations need to make informed decisions about where it will deliver measurable improvements in security.

'Using AI' is not a universal fix for all cyber problems," Shah said.

Shah did not oppose AI. He called it potentially important, while rejecting it as a universal answer.

The questions turn procurement into an audit of existing risk. They also define AISA's threshold for AI: a specific, measurable improvement rather than a general promise.

AISA said new tools must help, not distract from daily challenges. Organisations need informed evidence about where an AI system will reduce risk, rather than a broad claim that it makes security better.

When should cyber security enter procurement?

AISA said cyber security should enter system design and purchasing decisions before new technology is installed. The association also said organisations often underestimate the ongoing costs of maintenance, software updates and new vulnerabilities.

"Cyber security needs to be considered when systems are designed and purchased, rather than after they're installed.

Too often, organisations invest in new technology without adequately accounting for the people, time and resources needed to maintain it, keep software updated and manage emerging vulnerabilities.

Every new system creates an ongoing security responsibility.

That needs to be built into budgets, procurement decisions and operational planning from the outset.

Organisations also need to be clear on the expectations they have for their vendors to provide systems that are secure by default and by design, and on those vendors' commitment to ongoing support," Shah said.

Shah's procurement test covers both the purchase and its afterlife. Buyers need staff, time and resources for maintenance, updates, emerging vulnerabilities and vendor support.

That makes secure design and ongoing support purchasing criteria, not post-launch cleanup, AISA said. Every new system carries continuing obligations for the organisation that bought it.

The threat environment gives that principle immediate weight. AISA had also pointed to more than 1,500 incidents, almost 80 per cent more notifications and faster automated attacks.

AISA also said each new system creates an ongoing security responsibility. Budgets, procurement and operations must account for it from the outset, not after installation.

Who is accountable for cyber security?

AISA said cyber security responsibility extends beyond technical teams to boards, executives and frontline staff. Leaders need to understand organisational exposure and ensure appropriate support is in place.

"Cyber security is everyone's business.

Boards and executives need to understand their organisation's exposure and ensure the right resources are available.

Staff need to understand their responsibilities, and technical teams need the support and authority to do their jobs effectively.

Australia has a highly skilled cyber security community, including AISA's 14,000 members, with expertise spanning organisations of every size and sector.

That expertise is available to help organisations understand their risks, strengthen their defences and make sensible decisions about emerging technologies.

The latest threat report is a clear reminder that cyber risks are growing.

Our response needs to be practical, sustained and focused on the measures that genuinely make organisations safer," Shah said.

For organisations weighing AI security spending, AISA set a practical standard: measurable risk reduction, supported by people and basic controls. New tools will have to show that result without distracting teams from known weaknesses.