Australia's Cyber Agency Warns: Expect Outages as AI-Fueled Attacks Surge

Australians should expect basic and important online services to go offline unexpectedly, because the nation's signals intelligence agency has concluded that "system security must be prioritised over system availability." The Australian Signals Directorate (ASD), the government body responsible for signals intelligence and cybersecurity, delivered that warning in its annual cyber threat report released on Tuesday, alongside a stark set of numbers: 1,500 cybersecurity incidents responded to in the 2025-26 year, a 20% increase on the previous year, and more than 4,400 notifications of potential malicious cyber incidents sent to external entities, up 80% in twelve months.

The story matters beyond Australia's borders. It is one of the clearest signals yet from a Five Eyes-aligned intelligence agency that artificial intelligence has changed the economics of cyber offence, and that defenders, including governments and critical infrastructure operators, must adopt the same frontier technology to keep pace. ASD's answer is not merely defensive hardening. It is a call to reorganise how organisations weigh uptime against security, accepting deliberate outages as the price of resilience.

What did ASD actually report?

The annual report, released on Tuesday and previewed by ASD's director general, Abigail Bradshaw, on Monday, contains the agency's most direct assessment to date of AI's role in the threat environment:

• 1,500 cybersecurity incidents responded to by ASD in the 2025-26 year, a 20% rise year on year.
• More than 4,400 notifications of potential malicious cyber incidents to external entities, including businesses, governments and critical infrastructure, an 80% increase in a year.
• Persistent breach attempts against government and private networks from state-based actors throughout the year.
• A warning that such actors "in the Indo-Pacific" could be launching attacks to prepare for potential future conflicts, including "future intelligence collection or disruption activities."

ASD stated plainly that hostile foreign governments, criminals and hackers are using AI to gather intelligence, disrupt critical infrastructure and steal money. The agency expects AI to accelerate those dangers in future. The increasing availability of AI, the report noted, is creating positive opportunities, but it is also allowing cybercriminals and state-based actors to find vulnerabilities and launch attacks faster and more effectively.

Why is the director general calling for AI-driven defence?

Bradshaw's position is that Australia cannot defend AI-enabled attackers with manual processes. Her language is unambiguous.

"We need AI tools to help automate our defences to stay ahead of AI-enabled attackers," Bradshaw said on Monday.

"Australia must accelerate the modernisation of its technology and cybersecurity foundations to protect the systems we rely on every day."

The report argues that integrating AI tools into cybersecurity functions could help organisations find potential weaknesses or suspicious behaviour, and improve their responses to incidents. Bradshaw framed this as an obligation rather than an option: "To strengthen our cyber defences, we must harness the technologies that are reshaping the threat environment."

There is a concrete precedent behind that argument. Bradshaw has spoken previously about ASD having access to Anthropic's Mythos model, a powerful AI tool which the frontier lab (a company building AI systems at the current capability frontier) said it could not release publicly because it could identify unknown flaws in IT systems. While malicious actors' use of AI is rising, Australian government agencies believe having access to such frontier models, and collaborating with leading AI labs, is critical to bolstering cybersecurity. In effect, ASD is running a dual-track policy: restricting nothing on the offensive side of the market it can influence, while securing privileged access to the most capable defensive models before they reach general release.

Who is being told to act, and how?

ASD's warning is aimed at every organisation with a network, not just banks and utilities. The agency said "all network owners are facing elevated threat levels," and declared that cybersecurity is now a "core business risk and leadership responsibility" for all organisations, no longer only a technical concern.

Bradshaw singled out "legacy technology" — outdated systems or devices no longer supported with new updates by their creators — as among the biggest risks and the most attractive targets for hackers. ASD called for Australia to modernise its technology and cybersecurity capabilities, and said all organisations must take stronger action to ward off new threats.

The urgency is not abstract. Last week, newly discovered vulnerabilities in PHP, a programming language that underpins most websites, triggered a rush by governments and businesses to fix the problem. ASD urged organisations to update their systems, seek help from ASD and report suspicious incidents.

What did the ministers say?

Two cabinet-level figures reinforced the message on the report's release. The defence minister, Richard Marles, aligned himself with ASD's AI-forward posture: "To stay ahead, Australians must enhance their cyber defences while harnessing AI's benefit." Tony Burke, the minister for home affairs and cybersecurity, said the government was "positioning Australia to respond to the evolving threats and opportunities presented by emerging technologies."

The joint message from Bradshaw and Marles carries the report's most operationally significant implication: organisations should prioritise the security of their systems over keeping them online. That principle could mean more services are forced to go offline while they are secured, a deliberate trade of availability for safety that will be felt by ordinary users of banking, health and government digital services.

What happens next?

ASD's closing argument is about scale of response, not technology alone. "In a threat environment transformed by AI, collective action is our strongest defence," Bradshaw said. With incident counts rising 20% and notifications up 80% in a single year, and with AI expected to accelerate both trends, the report positions modernisation and AI-assisted defence as the baseline expectation for every Australian organisation in the coming cycle.