Australian cyber chief says expect service shutdowns to fix security

Australians may face more unexpected interruptions to online services as organizations take systems offline to fix security gaps. The Australian Signals Directorate (ASD) stated in its annual cyber threat report that protecting systems must take precedence over maintaining access, even if that requires temporary outages.

The agency reported handling 1,500 cybersecurity incidents during the 2025-26 fiscal year. That figure represents a 20% increase over the previous year. ASD also notified external organizations, including businesses and critical infrastructure operators, of more than 4,400 potentially malicious incidents. That notification count rose by 80% in the same period.

The report attributes the rise in threats to hostile foreign governments, criminals, and hackers using artificial intelligence. These actors are using AI to collect intelligence, interfere with infrastructure, and steal money. ASD noted that state-based actors have made persistent attempts to breach Australian government and private networks over the past year. The agency suggested that actors in the Indo-Pacific region may be conducting attacks in preparation for future conflicts.

ASD director general Abigail Bradshaw said on Monday that Australia needs to accelerate improvements to its technology and cybersecurity foundations. She argued that organizations should use AI tools to automate defensive work and identify vulnerabilities. Bradshaw previously discussed ASD’s access to Anthropic’s Mythos model, which the developer has kept private because it can identify previously unknown flaws in IT systems.

Government officials echoed the call for stronger defenses. Defence minister Richard Marles urged Australians to improve their protections while utilizing AI. Home affairs and cybersecurity minister Tony Burke said the government is preparing for the threats and opportunities associated with emerging technologies.

Bradshaw identified ageing technology as a major vulnerability, particularly systems whose makers no longer provide updates. Last week, newly identified weaknesses in PHP, the programming language used by most websites, forced governments and businesses to rush patches. ASD urged organizations to keep systems updated, report suspicious incidents, and seek assistance when needed.

Bradshaw and Marles maintained that security must come before keeping systems online. They acknowledged that this approach may result in more services being temporarily unavailable while organizations secure their infrastructure.