AI will help us improve cyber defence over time; however, it also accelerates the speed, scale and sophistication of cyber threats. These technologies can generate text, code, images and video, and automate repetitive or complex tasks to improve efficiency and productivity. However, as Australian organisations integrate AI and large language models into their environments, new and potentially exploitable security risks are emerging, expanding their overall opportunities – or our attack surface.

Over the last financial year, ASD’s ACSC has observed the increased risks and exposure that advances in AI models have introduced into Australian organisations.

Social engineering is a longstanding and evolving threat to individuals and organisations within Australia, and one that enables malicious cyber actors to compromise accounts, devices, systems or sensitive information.

Malicious cyber actors often go to great lengths to make their communication seem legitimate and trustworthy, increasing the chances that a targeted person will follow their instructions. Recent advancements in Al have amplified the effectiveness of social engineering techniques. For example, malicious cyber actors can use Al to write effective phishing emails, free from grammar and spelling errors, and automate targeted spearphishing attacks. To achieve their goals, malicious cyber actors have weaponised empathy, urgency, and trust to trick individuals or staff into circumventing regular processes to achieve their goals. These communications may appear to come from someone known to the victim, such as a relative, colleague, or senior manager, or an authoritative part of their organisation. AI lowers the skill barrier and increases scale, but does not fundamentally change the nature of social engineering attacks.

While social engineering attempts can be received by anyone, malicious cyber actors often prioritise individuals who have access to sensitive information, the ability to make changes to systems, the authority to perform financial transactions, or those whose roles require regular interaction with unknown or external parties. Anyone can be a target of social engineering, from an employee to the CEO.

The Australian Securities and Investments Commission (ASIC) has seen a sharp rise in online scams using deepfake videos of celebrities and politicians to encourage Australians to part with their money, with criminals increasingly exploiting topical issues in the news to deceive consumers. In June 2026, an Australian broadcaster publicly reported that scammers generated a fake version of their website, along with misleading articles and false images of prominent Australians, to advertise a fraudulent investment platform.

Image

1. The bait

   Malicious cyber actors research your organisation and employees, then target them with an attack that appears to come from a trusted source. Information posted on social media sites can be leveraged by malicious actors to get to know their target. AI can help malicious actors rapidly analyse publicly available information and create highly tailored approaches, making them seem more trustworthy and authentic.

2. The hook

   Using social connection, sympathy, imposed urgency, threats, or a disarming tone, a malicious actor hooks the victim into their scheme. AI can be used to generate convincing emails, messages, images and even voice recordings, increasing the likelihood that users believe the scenario or request presented is real and that the malicious actor is authentic.

3. The attack

   Users are tricked into giving up sensitive information about themselves or their organisation by clicking on a malicious link or changing a password that gives the malicious actor access to accounts and networks, or by opening a malicious attachment. This provides the malicious actor with the key to unlock and steal your information.

4. The long game

   Once a malicious actor has convinced the user to complete a task, or has the information they want, they may disappear, however, they may also maintain access to an account for extended periods, using their access to conduct further malicious acts.

As technology becomes increasingly embedded in Australian lives and businesses, the number of potential vulnerabilities for malicious cyber actors continues to grow. Malicious cyber actors often exploit security weaknesses in IT systems, known as CVEs to gain unauthorised access, steal data, or take control of a system. The assistance of Al tools can accelerate the ability to exploit vulnerability chains, where multiple weaknesses are linked together to gain broader access.

Vulnerabilities can include software bugs, system misconfigurations or insecure processes that malicious cyber actors might be able to take advantage of to harm an organisation. Although many vulnerabilities exist, only some pose significant risks.

AI may enable the faster identification and analysis of vulnerabilities in systems and software, reducing the time, effort and skill required of malicious actors. AI systems can be used to automate data collection and analysis, which allows for automated reconnaissance, data collection, and effective target selection. Likewise, over-optimisation, ambiguous instructions, poorly enforced boundaries and the ability to exploit software vulnerabilities or security control weaknesses can increase the risk that AI tools take unsafe or unexpected actions.

ASD’s ACSC has previously observed that most vulnerability exploitation occurs within two weeks, with some CVEs successfully exploited within 48 hours of a patch or mitigation advice being released. Over the next 12 months, the growth of AI-driven tools will further compress this window. This accelerated timeline highlights the increasing speed and efficiency of malicious actors’ operations, leaving organisations with less time to detect, patch and respond to newly disclosed vulnerabilities. The gap between vulnerability disclosure and its exploitation has never been narrower. In the past, defenders had months to patch, now they have days, sometimes only hours. Combined with automated tools and pre-existing exploit kits to quickly code, test and deploy, proof of concepts can significantly shorten the window between disclosure and active exploitation.

Image

1. Software is publicly released with an unknown vulnerability.

2. Researchers or hackers find a vulnerability within the software. A method to exploit the vulnerability is discovered.

   AI is compressing the time from discovery to exploitation. What used to take days to months now takes hours to days. Attackers are moving faster than organisations can respond.

3. Cybercriminals leverage the Zero-day vulnerability, exploiting organisations and causing damage.
4. The vendor learns of the vulnerability and works to develop a patch. The patch development process may take days to months.
5. A patch is released by the software vendor (Cybercriminals are often actively exploiting the vulnerability at this time).
6. Organisations remain vulnerable to exploitation until they deploy the patch or implement controls and counter measures.

ASD’s ACSC has observed cybercriminals rapidly acquiring public and stolen data to extract useful information – such as usernames and passwords – to accelerate their activities. Some AI tools can scrape social media and public sources to quickly profile victims for future malicious cyber activity – such as identity theft, fraud and social engineering attempts.

According to public reporting, in 2025, a US-based AI company disrupted a cybercriminal group that used their AI to generate code for the theft and extortion of personal data at scale. The actor used the AI to semi-automate aspects of their operation from reconnaissance to network compromise. The AI also obtained and analysed financial data from victim organisations to determine a ransom amount. Although the effectiveness of the attack is not clear, this example demonstrates how AI may be used by malicious cyber actors.

Great power competition and escalating geopolitical tensions are reflected in cyberspace. Over the 2025–26 financial year, Australia continued to experience persistent reconnaissance and testing of government and privately owned networks by state-backed actors.

State-sponsored actors have targeted Australian organisations, primarily to gain access to sensitive, or non-public information — not limited to government information. State-sponsored actors actively pursue information that can assist to fill their own intelligence gaps and to reduce their tactical, operational, strategic and commercial risk. This information can include data associated with individuals, operations, or organisational governance. This information is not exclusively held by governments and can almost certainly be gleaned from the networks of CI entities, private businesses, and individuals.

In the Indo-Pacific, state-sponsored actors are possibly preparing for eventualities, such as crisis or conflict, by pre-positioning capabilities for disruptive effects, or to access higher-value target networks to use at the time of their choosing. State-sponsored actors can use disruption to achieve strategic goals, such as limiting the ability to respond to an event or cause social unrest.

State-sponsored actors use a range of techniques to target Australian entities. State-sponsored actors will use low-effort or low-cost techniques to conduct opportunistic attacks and reserve advanced capabilities for high value targets.

Cybercrime continues to be a pervasive threat to Australia’s economic and social prosperity. Cybercrime is persistent and damaging across all facets of Australia’s economy as cybercriminals are willing to exploit opportunities for profit. The online domain has become an integral and ubiquitous part of daily life; with digital infrastructure and the information that companies hold being prime targets for cybercriminals.

Cybercriminals target Australian individuals and organisations for financial gain, attempting to conduct extortion, often using ransomware attacks or data theft. In the 2025–26 financial year, ASD’s ACSC received over 82,000 cybercrime reports through ReportCyber; however, it is likely that most cybercrime goes unreported.

Data theft

Data theft remains an ongoing and serious threat to Australians. PII – such as date of birth, email address and Medicare number – is highly valuable to cybercriminals, who exploit it as a commodity. Cybercriminals also use PII as a target to be acquired for other purposes, including the planning and execution of further criminal activities. For example, stolen PII can be used or sold on the dark web, aiding identity theft schemes and additional cyberattacks.

The average self-reported cost of cybercrime overall was $38,130 – with identity fraud, online shopping fraud, and online banking fraud the most frequently reported cybercrime types. Of the cyber security incidents recorded by ASD’s ACSC during FY2025–26, 98 were data breaches, accounting for over 6% of all incidents. This was an increase of 66% in data breach incidents compared to the previous year.

Ransomware

Ransomware continues to stand out as one of the most disruptive, costly and persistent cyber challenges facing Australia in FY2025–26. Over the past decade, ransomware has evolved from using basic encryption and extortion into an interconnected ecosystem where cybercriminals communicate and conduct payments through borderless online spaces that makes investigating cybercrime difficult. Cybercriminals often use ransomware to encrypt information, including PII, and demand a ransom to prevent the information from being leaked or sold online.

In FY2025–26, ASD’s ACSC responded to 139 ransomware incidents, a figure consistent with the previous year. While the 3 ANZSIC divisions most affected by ransomware, Health Care, Professional, Scientific and Technical Services, and Manufacturing, remained unchanged, the severity of incidents increased, with extensive ransomware incidents rising from 16 to 24.

The growth of the Cybercrime-as-a-service (CaaS) ‘business model’ has made cybercrime more accessible, scalable and efficient. This means that less skilled cybercriminals can access ready-made malware and infrastructure, increasing the number of malicious cyber actors in cybercrime. AI is also streamlining processes across the CaaS ecosystem, making cybercrime faster, less expensive and more effective than ever before.

Ransomware developers are responsible for the creation, upkeep and improvement of ransomware products. Commonly seen in the Ransomware-as-a-Service (RaaS) model, ransomware affiliates can purchase and customise ransomware for their attacks, then share a percentage of the profits with the RaaS developer. Payments to developers can also include rental or subscription-based services.

Paying a ransom does not guarantee recovery of ransomed data, nor prevent it from being sold or leaked online. Paying a ransom also helps promote ransomware as a profitable criminal enterprise. For more information, visit Learn about ransomware.

Australia continues to face a complex set of strategic circumstances. New conflicts in the Middle East and ongoing conflict in Ukraine are fueling international instability – contributing to economic uncertainty and supply chain shock. 

A range of actors, including state-sponsored actors, can use cyber means to achieve geostrategic, political or military effects during crisis or conflict. Malicious actors can conduct cyber operations at scale, which allows them to lay low in networks and generate effects across borders. These characteristics are increasingly valuable during a period of global instability. 

The distinction between state-sponsored and cybercriminal activity continues to blur. Despite differing objectives, both often exploit the same vulnerabilities and use similar TTPs to compromise systems and extract data. This includes the use of AI.

State-sponsored actors in modern conflict

State-sponsored actors have demonstrated both their capability and intent to use cyber as a disruptive and destructive tool in crisis or conflict. Modern conflicts have highlighted how militaries incorporate cyber effects to enable or facilitate operations. They also use cyber as a tool to shape or influence conditions in their area of operations to better suit their desired outcome.

State-sponsored actors are investing in disruptive cyber capabilities for future use in conflict. They can commit the necessary time and resources to gain access to a victim’s network and pre-position for future operations.

Hacktivists in modern conflict

Hacktivists are increasingly likely to pose a disruptive cyber threat to government and private sectors during crisis or conflict. While hacktivists are non-state-sponsored actors, they can also be patriotically motivated – targeting those whom they perceive as a threat to their own nation’s geopolitical objectives. The increasingly unpredictable and volatile international environment is motivating hacktivists to target entities or states whom they deem are adversarial to their ambitions.

Hacktivists are becoming increasingly willing to engage in disruption activities that pose a threat to Australia, regardless of whether hacktivists deliberately target the Australian entity itself. Australia’s geographical position in the Indo-Pacific places us at the forefront of many emerging global issues. Like other actors, hacktivists will likely benefit from emerging technologies, such as AI, to grow their capabilities and pose a bigger disruption threat to Australian sectors. Additionally, as Australia is heavily reliant on international supply chains, hacktivist disruption can affect Australia even if we are not the direct target.

• On 11 March 2026, Iranian hackers claimed responsibility for compromising Stryker, a US-based company that regularly imports surgical and pharmaceutical equipment into the Australian market. The group claimed this attack was in response to a US military strike in Iran. Although Australia was not directly targeted or impacted by this activity, the example highlights how Australia’s complex supply chain nevertheless exposes it to hacktivist activity, even if that activity does not directly target Australia.
• On 10 December 2025, ASD’s ACSC, alongside international partners, released an advisory assessing that pro-Russia hacktivist groups were targeting CI. They exploited insecure internet-facing virtual network computing (VNC) connections to infiltrate, or gain access to, operational technology (OT) systems. While these groups are generally less sophisticated and impactful than Advanced Persistent Threat (APT) actors, their activities have resulted in operational disruptions – including physical damage. Targeted sectors include water and wastewater systems, food and agriculture, and energy.

Everyone can be a target

Cyber threats affect Australians of all ages, industries and communities. Criminals are increasingly combining cyber techniques with social engineering to scam, defraud and exploit individuals at scale.

Who is being impacted?

Highest reporting age groups

• 25-34 and 35-44 year olds accounted for 42% of all scam reports to ReportCyber.

Youth reporting increased

• Reports from victims aged 17 and under increased 15%.
• 48% of reports related to cyber abuse.

Older Australians

• Reporting from Australians aged 65 and over decreased by 17%.
• 51% of reports accounted for online fraud activity.

Cybercrime in Australia 2025 report

Australian Cybercrime Survey 2025

• 64% experienced cybercrime at some point in their life.
• 45% were victims in the previous 12 months.

Most common cybercrimes

• 21% malware
• 21% identity crime and misues
• 11% fraud and scams

Why Australians remain vulnerable

Research conducted as part of the Australian Government's Act Now, Stay Secure. campaign found:

• 57% do not review privacy or location settings.
• 64% have personally identifiable information visible on social media.

Password habits create risk

• 55% reuse password across multiple accounts
• 59% use variations of the same password
• 30% include personal information in passwords

These behaviours make credential theft and account compromise easier for cybercriminals.

Four simple ways to be a harder target

1. Review privacy settings
2. Enable multi-factor authentication (MFA)
3. Use unique passwords or passkeys for every account
4. Think carefully before sharing personal information online

Cybercriminals increasingly exploit personal information and human trust. Simple cyber security practices can significantly reduce an individuals risk of becoming a victim.

Image

Australia’s more populous states – Victoria, Queensland and New South Wales – continue to report more cybercrime than any other state or territory, with disproportionately higher reporting rates relative to their populations.

• Western Australia: 12%
• Northern Territory: 2%
• South Australia: 7%
• Queensland: 26%
• New South Wales: 22%
• Australian Capital Territory: 2%
• Victoria: 27%
• Tasmania: 2%

CI continues to be an attractive target for malicious cyber activity due to the valuable data it holds and the important role it plays in everyday life. Malicious cyber actors seek to exploit CI for various reasons, ranging from financial extortion to espionage. A cyber attack affecting CI could undermine key sectors’ functionality, including health and energy – causing operational disruptions and service shutdowns affecting millions of Australians.

In FY2025–26, CI incidents accounted for 10% of all incidents, similar with last year. ASD’s ACSC responded to 154 CI incidents, a decrease of almost 7% compared to the previous year.

The top 3 MITRE ATT&CK initial access techniques leading to CI-related incidents were:

• Phishing (36%) – Adversaries used malicious emails, messages or other communications to deceive users and gain initial access to systems or credentials.
• Valid Accounts (16%) – Adversaries obtained and misused legitimate user accounts to access networks and systems without triggering traditional security controls.
• Drive-by Compromise (10%) – Adversaries gained access when a user visited a compromised or malicious website, resulting in the unintended download or execution of malicious content.

Top 3 ANZSIC divisions for CI incidents:

• Financial and Insurance Services (30%)
• Public Administration and Safety (21%)
• Electricity, Gas, Water and Waste Services (17%)

Cybercriminals continue to opportunistically target CI operators. CI is an attractive target for cybercriminals seeking to extort victims due to the sensitivity of the data stored by these entities, and the criticality of their services.

State-sponsored cyber actors routinely target Australia’s CI networks, possibly to conduct espionage to gain a competitive and strategic advantage, or to pre-position for disruptive and destructive cyber effects against OT in the event of crisis or conflict. In crisis or conflict, access to an OT network could provide a malicious cyber actor with control over that infrastructure.

The following state-sponsored actors linked to the People’s Republic of China (PRC), Russia, and the Democratic People’s Republic of Korea (DPRK) have targeted Australia or its allies.

CI Fortify is ASD’s ACSC guidance for Australian CI operators to strengthen cyber resilience and prepare for cyber incidents, disruptions, and other threats to essential services. Building resilience is essential to protecting critical systems and maintaining the delivery of services that Australians rely on every day.
 

Image

Effective cyber attacks on vital OT and enabling systems could incapacitate Australia

• APT40: PRC state-sponsored
  Active since 2009: Targeting Australian networks
• VOLT TYPHOON: PRC state-sponsored
  Active since 2021: Targeting CI across the US and Asia Pacific
• LAZARUS GROUP: DPRK state-sponsored
  Active since 2009: Targeting CI worldwide
• SALT TYPHOON: PRC state-sponsored
  Active since 2019: Targeting 200 CI organisations across 80 countries
• APT29: Russian intel-linked
  Active since 2008: Targeting CI and western organisations

The evolution of the cyber threat environment

Attackers steal access not just data

The easiest way into a network is by using stolen or compromised legitimate credentials.

• Stolen usernames, passwords, tokens and sessions are now among the most common pathways into Australian networks.
• Identity fraud remained the most reported cybercrime for individuals over the last five years.
• Compromised accounts and credentials have become one of the top incident categories across government, industry and CI.

Reporting is rising

A 36% increase in cyber security incidents reported to ASD's ACSC over the last five years.

Data breaches have remained steady

• FY2021-22: 7% of all incidents
• FY0205-26: 6% of all incidents

Ransomware remains a persistent and disruptive threat

On average 11% of all incidents since FY2021-22 involved ransomware

• FY2021-22: 135 Ransomware incidents
• FY2025-26: 139 Ransomware incidents

State actors remain a significant threat

State actors continue to target Australian governments and businesses to conduct espionage and gain strategic advantage.

They may also be motivated to maintain options to disrupt essential services during periods of crisis or conflict.

Growing malicious use of AI

Advances in AI are lowering the barrier to entry for malicious cyber actors

• Enabling social engineering
• Creating highly convincing deep fakes and impersonations
• Writing and adapting malicious code faster
• Scanning and exploiting vulnerabilities at scale

A more professional cybercrime ecosystem

Cybercrime is a thriving industry

• Specialised roles (e.g. developers and access brokers)
• Cybercrime-as-a-Service (e.g. tools, kits and infrastructure for hire)
• Efficient money laundering and monetisation networks
• Active forums, markets and communities sharing knowledge and tools

While technologies and tactics will evolve, cyber resilience will remain Australian's strongest defence against an increasingly complex threat environment.

Analysing incidents using the MITRE ATT&CK framework

Image

• Phishing (initial Access): 39%
• Compromise Accounts (Resource Development): 21%
• User Execution (Execution): 17%
• Valid Accounts (Initial Access): 15%
• Social Engineering (Stealth): 13%
• Gather Victim Identity Information (Reconnaissance): 13%
• Exploit Public-Facing Application (Initial Access): 13%
• Network Denial of Service (Impact): 11%
• Phishing for Information (Reconnaissance): 11%
• Acquire Infrastructure (Resource Development): 10%

ASD’s ACSC observed a range of common techniques malicious cyber actors used to exploit vulnerabilities in technology and systems, mapped against the MITRE ATT&CK framework. 

During FY2025–26, there was a notable shift away from reconnaissance techniques and a move towards direct access and execution techniques. Phishing remained the most observed initial access technique, with entities specifically warned to beware of spearphishing links. Interestingly, gathering victim identity information decreased from 30% in FY2024–25 to 13% in FY2025–26.

Managing supply chain and third party risk should be a core component of any cyber security strategy. The cyber security risks of your suppliers and third parties are also your risks – you are only as strong as your weakest link.

Effective cyber supply chain risk management ensures, as much as possible, the secure supply of products and services throughout their lifetime. This includes their design, manufacture, delivery, maintenance, decommissioning and disposal. As such, cyber supply chain risk management forms a significant component of any organisation’s overall cyber security strategy.

If products or services access valuable systems, operate with privileged access or have control over a large portion of a cyber supply chain, they may represent a weakness that could be exploited by malicious cyber actors. In such cases, this could have wide-reaching and harmful consequences.

Since September 2025, ASD’s ACSC has tracked the ongoing targeting of online code repositories (repos). Malicious cyber actors have been observed accessing online code repos through social engineering techniques, compromised credentials and authentication tokens. These malicious cyber actors then:

• abuse legitimate tooling and functions to modify public software packages to initiate supply chain compromises,
• extract and publicly leak identified credentials publicly,
• migrate private code repos to public code repos, and
• run open-source tools to scan for cryptographic secrets, passwords and sensitive keys stored in online code repos, rather than use bespoke tooling. Exposed code bases give malicious cyber actors a better understanding of internal processes and systems, increasing an organisation’s attack surface and enabling future, novel attacks.

The compromise of trusted software packages presents an ongoing risk for organisations. These packages are often widely used and embedded as dependencies within other software, increasing the potential impact when vulnerabilities are identified.

To manage this risk effectively, organisations must be able to rapidly identify which software packages – and which specific versions – are installed across their environments. This information should be accurately collected, maintained and readily accessible. This enables organisations to quickly assess threat intelligence related to compromised software, determine its relevance to their environment, and take prompt action to reduce the risk of compromise.

• Malicious actor
  Malicious actor compromises a trusted developed account and pushes a malicious version of a widely used software package.
• Compromised package
  Victim developer installs the poisoned package on Github repository.
• Victim
  After installation the malware starts running malicious code in the victims Github repository.
• Proliferation
  The malware harvests credentials and cloud metadata, exfiltrating them to an actor-controlled endpoint.
  • The malware then identifies other packages maintained by that developer, injecting malicious code, and publishing the new compromised versions to Github. This allows the malware to self-replicate, spreading without the malicious cyber actor's involvement.
  • The malware then programmatically creates a new public Github repo under the victim's account and uploads the stolen secrets to it, publicly exposing them.
  • Using the stolen credentials, the malware then authenticates, as the compromised developer.

Cyber Action Year: Awareness to Action

From the beginning of 2026, ASD’s ACSC has brought leaders from across government, industry and CI together to be part of something bigger: a coordinated effort through the inaugural Cyber Action Year focused on delivering practical, measurable cyber security outcomes to counter a worsening threat environment.

ASD’s ACSC is urging Australian industry to adopt the ‘assumed breach’ mindset, which takes a premediated planning approach for when, not if, a cyber compromise occurs. Five critical actions that every organisation should be working towards have formed the focus of Cyber Action Year:

	Replace or mitigate legacy technologies		Prepare for post-quantum cryptography
	Implement best practice event logging		Prepare for AI-enabled cyber threats
	Supply chain management, including choosing secure by design

Importantly, these actions help organisations prepare for AI-enabled cyber threats as it enables malicious actors to identify vulnerabilities, develop exploits and conduct cyber operations more quickly and at greater scale. Reducing exposure to legacy technologies, improving visibility through event logging, adopting Secure by Design products and services, and preparing for PQC all strengthen an organisation’s resilience.

Cyber Action Year is translating awareness into action. Organisations have shown a strong willingness to address cyber risks when presented with clear problems and actionable solutions, as demonstrated by the legacy technology uplift activities in March (for more information see Highlight 6: Addressing legacy technology risks through CHIPs).

As Cyber Action Year progresses, one lesson is clear: awareness alone is not enough. Most organisations understand cyber security risks, but turning awareness into meaningful action can be challenging amid competing priorities and an increasingly complex threat landscape. By providing clear, practical and actionable steps, ASD’s ACSC is helping organisations move from knowing to doing, building momentum toward a more cyber secure Australia. 

To ensure the continued effectiveness of ASD’s mitigation advice in the changing threat environment, in October 2026 ASD’s ACSC released the Essentials series. This is the evolution of ASD’s Essential Eight into a broader, principles-based approach, offering prioritised, threat-informed cyber security mitigations with technology-specific content.

Originally released in 2017, and regularly updated, the Essential Eight was designed to provide guidance for enterprise IT networks. ASD’s Essential Eight remains effective in preventing cyber security incidents, but the threat environment and technologies have evolved significantly since it was first developed.

The Essentials series was initially published with three chapters, each focused on a specific technology environment: Enterprise IT, OT and Cloud. The Essentials series helps organisations prioritise cyber security activities around their most important systems, services and data, while providing guidance that reflects the technologies they use. 

Implementation of the Essential series framework will enable organisations to focus on the actions that will have the greatest impact on reducing cyber risks in their systems and better prepare Australian organisations to be resilient to current and future cyber threats.

ASD’s ACSC acknowledges that organisations that have implemented the Essential Eight maturity model have made significant and valuable investments in their security posture. The evolved Essentials for enterprise IT framework does not discard that work. Indeed, this investment can be carried forward by organisations as part of implementing the Essentials. However, the mitigations and how we measure them have evolved and, in many cases, apply more broadly.

The development of the Essentials series was informed by ASD’s unique intelligence insights, cyber security incident data, public cyber threat reporting, and consultation with partners across industry and government. 

Throughout 2026, ASD’s ACSC has engaged with industry and government partners through more than 30 face-to-face workshops across all 8 capital cities, a consultation paper released via ASD’s Partner Portal, and bespoke targeted consultations for the cloud and operational technology chapters.

This process enabled implementers and service providers to shape the development of the Essentials series, while ensuring it is threat informed and supported by clear progression pathways and improved usability. ASD’s ACSC will continue to engage with stakeholders on the transitional arrangements into 2027.

Rapid advancements in AI technologies over the past year are creating significant opportunities for businesses to strengthen cyber security, improve productivity and enhance resilience. While malicious actors are also adopting these technologies, AI has the potential to be a force multiplier for defenders, enabling organisations to identify threats earlier, respond faster and use cyber security resources effectively.

AI can help organisations improve cyber defence by automating repetitive tasks, analysing large volumes of security data at speed, and supporting more consistent and effective decision-making. For many businesses, particularly those with limited cyber security resources, AI-enabled tools can increase visibility of cyber risks and help security teams focus on higher-value activities.

Organisations that integrate AI tooling into their security operations can detect vulnerabilities earlier, improve software quality, monitor unusual behaviour, and respond faster to cyber incidents – reducing both the cost and impact of incidents. AI can also support a range of defensive cyber security functions, including threat detection, vulnerability management, incident response, malware analysis and cyber threat intelligence. These capabilities can help organisations identify emerging threats more quickly, prioritise remediation efforts and improve overall cyber resilience. By reducing the time required to analyse information and investigate incidents, AI can help businesses operate more securely and efficiently.

Many AI use cases involve processing sensitive operational information. Businesses should use AI while maintaining appropriate controls and protecting information, in line with security and data handling obligations. This includes enforcing least privilege access, restricting data exposure to AI systems, validating outputs before use and maintaining auditability of AI-assisted actions.

Organisations must take steps to defend against AI-enabled threats, such as:

• Small businesses can reduce risk by choosing products that are Secure by Design out of the box, enabling automatic updates, and ensuring clear responsibility for security monitoring and incident response.
• Medium-sized businesses should maintain inventories of internet-facing systems, promptly patch vulnerabilities, implement network segmentation and test incident response and business continuity plans.
• Large enterprises, CI operators and government entities should establish executive accountability for AI-related cyber risks, adopt comprehensive monitoring and logging, and work towards layered Zero Trust and Secure by Design architectures supported by human-supervised defensive AI.
• Organisations should actively minimise their attack surface by ensuring only necessary systems and services are exposed to the internet, as AI-enabled exploitation is shrinking the window between vulnerability discovery and compromise.

Cyber resilience cannot be treated as a purely technical issue. It is a core business risk and leadership responsibility. As AI adoption continues to grow, organisations that effectively integrate AI into their cyber security practices will be better placed to manage risk, improve operational efficiency and respond to an increasingly complex threat environment. Organisations should continually assess the costs, benefits and risks of AI, recognising that both AI capabilities and their use by malicious actors will continue to evolve. Cyber risk assumptions can become outdated in months, not years. Success will depend on getting the fundamentals right, acting quickly and integrating cyber security into core business strategy. Organisations should also consider integrating AI into cyber security practices. For many organisations, AI represents not only a new area of risk, but a significant opportunity to build stronger, more adaptive and more resilient cyber defences.

Image

Integrating AI for cyber security

Govern

• Analyse data
• Identify gaps

Identify

• Automate and enrich discovery

Protect

• Scan source code
• Prioritise hardening actions

Recover

• Analyse and inform restoration activities

Respond

• Support activities
• Summarise and interpret information

Detect

• Advance visibility
• Identify patterns

Malicious cyber actors are moving quickly to exploit critical vulnerabilities, rapidly developing exploits to compromise networks. AI is shortening the time between vulnerability discovery and exploitation. ASD’s ACSC recommends that all entities accelerate their patching process and prioritise security updates accordingly to manage risks.

Having clear and streamlined patch management helps organisations respond quickly to new vulnerabilities. By understanding vendor patch schedules and regularly scanning for missing patches, organisations can dramatically reduce the time between identifying new vulnerabilities and applying fixes. 

Cryptographically relevant quantum computers (CRQCs) are being accelerated as recent research and development becomes reality, requiring Australia to prepare for Q-day, the point where a CRQC is able to break standard public-key cryptography.

The creation of CRQCs presents new cyber security risks as adversaries may use CRQC capabilities to threaten the security of current systems that rely on traditional asymmetric cryptographic algorithms.

PQC provides a solution by using quantum-resistant algorithms designed to remain secure against future quantum computing threats. Organisations should address the threat of CRQCs and prepare to protect their IT environment now. Some service providers and vendors have begun transitioning to PQC, with some offering PQC-only solutions and products, highlighting the need for organisations to start planning their PQC transition sooner rather than later.

ASD’s ACSC recommends ceasing the use of traditional asymmetric cryptography and transitioning to PQC by the end of 2030, or sooner, which will ensure organisations are at lower risk should AI speed up developments in quantum computing. Organisations will need to consider multiple factors when planning their PQC transition, as successful transition across different organisations may vary. Factors could include the scale of IT environments, the nature of the cyber threats faced, the availability of resources, or any need to maintain interoperability with legacy systems used by business partners and customers.

ASD’s ACSC encourages organisations to consider the LATICE framework, when undertaking their PQC transition: locate, assess, triage, implement, communicate and educate.

For more information, visit ASD’s ACSC quantum-related publications on cyber.gov.au/quantum.

Image

• Locate and inventory the use of traditional asymmetric cryptography.
• Assess the value and sensitivity of systems and data protected by traditional asymmetric cryptography.
• Triage systems using traditional asymmetric cryptography and prioritise individual systems for transition.
• Implement post-quantum cryptographic algorithms throughout systems.
• Communicate with vendors and stakeholders, and educate and train relevant stakeholders on the PQC transition.

Small and medium-sized organisations – including those operating bespoke, regulated, on-premises or critical systems – cannot easily transition to PQC across complex IT environments. However, they do not need a massive budget or a large security team to begin addressing quantum risk. Where possible, organisations should look to adopt PQC by implementing solutions that are post-quantum ready, doing it in-house, or through new or existing service providers who can provide vendor-managed updates to websites, cloud services and software.

OT systems are particularly vulnerable to cyber attacks. Many were never designed to withstand cyber threats and are now exposed to adversaries with sophisticated capabilities.

In October 2025, ASD’s ACSC released CI Fortify. The series provides practical, principles-based guidance to help CI withstand cyber threats and recover quickly in the event of an incident, ensuring the continuity of critical services during crises or prolonged disruptions. CI Fortify should be prioritised by all Australian CI operators.

To achieve this capability, organisations should:

• identify vital OT and enabling systems that support a critical service as well as associated isolation points
• develop the capability to physically isolate vital OT and enabling systems from the internet and other networks for three months while continuing to maintain critical services
• be able to rapidly and fully rebuild vital OT and enabling systems to minimise disruption to critical services.

ASD’s ACSC’s latest publication in the series, Advice for Isolating Vital Systems, provides guidance to OT system owners and operators, and cyber defenders in adopting CI Fortify’s physical isolation requirement. The physical isolation of vital systems removes operational independence between OT and IT networks, enabling continued delivery of critical services even if corporate networks become inoperable or degraded.

The ability to fully rebuild isolated OT and supporting systems is equally critical, allowing for effective incident response and the safe, timely restoration of services. This is particularly important where malicious activity may persist beyond the temporary isolation period, or where initial recovery efforts prove unsuccessful.