Annual Cyber Threat Report 2025-26

As technology becomes increasingly embedded in Australian lives and businesses, the number of potential vulnerabilities for malicious cyber actors continues to grow. Malicious cyber actors often exploit security weaknesses in IT systems, known as CVEs to gain unauthorised access, steal data, or take control of a system. The assistance of Al tools can accelerate the ability to exploit vulnerability chains, where multiple weaknesses are linked together to gain broader access.

Vulnerabilities can include software bugs, system misconfigurations or insecure processes that malicious cyber actors might be able to take advantage of to harm an organisation. Although many vulnerabilities exist, only some pose significant risks.

AI may enable the faster identification and analysis of vulnerabilities in systems and software, reducing the time, effort and skill required of malicious actors. AI systems can be used to automate data collection and analysis, which allows for automated reconnaissance, data collection, and effective target selection. Likewise, over-optimisation, ambiguous instructions, poorly enforced boundaries and the ability to exploit software vulnerabilities or security control weaknesses can increase the risk that AI tools take unsafe or unexpected actions.

ASD’s ACSC has previously observed that most vulnerability exploitation occurs within two weeks, with some CVEs successfully exploited within 48 hours of a patch or mitigation advice being released. Over the next 12 months, the growth of AI-driven tools will further compress this window. This accelerated timeline highlights the increasing speed and efficiency of malicious actors’ operations, leaving organisations with less time to detect, patch and respond to newly disclosed vulnerabilities. The gap between vulnerability disclosure and its exploitation has never been narrower. In the past, defenders had months to patch, now they have days, sometimes only hours. Combined with automated tools and pre-existing exploit kits to quickly code, test and deploy, proof of concepts can significantly shorten the window between disclosure and active exploitation.

Image

1. Software is publicly released with an unknown vulnerability.

2. Researchers or hackers find a vulnerability within the software. A method to exploit the vulnerability is discovered.

   AI is compressing the time from discovery to exploitation. What used to take days to months now takes hours to days. Attackers are moving faster than organisations can respond.

3. Cybercriminals leverage the Zero-day vulnerability, exploiting organisations and causing damage.
4. The vendor learns of the vulnerability and works to develop a patch. The patch development process may take days to months.
5. A patch is released by the software vendor (Cybercriminals are often actively exploiting the vulnerability at this time).
6. Organisations remain vulnerable to exploitation until they deploy the patch or implement controls and counter measures.