Annual Cyber Threat Report 2025-26

Technology is evolving at accelerated rates and continues to impact cyber security in both positive and negative ways. Throughout FY2025–26, Artificial Intelligence (AI) tools became more accessible, driven by a new generation of frontier AI models. These models have changed the game with speed and opportunity, but they have also have generated significant uncertainty.The question is no longer whether organisations will face cyber threats, but how prepared they are to respond.

As AI tools become more accessible, malicious cyber actors require less effort to target Australian critical infrastructure (CI), governments, businesses, and individuals either for financial gain, espionage or to pre-position on systems for later disruption. Both state-sponsored actors and cybercriminals can use AI to identify vulnerabilities, develop exploits and launch attacks at greater scale than ever before.

To respond effectively to these new threats, organisations must strengthen patching processes and adapt basic cyber security controls to remain resilient. Equally, the integration of AI tools into organisations’ security operations can facilitate the early detection of vulnerabilities, enhance software quality, monitor for unusual behaviour and improve incident response times. The increasing integration of AI across the economy is expected to drive a greater focus on cyber security risk management practices with the need to adapt to new threats, vulnerabilities and governance requirements associated with increasingly capable AI systems. The emergence of agentic AI, and the potential for rapid advances towards highly autonomous or recursively self-improving AI, may further accelerate the pace, scale and sophistication of cyber threats, requiring ongoing investment.

In FY2025–26, ASD’s ACSC responded to more than 1,500 cyber security incidents, representing a 20% increase from the previous year and a 36% rise over the past five years. ASD’s ACSC also notified entities more than 4,400 times of potentially malicious cyber activity – an increase of 80% over FY2024–25. This included over 2,200 individual notifications, and collective notifications issued to more than 2,100 entities.

State-sponsored cyber actors continued to target Australian organisations primarily to gain access to sensitive or non-public information. This activity extends beyond government networks, and includes critical infrastructure entities, private businesses and individuals. As the global security environment continues to deteriorate, state-sponsored cyber actors are increasingly seeking to pre-position within networks to enable future intelligence collection, disruption or access to higher-value targets at a time of their choosing. This trend is not confined to Australia and is evident in the context of multiple global conflicts currently underway. Cyber is normalised as a feature of conventional warfare.

Australian individuals had personally identifiable information (PII) compromised in a growing number of global data breaches, and this data was held to ransom, sold or published online. AI has amplified the effectiveness of social engineering techniques, enabling malicious cyber actors to more convincingly impersonate or manipulate Australian individuals and businesses for financial gain or access to networks. Compromised accounts and credentials also emerged as one of the most frequently reported incident categories across government, industry and CI sectors, reflecting the value malicious actors place on legitimate access to networks and systems. Implementing basic cyber security practices such as reviewing privacy settings, enabling passwordless authentication – such as multi-factor authentication (MFA) or passkeys – are essential to reducing the likelihood of becoming a victim of cybercrime.

In October 2026, ASD’s ACSC released the Essentials series, evolving the Essential Eight into a modern, principles-based framework that provides prioritised, threat-informed cyber security guidance tailored to different technology environments. ASD’s ACSC’s Essentials series is a necessary reflection of advances in threats, availability of mitigation technologies and diversity of networks and operating systems.

In addition to modernising foundational frameworks, throughout FY2025–26, ASD’s ACSC continued to amplify the importance for government, industry and CI entities of actioning priorities set out in our last year’s report. This includes reducing legacy information technology (IT), implementing event logging, supply chain management, and preparing for post-quantum cryptography (PQC). Maintaining a focus on these priorities also ensures preparation for AI-enabled cyber threats. For example, the less legacy IT is exposed to the internet, the less attack surface opportunity there is for a malicious actor to compromise a network. In a similar vein, ceasing the use of traditional asymmetric cryptography by the end of 2030, or sooner, will ensure an organisation is at lower risk should AI speed up developments in quantum computing. AI capabilities have not introduced new cyber threats, but they have amplified existing ones, meaning action is now more critical than ever. Accordingly, these areas will remain a key focus for ASD’s ACSC throughout FY2026–27.

It is critically important that organisations and individuals who observe suspicious cyber activity, incidents and vulnerabilities report to cyber.gov.au or to the Australian Cyber Security Hotline 1300 CYBER1 (1300 292 371).