Annual Cyber Threat Report 2025-26
The 2025-26 Annual Cyber Threat Report highlights key threats, responses and security advice for Australians.
What you can do
Cyber Action Year: Awareness to Action
From the beginning of 2026, ASD’s ACSC has brought leaders from across government, industry and CI together to be part of something bigger: a coordinated effort through the inaugural Cyber Action Year focused on delivering practical, measurable cyber security outcomes to counter a worsening threat environment.
ASD’s ACSC is urging Australian industry to adopt the ‘assumed breach’ mindset, which takes a premediated planning approach for when, not if, a cyber compromise occurs. Five critical actions that every organisation should be working towards have formed the focus of Cyber Action Year:
| Replace or mitigate legacy technologies | 
| Prepare for post-quantum cryptography |
| Implement best practice event logging | 
| Prepare for AI-enabled cyber threats |
| Supply chain management, including choosing secure by design |
Importantly, these actions help organisations prepare for AI-enabled cyber threats as it enables malicious actors to identify vulnerabilities, develop exploits and conduct cyber operations more quickly and at greater scale. Reducing exposure to legacy technologies, improving visibility through event logging, adopting Secure by Design products and services, and preparing for PQC all strengthen an organisation’s resilience.
Cyber Action Year is translating awareness into action. Organisations have shown a strong willingness to address cyber risks when presented with clear problems and actionable solutions, as demonstrated by the legacy technology uplift activities in March (for more information see Highlight 6: Addressing legacy technology risks through CHIPs).
As Cyber Action Year progresses, one lesson is clear: awareness alone is not enough. Most organisations understand cyber security risks, but turning awareness into meaningful action can be challenging amid competing priorities and an increasingly complex threat landscape. By providing clear, practical and actionable steps, ASD’s ACSC is helping organisations move from knowing to doing, building momentum toward a more cyber secure Australia.
In March, Cyber Action Year focused on the risks posed by legacy technology and encouraged industry and government to uplift software versioning and identify, replace or mitigate legacy technology.
Legacy technology is outdated hardware and software that is no longer supported by the manufacturer, vendor or developer and cannot receive important security updates or patches. It presents significant and enduring risks to the cyber security posture of government and organisations. The most effective method to mitigate the risk posed by legacy tech is to replace it before it becomes unsupported.
To support the legacy technology focus, the Cyber Hygiene Improvement Program (CHIPs) expanded its service offering in February 2026 by introducing detection capabilities for 8 End-of-Life (EoL) products. Once identified, CHIPs sent reports to customers, recommending for each EoL product, that either they update it to a version that is in support, change to another product at a supported version, or decommission if the product was no longer needed.
Follow-up scans of customer systems revealed a significant reduction in products that were past EoL. From February to June, there was a 31.7% reduction in EoL products across all CHIPs customers.
Sector-specific results also demonstrated positive outcomes, with Commonwealth entities reducing EoL products by 31.7% and CI organisations achieving a 30.2% reduction over the same period.
In mid-2025, ASD’s ACSC was engaged by an Australian organisation in response to a ransomware incident. The ransomware attack disrupted several building systems that were critical to the organisation’s day-to-day operations, including security cameras, building access controls, lighting and lifts, and more than 30 virtual servers.
Fortunately, the organisation had comprehensive event logging in place, meaning that their operating system recorded key information about the malicious cyber incident, including:
- how the malicious cyber actor gained access
- which systems had been affected, and
- what actions the malicious cyber actor had taken.
The event logs also showed that the malicious cyber actors had not stolen any data from the organisation’s network, which gave the organisation confidence that the incident, while disruptive, was limited in scope. Additionally, because the organisation had a practice of backing up their systems, essential services were restored promptly.