Cyber Strategy: Australia prioritizes security over uptime

Australian organizations are facing a shift in cyber defense strategy that places system security above continuous availability. The Australian Signals Directorate (ASD) issued this guidance in its annual cyber threat report, noting that protecting infrastructure often requires taking services offline while technical fixes are applied.

The agency recorded 1,500 cybersecurity incidents during the 2025-26 fiscal year, a 20% increase from the previous period. ASD also notified external entities, including businesses and critical infrastructure operators, of more than 4,400 potentially malicious incidents. This notification figure represents an 80% year-on-year rise.

The report attributes this surge to hostile foreign governments, criminals, and hackers leveraging artificial intelligence to gather intelligence and disrupt infrastructure. State-based actors have maintained persistent attempts to breach Australian networks, with ASD suggesting that actors in the Indo-Pacific region may be preparing for future conflicts through intelligence gathering.

ASD director general Abigail Bradshaw stated on Monday that Australia must accelerate improvements to its technology foundations. She advocated for the use of AI tools to automate defensive work and detect vulnerabilities. Bradshaw has previously referenced ASD’s access to Anthropic’s Mythos model, a tool the developer kept private due to its ability to identify unknown flaws in IT systems.

Government officials support this approach, viewing advanced AI models as critical to national defense. Defence minister Richard Marles urged citizens to enhance their protections, while home affairs and cybersecurity minister Tony Burke said the government is preparing for the implications of emerging technologies.

Ageing technology remains a primary vulnerability, particularly for systems where manufacturers no longer provide updates. Last week, newly discovered weaknesses in the PHP programming language forced rapid responses from governments and businesses to patch affected websites.

ASD now urges organizations to keep systems updated and report suspicious activity immediately. Bradshaw and Marles emphasized that security measures should take priority over keeping systems online, accepting that this may result in temporary unavailability of services.