Quick Takeaways
-
Cyber activity surged: ASD’s ACSC responded to more than 1,500 incidents in 2025–26—up over 20%—and issued 4,400+ threat notifications, nearly 80% more than the previous year.
-
AI is accelerating threats: State-backed actors and cybercriminals can use AI to find vulnerabilities and scale attacks faster, while increasingly exploiting trusted access, stolen credentials and social engineering.
-
Critical infrastructure remains exposed: It accounted for 10% of incidents, with phishing the leading entry point; attackers target these systems for espionage, extortion and potential future disruption.
- Resilience is the priority: Organizations should patch rapidly, use MFA or passkeys, manage supplier risks and prepare to isolate and restore critical systems; ASD also recommends planning a transition to post-quantum cryptography by 2030.
Problem Explained
The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) reported more than 1,500 cybersecurity incidents in 2025–26, an increase of over 20% from the previous year. It also issued more than 4,400 warnings about potential malicious activity, up almost 80%. The activity affected Australian government agencies, critical infrastructure operators, businesses and individuals. Cybercriminals and state-sponsored actors sought money, sensitive information and access to networks that could support espionage or future disruption. Compromised accounts and credentials were among the most frequently reported problems.
According to the ASD’s ACSC Annual Cyber Threat Report 2025–26, increasingly accessible AI is helping attackers find vulnerabilities and launch attacks faster and at greater scale. Meanwhile, trusted relationships and social engineering make it easier to deceive people into granting access. The report warns that the distinction between espionage, sabotage and cybercrime is becoming less clear. It urges organizations to patch systems faster, strengthen basic protections such as multifactor authentication, manage supplier risks and prepare to keep critical services running during disruptions.
What’s at Stake?
The reported 20% rise in cyber incidents and sharp increase in threat notifications signal a risk that can reach any business—not only critical infrastructure operators. Attackers may exploit stolen passwords, deceptive emails, vulnerable software, or suppliers with weaker security. As a result, a company could lose access to essential systems, expose customer or employee data, or be forced to halt operations. Even a brief disruption can mean lost sales, recovery costs, contractual penalties, and regulatory scrutiny. Moreover, customers and partners may lose trust. Strong safeguards reduce the risk, but no business is immune.
Possible Action Plan
Timely remediation reduces the chance that rising threat activity becomes a prolonged disruption to essential services.
Priority Actions
- Triage and prioritize exposure: Inventory critical assets, identify internet-facing systems, and rank vulnerabilities by exploitability, business impact, and risk to essential services.
- Patch and mitigate quickly: Apply vendor security updates promptly; where patching must wait, disable vulnerable features, restrict access, or use other documented compensating controls.
- Strengthen access controls: Require phishing-resistant multifactor authentication for privileged and remote access, remove stale accounts, and enforce least privilege.
- Limit potential spread: Segment operational technology (OT) from corporate networks, restrict remote connections, and monitor access to critical systems.
- Improve detection: Centralize and review logs, alert on unusual authentication and network activity, and use current threat intelligence to tune detection.
- Prepare incident response: Maintain tested response and continuity plans, assign decision-makers, and rehearse scenarios involving critical services and suppliers.
- Protect recovery capability: Keep isolated, immutable backups of critical data and configurations; test restoration, not just backup creation.
- Coordinate and report: Share relevant indicators with trusted partners and report incidents to the Australian Cyber Security Centre. Organizations covered by the SOCI Act should also assess and meet their applicable reporting and risk-management obligations.
- Track remediation: Assign owners and deadlines, verify fixes through follow-up testing, and review unresolved risks with leadership—consistent with NIST CSF’s Govern, Identify, Protect, Detect, Respond, and Recover functions.
Explore More Security Insights
Stay informed on the latest Threat Intelligence and Cyberattacks.
Understand foundational security frameworks via NIST CSF on Wikipedia.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
