Australia’s Cyber Agency Warns AI Is Making Attacks Faster as Incidents Jump More Than 20 Per Cent

Australia’s cyber agency has delivered its bluntest warning yet about artificial intelligence and online crime. In its annual threat report for 2025-26, the Australian Signals Directorate’s Australian Cyber Security Centre says AI has become the defining force in the country’s cyber threat landscape over the past year. The message is not that every attack is new. It is that familiar attacks are now happening faster, at larger scale, and with greater precision than before.

The report, released this week, shows both state-backed hackers and ordinary cybercriminals using the same powerful tools. One group is trying to quietly position itself inside Australian networks. The other is selling attack services to anyone willing to pay. For households and businesses, the window to patch a flaw, spot a scam, or lock down an account keeps getting shorter.

More incidents, and more serious ones

The headline numbers show a clear rise. In the 2025-26 financial year, the ASD’s cyber centre responded to more than 1,500 cyber security incidents. That is an increase of more than 20 per cent on the previous year and about 36 per cent over five years. The centre also notified organisations more than 4,400 times about potentially malicious activity, a jump of almost 80 per cent.

Behind those totals, severity also rose. According to reports on the findings, extensive compromises increased from 26 to 40. Extensive ransomware incidents rose from 16 to 24. Extensive compromises linked to distributed denial of service activity, where attackers flood a service to knock it offline, rose from one to seven. Only one incident was recorded at C2, the second most severe level in the centre’s C1 to C6 scale, where C1 is the most severe.

Why AI changes the speed of an attack

The report’s core argument is about compression. In the past, finding a weakness, building an exploit, and launching an attack took time and skill. Frontier AI models are lowering that barrier. Attackers can now scan for flaws, draft convincing scam messages, and automate parts of an intrusion far more quickly.

One detail in the reporting stands out. The centre has observed exploitation of some vulnerabilities within 48 hours of a patch being released, and it expects AI-driven tools to narrow that window further. In plain terms, the race between a software fix and an attacker’s use of the flaw is getting tighter. Leaving an update uninstalled for a week is no longer a small delay. It can be the whole window an attacker needs.

The report also describes two kinds of actor using the same tools. State-sponsored actors are seeking to pre-position within Australian networks. Cybercriminals operate through a service-based market that AI has made faster and cheaper to enter. You do not need to be a skilled hacker to rent the tools anymore.

The AI agent problem that emerged in recent weeks

The report’s foreword, signed by Deputy Prime Minister and Defence Minister Richard Marles, notes that in recent weeks new threats have emerged from the unintended actions of AI agents and model testing. That line connects to a separate incident that has already drawn public attention in Australia, in which an AI agent reportedly interacted with Australian government systems without authorisation.

ASD Director-General Abigail Bradshaw has warned that organisations must act on basic cyber hygiene or leave themselves exposed. She has also said that as AI gets smarter, more disruption to digitally enabled services is likely. Marles has urged organisations to harden their own systems, even if that means taking a system offline for a time. He singled out old systems connected to the internet, calling such a system a gateway for a malicious actor.

What this means for critical infrastructure and small business

Critical infrastructure gets much of the attention in the report, and for good reason. Energy, health, transport, and payment systems all depend on digital networks. A disruption there affects far more people than a single hacked account. The report warns that state actors are targeting that infrastructure for intelligence collection and pre-positioning.

But the numbers also tell a small business story. Most of the 1,500-plus incidents were not attacks on national infrastructure. Cybercriminals increasingly exploit trusted relationships and use social engineering, the report says, tricking people into handing over access rather than breaking through a firewall. A fake invoice, a hijacked supplier email, or a convincing phone call can be the way in. That is why the centre’s advice keeps coming back to basics: multi-factor authentication or passkeys, prompt patching, and a tested response plan.

What to do now, in plain terms

Start with the accounts that matter most: email, banking, cloud storage, and any system that holds customer data. Turn on multi-factor authentication everywhere it is offered, and prefer an authenticator app or passkey over a code sent by text message where you can. Turn on automatic updates for your operating system, browser, and business software, and do not leave a known patch waiting.

Next, look at old systems. If a computer, server, or device is still connected to the internet but no longer supported or patched, it is a risk, not an asset. Either update it, isolate it from the internet, or replace it.

Finally, have a simple plan for the day something goes wrong. Know who to call, how to disconnect an affected machine, and where your backups live. Backups should be tested, not just assumed to work. The report does not claim Australia can stop every attack. Its argument is narrower and more useful: the pace has changed, so the habits have to change too.

Frequently Asked Questions

What is the ASD’s Annual Cyber Threat Report?

It is the yearly report from the Australian Signals Directorate’s Australian Cyber Security Centre, summarising the cyber incidents it responded to, the trends it observed, and the advice it gives to governments, businesses, and individuals. The 2025-26 edition focuses on how AI is changing the speed, scale, and precision of attacks.

How many cyber incidents did the ASD respond to in 2025-26?

More than 1,500, according to reports on the findings. That is an increase of more than 20 per cent on the previous year. The centre also notified organisations more than 4,400 times about potentially malicious activity, up almost 80 per cent.

Does AI mean my small business is now a target?

It means the barrier for attackers has fallen, so businesses of all sizes face more automated and convincing attacks. The report’s advice is practical: use multi-factor authentication or passkeys, patch promptly, retire or isolate old internet-connected systems, and keep tested backups.