Australians should prepare for important online services to go offline unexpectedly as cyber threats grow, the Australian Signals Directorate has warned. The agency says the response will require stronger technology foundations and wider use of advanced artificial intelligence tools to defend against attackers also using AI.
The warning accompanies the ASD’s annual cyber threat report, as described by the Guardian. It presents a picture of elevated pressure on government and private networks, with cybercriminals and state-linked actors using increasingly capable tools to find vulnerabilities, gather intelligence, disrupt systems and steal money.
The message is notable for its emphasis on resilience as well as prevention. Rather than assuming services can always remain available, the agency said system security should take priority over system availability. In practice, that means organisations and the public may have to anticipate disruptions as a consequence of defensive action or attacks.
AI changes both sides of cyber defence
ASD director-general Abigail Bradshaw said Australia needs to use AI tools to automate defences and keep pace with AI-enabled attackers. The agency’s position is not that AI alone will solve cyber risk. Rather, it argues that defenders need modern capabilities because attackers can use AI to accelerate reconnaissance, identify weaknesses and conduct operations more effectively.
The report described AI as creating positive opportunities while also lowering barriers and increasing the capability of criminal and state-based actors. That dual-use quality has become a central issue for cybersecurity policy. The same systems that can help an organisation sift through alerts, detect unusual behaviour and automate routine work can be used by adversaries to scale intelligence gathering and attack preparation.
For critical infrastructure and businesses, the warning points toward a defensive model that combines AI-enabled tools with updated core systems and security practices. The agency’s call is broader than a recommendation to buy a new product: it is an appeal to modernise the underlying technology and cybersecurity foundations on which essential services depend.
Rising incident figures
According to the Guardian’s account of the report, ASD responded to 1,500 cybersecurity incidents during the 2025–26 year. That represented a 20% increase from the preceding year. It also notified external organisations, including businesses, governments and critical-infrastructure entities, of more than 4,400 potential malicious cyber incidents, an 80% increase over a year.
Those figures do not necessarily mean every notification became a successful compromise. They do show a larger operational workload and a high volume of potentially harmful activity affecting organisations outside the agency. The reported trend is consistent with ASD’s broader warning that network owners face elevated threat levels.
The agency also said government and private networks experienced persistent attempted breaches from state-based actors. It warned that actors in the Indo-Pacific could conduct activity that prepares for possible future conflict, including intelligence collection or disruption. Such preparation can be strategically significant even when it does not immediately produce a visible service outage.
Planning for disruption
The recommendation that people prepare for unexpected outages shifts attention from cybersecurity as an invisible specialist concern to cybersecurity as a continuity issue. Many day-to-day services depend on digital systems: communications, payments, logistics, public administration and business operations. A disruption can have consequences even if it is short-lived.
For organisations, the practical implication is the need to treat availability as one element of a wider security and resilience strategy. The ASD’s framing suggests that the safest action during an incident may sometimes restrict access, isolate systems or take services offline. That can reduce immediate convenience but limit the chance of a more serious compromise.
The report’s message also places responsibility across government and private-sector networks. Critical infrastructure, businesses and other network owners may face different risks, but the agency’s warning is directed at the systems people rely on every day. Building resilience therefore involves more than responding after an attack; it includes preparation for outages and a capacity to recover.
A technology-policy challenge
Australia’s warning reflects a wider policy challenge created by rapidly advancing AI. As the tools become more available, defensive institutions must judge how to deploy them responsibly while adapting to the ways hostile actors may exploit them. ASD’s answer is that advanced defensive AI is necessary, alongside a faster modernization of cybersecurity foundations.
The available information does not specify particular tools, mandate a single technical approach or establish a timetable for every organisation. But it is a clear signal from the country’s signals intelligence agency: disruptions are a plausible part of the cyber-threat environment, and planning for them is becoming as important as preserving uninterrupted access.
For the public, the immediate takeaway is straightforward. Online services that feel routine should not be assumed to be permanently available. For operators, the task is harder: strengthen systems, prepare for interruptions and adapt defences to an environment in which AI can increase both the pace of attacks and the capacity to detect and counter them.
This article is based on reporting by The Guardian. Read the original article.
Originally published on theguardian.com
