Australia’s cyber agency says AI is making it easier to find and use software flaws, raising pressure on organizations to secure systems before attackers can act.
During FY2025-26, the Australian Signals Directorate (ASD), through its Australian Cyber Security Centre (ACSC), responded to 1,524 cyber security incidents, 20% more than in FY2024-25. The agency also issued more than 4,400 notifications about potentially malicious activity, an 80% rise. The totals measure separate parts of its work: 362 incident responses followed proactive notifications to organizations. The report does not say how many cases involved AI or attribute the annual increase to it.
ASD says AI can handle tasks such as gathering information and sorting likely targets, while helping users assess weaknesses and combine them into attack paths. The agency says these tools can reduce the expertise and work required for some malicious operations and allow them to be carried out at greater scale.
Cybercriminals seek financial gain through extortion, ransomware and data theft, while state-backed actors may pursue sensitive information or retain access for potential disruption during a crisis, ASD says. Individuals and organizations face the resulting harm. Attacks on critical infrastructure can also disrupt services relied on by millions. Unpatched software, older systems and connections to outside suppliers add to organizations’ exposure.
Among the vulnerabilities ASD tracked, exploitation generally occurred within two weeks. In some cases, attackers acted within two days of a patch or other mitigation being announced. The agency expects wider AI use to leave defenders less time to respond over the coming year. One flaw exploited during FY2025-26 had been known since 2008.
The increase was not consistent across categories. ACSC responded to 154 incidents involving critical infrastructure, about 10% of its total and nearly 7% fewer than a year earlier. Denial-of-service incidents also declined by more than 60%, the report says. ASD revised some incident classifications for FY2025-26, limiting comparisons in certain categories; it also noted greater cyber security awareness and improved reporting practices without measuring their contribution to the annual rise.
For FY2026-27, ASD identified reducing exposure from legacy IT, improving logging and managing supplier risks as priorities.
