The threat is spreading
ASD says foreign governments, criminals and hackers are using AI to gather intelligence, target critical infrastructure and steal money. Government and private networks in Australia faced persistent attempts by state-backed actors last year. ASD says actors in the Indo-Pacific may be preparing for future conflicts by collecting intelligence and positioning themselves to disrupt systems.
The warnings are not limited to large institutions. ASD says the threat level has risen for all network owners, making cybersecurity a business risk and a responsibility for organisational leaders, not just technical teams.
The agency also sees AI as part of the defence. Its report says AI tools can help defenders identify vulnerabilities and suspicious behaviour, then respond to incidents faster. ASD chief executive Abigail Bradshaw said on Monday that Australia needs AI tools to automate defence against attackers using AI, alongside faster upgrades to technology and cybersecurity foundations.
The agency has access to Anthropic’s Mythos model, Bradshaw has previously said. Anthropic has said it did not release the powerful model to the public because it could identify previously unknown vulnerabilities in IT systems. Australian government agencies view access to advanced models and cooperation with leading AI labs as important to strengthening cyber defences.
The cost of staying online
Bradshaw has identified legacy technology as a major risk and an attractive target for hackers, especially systems and devices no longer receiving software updates. Last week, newly discovered vulnerabilities in PHP, the programming language used by most websites, prompted governments and companies to urgently address the issue.
ASD recommends that organisations update systems, seek help from the agency and report suspicious incidents. Defence Minister Richard Marles said Australia must strengthen its cyber defences while making use of AI’s benefits. Home Affairs and Cybersecurity Minister Tony Burke said the government was preparing the country for the threats and opportunities posed by developing technologies.
Bradshaw and Marles have also urged organisations to put system security ahead of availability. That can mean temporarily shutting down services while specialists fix vulnerabilities.
I think that warning is the report’s most consequential point: resilience may require accepting visible disruption now to avoid a more damaging breach later. The agency is clear about the trade-off, but less specific about how organisations should decide when a service is safe enough to bring back online.
Daily AI news
Every day we pick what actually matters in AI and explain it plainly — no hype, no filler. Subscribe if you want to follow where the industry is going.
Only what matters — every day
Follow on X