Cyber Defense: Australia warns essential services will go offline

The Australian Signals Directorate has instructed organizations to take essential online services offline when necessary to patch security flaws, placing the integrity of systems above continuous access. This directive comes from the agency's annual cyber threat report, which outlines a strategy where protection of infrastructure takes precedence over maintaining user connectivity during active security work.

The agency processed 1,500 cybersecurity incidents during the 2025-26 fiscal year, marking a 20 percent increase over the previous period. In the same timeframe, ASD notified external entities, including businesses and critical infrastructure operators, of more than 4,400 potentially malicious events. This notification figure rose by 80 percent year over year, reflecting a sharp uptick in detected threats targeting Australian networks.

The report attributes this surge to hostile foreign governments, criminal groups, and hackers leveraging artificial intelligence. These actors use AI to gather intelligence, disrupt critical infrastructure, and extract funds. State-based actors have persisted in attempting to breach government and private networks, with ASD noting that Indo-Pacific nations may be conducting operations to prepare for future conflicts. The agency warns that AI tools allow attackers to find weaknesses and execute operations with greater speed and effectiveness.

Director General Abigail Bradshaw stated on Monday that Australia must accelerate improvements to its technological and cybersecurity foundations. She advocated for the use of AI tools to automate defensive tasks and help organizations stay ahead of attackers who utilize similar technologies. Bradshaw referenced ASD's access to Anthropic's Mythos model, a tool the developer has withheld from public release due to its capacity to identify previously unknown flaws in IT systems.

Government officials support this approach. Defence minister Richard Marles urged Australians to enhance their protections while utilizing AI capabilities. Home affairs and cybersecurity minister Tony Burke said the government is preparing for the threats and opportunities presented by emerging technologies. Bradshaw also identified ageing technology as a major vulnerability, specifically citing systems and devices that no longer receive updates from their manufacturers.

This concern is immediate, as newly identified weaknesses in the PHP programming language, which underpins most websites, forced governments and businesses to rush patches last week. ASD urges organizations to keep systems updated and report suspicious incidents. Bradshaw and Marles confirmed that security will come before uptime, meaning more services may remain temporarily unavailable while organizations secure their infrastructure.