Australia's annual cyber threat report
On 26 October 2026 the Australian Signals Directorate and its Australian Cyber Security Centre published the seventh annual Cyber Threat Report, for the 2025-26 financial year: more than 1,500 incidents (20% more than the year before), more than 4,400 notifications to organizations (80% more) and more than 82,000 cybercrime reports. By the report, AI helps state actors and criminals find vulnerabilities, develop exploits and scale attacks.
Why it matters
An agency that sees thousands of incidents puts AI at the centre of its annual report but words it with restraint: AI 'has not introduced new cyber threats, but ... amplified existing ones'. Hence the advice: patch legacy systems harder and keep the basic controls; the report also names agentic AI and a possible rapid advance towards 'highly autonomous or recursively self-improving AI' as something that may speed up threats. It is the agency's assessment: the part read gives no measure of how many attacks were run with AI.
What was read. The executive summary of the seventh report on the report's own page and ASD's news release announcing it; the chapters after the summary (Year in Review and on) were not read. Numbers in the summary. In FY2025-26 ASD's ACSC responded to more than 1,500 cyber security incidents, 20% more than the previous year and 36% more than five years earlier; it notified entities more than 4,400 times of potentially malicious activity, 80% more than in FY2024-25, including over 2,200 individual notifications and collective notifications to more than 2,100 entities. According to the news release ACSC received more than 82,000 cybercrime reports, about one every 6 minutes. On AI. During the year AI tools became more accessible, driven by a new generation of frontier models; malicious actors need less effort to target critical infrastructure, governments, businesses and individuals, and both state-sponsored actors and cybercriminals can use AI to identify vulnerabilities, develop exploits and launch attacks at greater scale than ever before. AI has amplified social engineering, making impersonation of people and businesses more convincing. At the same time, integrating AI into security operations can help detect vulnerabilities earlier, improve software quality, monitor for unusual behaviour and speed up incident response. The report says 'AI capabilities have not introduced new cyber threats, but they have amplified existing ones' and names priorities: less legacy IT, event logging, supply chain management and post-quantum cryptography by the end of 2030 or sooner. State actors, it says, increasingly pre-position in networks. In October 2026 ACSC released the Essentials series, which evolves the Essential Eight. What the record does not claim. In the part read, the report does not measure the share of attacks run with AI or name incidents in which AI was established; the statements about AI are the agency's assessment. The counts of incidents and notifications are ASD's own. The report is dated 26 October by its own page and announced on 27 October.