Outdated technology and weak digital security practices are leaving Australian organisations increasingly exposed as artificial intelligence enables cyber attacks to be launched more quickly and precisely, the Australian Signals Directorate has warned.
Its latest Cyber Threat Report records a 36 per cent rise in incidents over the past five years, with almost 1,500 reported to the Australian Cyber Security Centre during the last financial year.
The public sector accounted for nearly half of those incidents. One was classified as an extensive incident, the second-highest level of severity.
The centre also received 82,000 reports during the year, equivalent to one every six minutes, highlighting the scale of cybercrime affecting businesses and individuals.
Cyber attacks and service outages
Abigail Bradshaw, the director-general of the Australian Signals Directorate, said artificial intelligence was creating new opportunities but also allowing malicious actors to find weaknesses and conduct attacks at greater speed and scale.
“They are creating enormous opportunities, but they are also enabling malicious cyber actors to identify vulnerabilities and to conduct attacks faster, at greater scale, and with greater precision than before,” she said. “This shift will only accelerate.”
Legacy technology, including software no longer supported by its vendors, was identified as Australia’s biggest cybersecurity weakness. The directorate said every sector of the economy was at risk.
Ms Bradshaw urged organisations to improve basic cyber hygiene and warned that frequent network outages could become a normal response to attacks and software updates.
“System security must be prioritised over system availability in order to deal with increased vulnerability discovery by new AI models … the prospect of compromise has increased,” she said.
Attackers continue to rely on familiar methods, including scraping usernames and passwords and exploiting them. However, artificial intelligence has greatly increased the speed at which criminals can collect information and turn software weaknesses into attacks.
Medium-sized businesses face rising losses
Medium-sized businesses recorded a particularly sharp rise in losses from cybercrime. The cost of self-reported cybercrime for a medium-sized business reached 141,300 Australian dollars, a 45 per cent increase.
The directorate said the increase was understood to be linked to smaller operators being less able to afford executive-level information technology roles than larger businesses.
Australian authorities are working with Five Eyes partner nations to test emerging frontier models, including Anthropic’s Mythos 5, which is known for finding and exploiting software vulnerabilities at exceptional speed.
The directorate is calling for closer links with operators of frontier models to help authorities prepare for and respond to attacks using artificial intelligence.
The annual update does not include several recent high-profile incidents, including a global PHP outage and a breach involving an OpenAI agent and publicly available Australian government data. The full effect of attacks using frontier AI models is expected to be reflected in the next update.
