AI accelerates cyber threats as basic security gaps persist: ASD report

Cyber resilience is in the spotlight as AI raises speed and scale of threats.

Australian organisations need greater focus on cyber resilience in the wake of growing numbers of cybersecurity incidents, according to the Australian Signals Directorate's (ASD’s) annual threat report.

The Australian Cyber Security Centre (ACSC) responded to more than 1,500 incidents, a jump of more than 20 percent, and issued notifications of potential malicious activity more than 4,400 times, an almost 80 percent increase on the previous year.

Chris Pallister, head of managed security services at Interactive, said the numbers show there’s still a significant visibility challenge.

“SOCs need to be more proactive, using threat intelligence, continuous exposure monitoring and detection engineering to identify where organisations are most vulnerable before an attacker gets there,” he said.

The report also showed that the attacks that succeed are becoming more damaging because attackers are getting further into organisations.

“The difference between a bad day and a business-ending week can come down to how quickly your SOC detects and responds,” Pallister told CRN Australia.

The average self-reported cost of a cyber incident to medium-size businesses rose 45 percent to $141,300, while large businesses saw costs fall 27 percent.

“Medium businesses now face losses close to those of large enterprises, usually without the same security budget or in-house team,” Clint Thomson, director, TechConnect said.

“That's the part of the market most Australian IT providers serve, so it's where we'd expect the most attention over the next year.”

AI is the defining force in cyber threats

AI has been the defining force in cyber threats over the past year, the report noted, allowing malicious actors to find vulnerabilities faster and exploit them at scale, speed and sophistication.

“AI hasn't created new types of threats, it's made existing ones faster and cheaper to run,” Thomson said, noting that this puts more pressure on patching speed, particularly for internet-facing systems.

“The other side of AI is how businesses are adopting it themselves. Many organisations are connecting AI agents and copilots to email, files and business systems without effective governance over what those tools can access,” he said.

“ASD has published guidance on careful adoption of agentic AI, and it deserves more airtime. With compromised accounts and credentials already among the most reported incident types, AI tools with broad access are a risk businesses should be managing now, not later,” he added.

Fundamentals remain the best line of defence

While cyber threats are growing in speed and scale, the fundamentals remain the best line of defence. Yet, it’s gaps in basic cyber defences that are the problem, the report concluded.

“Attackers aren’t necessarily breaking in through some sophisticated new technique. They’re often logging in using compromised credentials, exploiting known vulnerabilities or targeting edge devices,” Pallister told CRN Australia.

“Good operational security, from verifying a caller before resetting a password through to knowing what assets you have exposed, remains just as important as the security technology you buy,” he added.

“The broader message from the report is that cyber resilience increasingly comes down to visibility and speed.”