ASD Director General Bradshaw Orders Security Over Uptime in Annual Report

The Australian Signals Directorate has instructed that protecting digital infrastructure takes priority over maintaining constant access. The agency issued the guidance in its annual cyber threat report, released this week, noting that essential online services may experience unexpected interruptions while security work is completed.

ASD reported handling 1,500 cybersecurity incidents during the 2025-26 period. That figure represents a 20% increase compared to the previous year. The agency also notified external organizations, including businesses, governments, and critical infrastructure operators, about more than 4,400 potentially malicious cyber incidents. This notification count rose by 80% over the same timeframe.

The report identifies hostile foreign governments, criminals, and hackers as primary threats. These actors are using artificial intelligence to gather intelligence, disrupt critical infrastructure, and steal funds. State-based actors in the Indo-Pacific region are conducting attacks that may prepare for future conflicts. ASD stated that AI is enabling attackers to find weaknesses and execute operations with greater speed and effectiveness.

Abigail Bradshaw, the ASD director general, said on Monday that Australia must accelerate improvements to its technology foundations. She called for the adoption of AI tools to automate defensive tasks. Bradshaw referenced ASD’s access to Anthropic’s Mythos model. The developer restricted public release of that model because it can identify previously unknown flaws in IT systems. Australian government agencies view access to such advanced models and cooperation with AI laboratories as essential for strengthening defenses.

Defence minister Richard Marles urged Australians to enhance their protections while leveraging AI. Home affairs and cybersecurity minister Tony Burke stated the government is preparing for the threats and opportunities linked to emerging technologies. Bradshaw highlighted ageing technology as a major vulnerability, specifically systems whose manufacturers no longer provide updates. Last week, newly discovered weaknesses in the PHP programming language forced governments and businesses to rush patches.

ASD advised organizations to keep systems updated, report suspicious incidents, and seek assistance when needed. Bradshaw and Marles reiterated that security must come before keeping systems online. This approach may result in more services being temporarily unavailable as organizations secure their networks.