The Pulse
Australia’s ASD Says AI Is Speeding Up Cyberattacks
Australia’s Signals Directorate says AI is helping attackers find vulnerabilities faster and scale phishing, as its cyber centre responded to more than 1,500 incidents in 2025–26. The agency urges organisations to patch systems quickly, ret
AI.info Team · Written with AI · fact-checked ·
Australia’s cyber agency says artificial intelligence is reducing the effort needed to find and exploit software weaknesses, widening the pool of people able to carry out attacks. The Australian Signals Directorate’s 2025–26 Annual Cyber Threat Report was published on October 26 and highlighted in an agency announcement the following day.
The report describes AI as an accelerant for existing tactics, not a source of entirely new kinds of cyber threat. It says tools that generate text and code can help malicious actors identify vulnerabilities, automate reconnaissance and make phishing more convincing. As organisations add AI systems to their own networks, the report warns, they can also create new security weaknesses.
AI lowers the effort required to target systems
ASD says attackers can use AI to analyse publicly available information about an organisation and shape messages around a particular person or role. The tools can produce polished phishing emails and automate targeted spearphishing, making it easier to imitate a trusted colleague or an authoritative organisation. AI-generated messages may also include images or voice recordings that make a false request seem authentic.
The report’s warning is not limited to scams. AI can help attackers collect and analyse data, select targets and link software weaknesses into vulnerability chains that provide broader access. “AI is reducing the expertise and effort required to identify and exploit vulnerabilities, likely accelerating Time to Exploit (TTE) and increasing the number and diversity of actors able to undertake cyber attacks,” the report says.
AI is reducing the expertise and effort required to identify and exploit vulnerabilities, likely accelerating Time to Exploit (TTE) and increasing the number and diversity of actors able to undertake cyber attacks.
Australian Signals Directorate, Annual Cyber Threat Report 2025-26
Some organisations may have hours to patch
ASD says most vulnerability exploitation it has observed takes place within two weeks, while some vulnerabilities have been exploited within 48 hours of a patch or mitigation notice. The agency expects AI-driven tools to compress that period further over the next 12 months, leaving organisations less time to detect, patch and respond to newly disclosed flaws.
The report also records successful exploitation of a vulnerability first identified in 2008, a reminder that attackers can still gain ground through old, unpatched weaknesses. Its account of AI-assisted attacks therefore sits alongside familiar security failures: outdated systems, social engineering and insecure processes. Faster discovery tools make the consequences of slow maintenance more pressing.
Incident response rose 20% in a year
ASD’s Australian Cyber Security Centre responded to more than 1,500 cyber incidents in the 2025–26 financial year, a 20% increase from the previous year and a 36% rise over five years. The agency also sent more than 4,400 notifications about potentially malicious activity, almost 80% more than in 2024–25. It says 362 incidents were identified after proactive notifications to affected entities.
The centre received more than 82,000 cybercrime reports, averaging one every six minutes. Average self-reported losses per cybercrime report reached A$93,500 for businesses, up 16%; for individuals, the average remained A$33,000. The report notes that incident totals include a rise in reporting and that stronger awareness may help explain the increase, so the figures do not by themselves measure how much of the change came from more attacks.
ASD’s response starts with basic controls
The report urges organisations to improve patching, reduce reliance on legacy technology, log cyber events and manage supply-chain risks. It also calls for preparation around AI systems and for a shift away from traditional asymmetric cryptography by the end of 2030, or sooner, to reduce exposure if quantum computing advances faster than expected.
For individuals, ASD points to practical steps such as reviewing privacy settings and enabling multifactor authentication or passkeys. The agency’s central warning is that AI can increase the speed and reach of familiar attack methods, while the defences it recommends remain concrete: close known vulnerabilities, limit unnecessary access and make suspicious activity visible.