Australia’s top cyber official has a warning for anyone who relies on a website, an app or a payment system, which is everyone: expect more of them to fall over.
Abigail Bradshaw, director-general of the Australian Signals Directorate (ASD), told the ABC that with each jump in AI capability “we are likely to see more disruption”. That could mean sites pulled offline for urgent patching, data breaches, or services going dark.
Her comments came as the agency published its Annual Cyber Threat Report 2025–26, and the numbers back her up.
The ASD’s Australian Cyber Security Centre (ACSC) responded to more than 1,500 incidents last financial year, up more than 20%. It also sent more than 4,400 warnings to organisations about suspicious activity on their networks. Cybercrime reports eased slightly to more than 82,000, from 84,700 the year before. That is still one every six minutes.
For insurers, the cost data is the real story. The average self-reported loss per business report rose 16% to $93,500. Medium-sized firms were hit hardest, with average losses up 45% to $141,300. Small businesses held roughly steady at $55,400. Large businesses reported $148,100, down 27%, which suggests their spending on defence and response may be starting to pay off.
Financial and insurance services accounted for 6% of incidents. That puts the sector level with professional services and just behind healthcare on 7%. Federal agencies made up 32% and state and local government 16%. Manufacturing posted the biggest rise of any sector, while ransomware held steady at 139 cases.
In his foreword, Defence Minister Richard Marles calls AI the defining force in cyber threats over the past year. Bradshaw singled out frontier models such as Anthropic’s Mythos, which was held back from general release because it is so good at finding software flaws.
When Anthropic brought its controlled Mythos programme to Australia and New Zealand, IB reported the model had already uncovered more than 10,000 high- or critical-severity vulnerabilities. Emergence Insurance chief underwriter Jeffrey Gonlin said at the time that AI might make “everybody a super cyber criminal”.
In September the government revealed that an OpenAI agent researching health spending had got past security on Services Australia’s Medicare statistics portal in June and opened non-public files. No patient records were involved. But OpenAI took months to tell Canberra, and a taskforce is now investigating.
Bradshaw said the ASD has since set up early-warning arrangements with AI labs including OpenAI, which it has shared with Five Eyes partners. The aim is for agencies to hear about dangerous capabilities before models are tested.
Read next: When the future arrives early: What Mythos means for the ANZ cyber insurance market
The ASD also went public on its offensive work. It said it got inside Amadey, info-stealing malware hidden in pirated software such as a fake Photoshop, and cut its operators off from about 180,000 infected computers worldwide. In a separate operation it destroyed about 4.8 million files stolen from Australians before they could be sold.
That matters for underwriters. Logins harvested by tools like Amadey are a common way in for the ransomware and business email compromise attacks behind many cyber claims.
Attackers successfully exploited a flaw first identified in 2008, and publicly reported vulnerabilities rose 30%. Bradshaw said replacing vulnerable legacy systems is a big job for government and business alike.
That hands brokers a renewal script. Multifactor authentication or passkeys, patching speed and a tested response plan still decide whether an attack turns into a claim. And in a soft market, with SME premiums well below their peak, clients have fewer excuses to go without cover.
Globally, Swiss Re puts cyber premium on track for about US$16.4bn this year. It estimates AI played a part in roughly a quarter of breaches in the first half.
Read next: Revealed – best cyber insurance providers in Australia for 2026
Bradshaw expects the regional picture to get harder too, with state actors using AI to fill intelligence gaps as tensions rise. Fixing the weak points, she said, is now “a matter of urgency”.
