Australia’s cyber agency has told organisations to take systems offline when security demands it. For many businesses, whether insurance covers the lost income will depend on the wording of their cyber policy.
The Australian Signals Directorate’s (ASD) Annual Cyber Threat Report 2025–26, released on Tuesday, warned that “system security must be prioritised over system availability”. In a statement alongside the report, the government asked all entities to “lower thresholds for reporting to ASD and to prioritise security over service availability”. It said the likelihood of cyber incidents had “increased substantially”. ASD director-general Abigail Bradshaw and Defence Minister Richard Marles both said Australians should expect more services to go offline while they are secured.
The threat picture behind that advice has worsened. ASD’s Australian Cyber Security Centre responded to more than 1,500 cyber security incidents in 2025–26, up more than 20% on the previous year and 36% over five years. It sent more than 4,400 notifications to Australian entities about potentially malicious activity, almost 80% more than a year earlier, including mass notifications to more than 2,100 entities. It received more than 82,000 cybercrime reports, an average of one every six minutes.
The costs are also significant for smaller firms. The report puts the average reported cybercrime cost at $93,500 for businesses, and $33,000 for individuals. Cyber Security Minister Tony Burke said being under attack is “certain, constant and ever present”.
ASD was explicit about what that means for operations. “It is vital that businesses prepare for service disruptions from a cyber incident,” the agency said. Bradshaw named legacy technology, meaning outdated systems and devices that no longer receive updates, as among the biggest risks.
Taking systems offline to secure them sits awkwardly with how cyber business interruption cover is often written. IB AU has reported that Australian firms face growing outage losses their insurance may not cover. Voluntary shutdown cover is available in the local market, but it is typically linked to an incident. One Australian MGA’s construction cyber wording, for example, extends business interruption to a voluntary shutdown where it is “reasonably necessary to stop a cyber event in progress”. A precautionary takedown to patch a vulnerability, with no attack underway, may not meet that test.
For brokers with cyber clients, ASD’s advice turns a wording detail into a live question. Before a client takes systems offline on ASD’s guidance, check three things: whether the policy covers voluntary shutdown, what triggers it, and whether scheduled security downtime is excluded. If the answers fall the wrong way, following ASD’s advice could leave the client carrying the cost of its own outage.
