DOSSIER 002 · FIELD NOTES
ASD's Annual Cyber Threat Report 2025-26: more incidents, far more notifications
ASD's ACSC responded to over 1,500 incidents in 2025-26 and sent more than 4,400 notifications of potential malicious activity. Here's what the report says about AI and trust, and what I'd do with an ASD notification.
ASD has released its Annual Cyber Threat Report 2025-26. I've read through the summary, and two numbers stood out to me.
The numbers
In 2025-26, ASD's ACSC responded to over 1,500 cyber security incidents, an increase of more than 20%.
It also notified entities of potential malicious activity more than 4,400 times. That's almost an 80% increase on the previous year.
AI was the defining force
The report says AI has been the defining force in the cyber threat landscape over the past year. It's letting malicious actors find vulnerabilities faster and exploit them at unprecedented scale, speed and sophistication.
It also notes that new threats have emerged in recent weeks from the unintended actions of AI agents and model testing. That's a different kind of risk from an attacker using AI, and I think it's worth tracking separately.
Trust is the attack surface
The other theme I'd underline is trust. ASD says cybercriminals are becoming more adaptive, increasingly exploiting trusted relationships and using social engineering to manipulate people and organisations into granting access to sensitive systems and information.
What ASD says to do
The report's key actions are fairly short:
- Organisations should embrace AI to improve resilience, while preparing to counter malicious uses of AI by adversaries.
- Get the basics in place, such as reviewing privacy settings and enabling multi-factor authentication (MFA) or passkeys.
- Report suspicious cyber activity, incidents and vulnerabilities to cyber.gov.au or the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).
My take: treat a notification as an incident
This part is my opinion, not ASD's.
If ASD notifies you of potential malicious activity, treat it as an incident, not an FYI. With notifications up almost 80%, the gap between "we were told" and "we acted" is where the damage happens.
So I'd check three things:
- Who in your organisation actually receives ASD notifications, and whether that inbox or contact is still current.
- How those notifications get triaged, and by whom.
- How quickly they get escalated into your incident response process.
If you can't answer those quickly, that's the first thing I'd fix, before anything else in the report.