The Australian Signals Directorate (ASD) published its Annual Cyber Threat Report 2025-26 on 26 October. Its business factsheet reports more than 82,000 cybercrime reports, one every six minutes, and more than 1,500 cyber security incidents that ASD responded to.
ASD's view of AI is measured. AI hasn't introduced new threats, it has amplified the ones we already know. For most organisations, the practical consequence is speed.
The patch window is shrinking
ASD says most vulnerability exploitation occurs within two weeks, and some within 48 hours of a patch or mitigation advice being released. It expects AI-driven tools to compress that window further over the next 12 months.
Its summary is blunt: "In the past, defenders had months to patch, now they have days, sometimes only hours."
Old flaws still matter too. This year ASD recorded successful exploitation of a vulnerability identified in 2008.
What it is costing
The average self-reported cost of cybercrime per business report was $93,500, up 16%. For medium businesses it was $141,300, up 45%. These figures are self-reported, and the report doesn't tie them to AI.
Who owns the clock?
ASD puts it plainly: "Cyber resilience cannot be treated as a purely technical issue. It is a core business risk and leadership responsibility."
This is our view, not ASD's. Patching speed is a risk appetite decision. Someone senior should own the clock, agree a target time-to-patch (shorter for internet-facing systems), and check the records to see whether it was met. The 2008 case shows the other half: you can't patch what you don't know you have.
What to do now
ASD's advice scales with size:
- Small business: choose products that are secure by design, turn on automatic updates, and make someone clearly responsible for security monitoring and incident response.
- Medium business: keep an inventory of internet-facing systems, patch promptly, segment your network, and test incident response and business continuity plans.
- Large organisations: establish executive accountability for AI-related cyber risks.
Our addition for any size: write down your time-to-patch target, name the owner, and review the actual patch times each month. If you work to ISO 27001, this sits under Annex A control A.8.8, Management of technical vulnerabilities.
The next governance question is AI agents with access to your systems. ASD's separate guidance points to minimum permissions, human approval for high-impact actions, logging and isolation. We'll cover it soon.
Key points
- ASD says AI has amplified existing cyber threats rather than created new ones.
- Most exploitation happens within two weeks of a patch, some within 48 hours, and ASD expects AI to shorten that further.
- Time-to-patch needs a named owner and an agreed target, because resilience is a leadership responsibility.
Sources
- Australian Signals Directorate, Annual Cyber Threat Report 2025-26, 26 October 2026.
Need help applying this to your organisation? Talk to Cybervisory.