ASD's ACSC publishes Annual Cyber Threat Report 2025-26, identifies AI as the 'defining force', and releases the Essentials framework series (evolving the Essential Eight)

The Australian Signals Directorate's ACSC published its Annual Cyber Threat Report 2025-26 (released ~26 October 2026, per reporting) calling AI 'the defining force in the cyber threat landscape over the past year.' It reports 1,500+ cyber security incidents responded to in FY2025-26 (up 20%), 4,400+ notifications (up ~80%), and highlights that AI enables malicious actors to identify vulnerabilities and develop exploits faster and at greater scale, with most exploitation now occurring within two weeks and some flaws exploited within 48 hours of patch/advice release. It explicitly flags agentic AI and the potential for highly autonomous or recursively self-improving AI to accelerate the scale and sophistication of threats, and urges organisations to use AI defensively (early vulnerability detection, monitoring, faster incident response) while adapting governance to AI-related threats and vulnerabilities. The report also announces that in October 2026 ASD's ACSC released the 'Essentials series', evolving the Essential Eight into a modern, principles-based framework with chapters for enterprise IT, operational technology and cloud, framed as a necessary reflection of advances in threats (including preparation for AI-enabled cyber threats) and advising a gap analysis before transition, with transitional arrangements continuing into 2027.

It is an authoritative national cyber-authority statement that AI and agentic AI are now the primary risk accelerant for Australian critical infrastructure and businesses, and it redefines the country's core cyber guidance baseline (Essentials series) to address AI-enabled threats and diversified technology environments — effectively a control-baseline change with potentially broad adoption in and beyond Australia. The explicit recommendation to speed up patching (days, not months) and to adapt governance to agentic AI is directly actionable.

Australian organisations (and those aligned to the Essential Eight pathway) should start a gap analysis against the new Essentials series (enterprise IT / OT / cloud chapters) and prioritise accelerated patching and event logging; security leaders should fold AI-enabled and agentic-AI threat adaptation into risk management and incident playbooks per the report's recommendations.