AISA warns firms not to put AI before cyber basics

The Australian Information Security Association has warned organisations not to prioritise artificial intelligence cyber defence tools over basic security measures. The warning followed the release of the Australian Signals Directorate's annual cyber threat report.

Many organisations still face avoidable weaknesses such as unpatched vulnerabilities, unnecessary internet exposure and poor visibility over their systems and software, the industry body said. It argued these issues should be addressed before businesses commit significant resources to AI-based security products.

The warning came as the Australian Signals Directorate reported a sharp rise in cyber activity. Its Australian Cyber Security Centre responded to more than 1,500 cyber security incidents in 2025-26, up more than 20 per cent from the previous year, while notifications to organisations about potentially malicious cyber activity rose almost 80 per cent. Australians reported cybercrime about every six minutes.

Dr Rajiv Shah, spokesperson for the Australian Information Security Association, said the figures showed the pressure facing organisations but did not change the need for discipline on the basics.

"The measure of successful cyber security is how much risk you reduce, not whether you're using the latest AI tools," Shah said.

He said AI was becoming more important in both cyber attacks and defensive systems, but cautioned that the label covered a wide range of tools with different uses.

"ASD is right to highlight the growing role of AI in cyber attacks and defences. But its advice to embrace AI for cyber defence is ambitious for organisations that are still struggling to get the fundamentals right. They should also realise there are many different types of AI cyber defence, and not all are the right fit for every organisation.

"AI offers enormous opportunities to improve our defences, particularly as criminals use automation to launch attacks faster and at greater scale. But there's little point investing in sophisticated AI systems if you're leaving known vulnerabilities unpatched or exposing systems to the internet unnecessarily.

"Organisations need to know what technology they have, what software they're running, where their vulnerabilities are and which systems actually need to be connected to the internet.

"These are established cyber security practices, and they remain some of the most effective defences against increasingly automated attacks," Shah said.

Workforce pressure

AISA also used the report to highlight pressure on cyber security staff, saying boards and executives should consider whether teams have the resources and support needed to manage a more demanding threat environment.

"Behind every cyber defence system are people who have to keep it operating, investigate threats and respond when something goes wrong.

"Cyber security professionals are working in an environment where attacks are becoming faster and more complex, and the pressure to identify and respond to threats continues to grow.

"Organisations cannot expect their cyber security teams to absorb that pressure indefinitely. They need adequate staffing, access to professional development, realistic workloads and support for their wellbeing. Before asking them to add extra tools or 'just adopt AI', organisations need to be confident these will help, not distract from their everyday challenges.

"Looking after the people responsible for cyber security is an important part of maintaining effective defences," Shah said.

The association said directors and senior leaders should review existing arrangements before backing new technology spending. It pointed to routine controls such as asset inventories, timely patching, access controls and reducing unnecessary internet connections as areas where immediate attention may be needed.

"Every organisation should be asking some fairly straightforward questions. Do we have a complete inventory of our systems and software? Are we patching vulnerabilities promptly? Are we removing unnecessary internet connections? Are our access controls effective?

"If the answer to those questions is no, that's where the immediate attention needs to go.

"AI can be an important part of the solution, but organisations need to make informed decisions about where it will deliver measurable improvements in security. 'Using AI' is not a universal fix for all cyber problems," Shah said.

Design and procurement

AISA said cyber security should be considered earlier in system design and purchasing decisions, rather than after new technology is already in place. It also said organisations often underestimate the ongoing cost of maintaining systems, updating software and managing new vulnerabilities.

"Cyber security needs to be considered when systems are designed and purchased, rather than after they're installed.

"Too often, organisations invest in new technology without adequately accounting for the people, time and resources needed to maintain it, keep software updated and manage emerging vulnerabilities.

"Every new system creates an ongoing security responsibility. That needs to be built into budgets, procurement decisions and operational planning from the outset. Organisations also need to be clear on the expectations they have for their vendors to provide systems that are secure by default and by design, and on those vendors' commitment to ongoing support," Shah said.

The association said responsibility for cyber security extended beyond technical teams to boards, executives and frontline staff. Leaders need to understand their organisations' exposure and ensure appropriate support is in place.

"Cyber security is everyone's business. Boards and executives need to understand their organisation's exposure and ensure the right resources are available. Staff need to understand their responsibilities, and technical teams need the support and authority to do their jobs effectively.

"Australia has a highly skilled cyber security community, including AISA's 14,000 members, with expertise spanning organisations of every size and sector.

"That expertise is available to help organisations understand their risks, strengthen their defences and make sensible decisions about emerging technologies.

"The latest threat report is a clear reminder that cyber risks are growing. Our response needs to be practical, sustained and focused on the measures that genuinely make organisations safer," Shah said.