THE WORLD IS NOT STANDING STILL.RSS
BIG CHANGE.
BIG CHANGE, one tap away
BIG CHANGE, one tap away

Make room for the big picture.

Add BIG CHANGE to your home screen or desktop. It opens in its own window, with the latest stories when you’re online.

iPhone & iPad
Open bigchange.ai in Safari. Tap Share, then Add to Home Screen. Turn on Open as Web App if shown, then tap Add.
Android
Open bigchange.ai in Chrome. In the browser menu, choose Install app or Add to Home screen.
Desktop
In Chrome or Edge, use the install icon in the address bar or the browser’s app menu. In Safari on Mac, choose File → Add to Dock.

Markdown edition

# Australia’s cyber alerts rose sharply. Its AI attack count is unknown

> ASD warnings rose almost 80%; its published report gives no AI-attributed attack count.

By BIGCHANGE.AI Editorial

Published: 2026-10-27T12:27:17.859Z
Updated: 2026-10-27T12:27:17.859Z
Canonical: https://bigchange.ai/blog/australia-cyber-alerts-ai-attack-count-2025-26

![Conceptual charcoal illustration of one hand lifting a wall telephone handset while a blank mobile phone rests on a separate shelf.](https://bigchange.ai/api/media/file/asd-independent-call-hero-v2.png)
AI-generated conceptual illustration by BIG CHANGE.

The Australian Signals Directorate (ASD) says in its [2025–26 Annual Cyber Threat Report](https://www.cyber.gov.au/publication/annual-cyber-threat-report-2025-26/executive-summary), published 26 October, that it issued more than 4,400 warnings, up almost 80%. The report gives no AI-attributed attack count.

## The big change

- **What changed:** ASD’s near-80% rise measures warnings; incident responses rose about 20%.
- **Why it matters:** Verify sensitive requests through a trusted channel; convincing words or voices are weak proof of identity.
- **What to watch:** An AI-attributed incident series and a disclosed case definition would make claims about AI’s share testable.

The report invites two different readings. One concerns how often its cyber security centre saw or acted on a problem. The other concerns what new tools might make an attacker more effective. Treating a change in the first as proof of the second would assign a cause that the published evidence does not establish.

## Reports, responses and warnings

ASD received over 82,000 cybercrime reports and handled over 1,500 incidents, up 20%. Its [notes](https://www.cyber.gov.au/publication/annual-cyber-threat-report-2025-26/notes) describe distinct, incomplete datasets.

These measures have different units. A report, an incident response and a warning are not mutually convertible. Comparing their changes requires knowing how reporting, detection and outreach worked in each period. The headline totals alone cannot identify which of those processes changed.

The [2024–25 ASD report](https://www.cyber.gov.au/publication/annual-cyber-threat-report-2024-2025) recorded more than 84,700 cybercrime reports, more than 1,200 incident responses and more than 1,700 notifications. Each figure is a rounded lower bound. Dividing those bounds would manufacture a precise growth rate.

Even comparisons within the incident series need care. The [current year-in-review](https://www.cyber.gov.au/publication/annual-cyber-threat-report-2025-26/year-in-review) flags revised severity categories and improved reporting. The count can change because more activity happened, more was detected or more was reported. These explanations cannot be separated using the headline totals alone.

## AI changes the approach to a target

[ASD’s social-engineering chapter](https://www.cyber.gov.au/publication/annual-cyber-threat-report-2025-26/australian-cyber-threat-landscape/social-engineering) describes AI-written phishing; generative tools can produce plausible messages quickly and at scale, reducing the skill and effort required.

Australia’s corporate regulator provides a more specific example from its own remit. [ASIC says](https://www.asic.gov.au/about-asic/news-centre/find-a-media-release/2026-releases/26-195mr-asic-warns-scammers-are-using-ai-to-spin-vast-webs-of-deception) it has seen investment scams built around deepfake videos of public figures. The videos sit alongside spoof websites, fabricated articles and fake reviews. A search for the supposed opportunity may therefore turn up several mutually reinforcing false signals. ASIC reports removing more than 19,400 online scams in the financial year, up 182%, but its removals include many kinds of fraud and reflect enforcement activity. They cannot be used as a count of AI attacks.

The UK’s [National Cyber Security Centre annual review](https://www.ncsc.gov.uk/collection/ncsc-annual-review-2025/chapter-01-cyber-threat-to-the-uk) describes a similar pattern across a different jurisdiction: threat actors use AI to improve existing techniques, including reconnaissance, social engineering and vulnerability research. It expects AI-assisted vulnerability research and exploit development to matter more, which is an assessment of likely future capability. The UK account corroborates the mechanism. It does not independently validate a percentage change in Australia’s incidents.

## What a warning can and cannot tell its recipient

An ASD warning prompts investigation. The recipient may still be able to check exposure, identify a compromise or contain one. Without the finding from that investigation, the warning alone should not be described as a successful intrusion. Preventing an intrusion is also a reason to warn early, so the value of an alert cannot be judged only by the number of incidents later confirmed.

ASD’s separate [social-engineering guidance](https://www.cyber.gov.au/guidance/learn-about-social-engineering) advises independently verifying unexpected requests through a trusted method, especially when they ask for credentials, a payment or a security-setting change. That shifts the check away from the appearance of a message or the sound of a caller. ASIC makes a parallel point for investments: polished search results and familiar endorsements are not adequate verification of a provider. These are concrete precautions supported by the agencies’ guidance; this article has not tested their effectiveness in a particular case.

To estimate AI’s share of Australian cyber incidents, readers would need a consistent definition of AI involvement, case-level attribution and a disclosed denominator over comparable periods. That denominator is the missing evidence behind any claim that AI drove the increase.

## Sources

- [Australian Signals Directorate, Annual Cyber Threat Report 2025–26 (26 October 2026)](https://www.cyber.gov.au/publication/annual-cyber-threat-report-2025-26/executive-summary) — Agency measures and limits.
- [Australian Signals Directorate, Annual Cyber Threat Report 2024–25 (14 October 2025)](https://www.cyber.gov.au/publication/annual-cyber-threat-report-2024-2025) — Prior agency figures are rounded lower bounds, so they cannot be used as an exact denominator.
- [Australian Securities and Investments Commission, warning on AI investment scams](https://www.asic.gov.au/about-asic/news-centre/find-a-media-release/2026-releases/26-195mr-asic-warns-scammers-are-using-ai-to-spin-vast-webs-of-deception) — Regulator's firsthand account of generated endorsements and spoof sites. Its takedown metric measures ASIC removals, not ASD incidents or the national prevalence of AI-assisted attacks.
- [Australian Signals Directorate, Learn about social engineering (reviewed 9 April 2026)](https://www.cyber.gov.au/guidance/learn-about-social-engineering) — Separate practical guidance for checking suspicious requests by a trusted channel; advice, not evidence that any particular 2025–26 case was prevented.
- [UK National Cyber Security Centre, Annual Review 2025: Countering the cyber threat](https://www.ncsc.gov.uk/collection/ncsc-annual-review-2025/chapter-01-cyber-threat-to-the-uk) — Separate UK primary assessment of AI improving existing attack techniques. Its forward-looking vulnerability research judgement is not a measured Australian trend.