ASD Warns AI-Powered Attacks Are Coming: Shorten Your Patch Window
The Australian Signals Directorate has put out its annual cyber threat report, and the message is blunt: AI is making attacks faster, and the time you have to patch is shrinking.
ASD says the incidents it responded to jumped 20% last financial year, and its director-general expects more disruption to everyday services as AI tools improve. As ABC News reported, ASD also pulled the plug on an Amadey malware network controlling around 180,000 computers, and destroyed 5 terabytes of stolen data, including about 4.8 million files belonging to Australians. Its advice: fix known flaws quickly, replace vulnerable legacy systems, and learn to use AI defensively.
Who's affected
Everyone with something online. Attackers using automation don't care about your headcount, they scan for unpatched systems and exposed logins. We saw it just last week with the PHP flaws, and with Qilin hitting a Bathurst club.
What to do this week
- List your internet-facing kit. Firewalls, VPNs, remote access, websites and anything with a public login.
- Patch those first. Turn on auto-updates where you can, and check the rest by hand.
- Retire what can't be patched. Unsupported systems need a replacement date, not a reminder.
- Check MFA is on for every remote and admin login.
Not sure what's exposed? All IT's managed IT support team can map it and patch it for you.
Frequently Asked Questions
What is the ASD annual cyber threat report?
It is the Australian Signals Directorate's yearly summary of the cyber incidents it responded to and the threats it sees against Australia. This year's edition reports a 20% rise in incidents and a strong warning about AI-assisted attacks.
Does this really apply to a small business?
Yes. Attackers using automation don't pick targets by size. They scan for unpatched systems and exposed logins, and a small business with a neglected firewall or website looks the same as a big one. The cost of a breach hits a small team harder.
What should we patch first?
Anything reachable from the internet: firewalls, VPNs, remote access tools, web servers and websites. Patch those within days. Laptops and internal servers can stay on your normal monthly cycle.
What if a system is too old to patch?
Then it needs a replacement plan, not a reminder. ASD specifically urges replacing vulnerable legacy systems. In the meantime, take it off the internet and restrict who can reach it.
Want to Know What's Exposed on Your Network?
We'll find your internet-facing systems, patch the risky ones and keep them current, so AI-speed attacks hit a closed door.
Related Guide
Cybersecurity for Sydney SMBs
Explore our complete guide to protecting your business from cyber threats.
Read the Full Guide →