AI-enabled cyber threats: what changes for defenders?

AI-enabled cyber threats increase the urgency of dealing with weaknesses that organisations already understand: exposed services, unpatched systems, excessive privilege and controls whose effectiveness is uncertain. The immediate defensive question is which of those weaknesses could provide a credible route to important systems or information.

AI can change the effort required to discover and combine weaknesses. That does not make established defences obsolete. It makes the time spent identifying, treating and verifying material exposure more consequential. A new security programme or product is not automatically the first response.

Read the threat evidence with its qualifications

In its 8 May 2026 frontier AI update, ASD described increasingly capable models and the potential to connect cyber tasks into more complex activity. The demonstrated capabilities included simulations without active defenders. That is significant capability evidence, but it is not proof that every organisation is experiencing fully autonomous attacks.

ASD's 25 September 2026 misalignment alert described agents taking unexpected, unauthorised actions while attempting to complete assigned work. ASD also stated that there was no indication that the activity represented a broader threat or malicious actors targeting Australia. The appropriate response is to examine the defensive implications without turning a qualified observation into an unsupported claim about attack prevalence.

Start with the exposure already present

A vulnerability backlog becomes more useful when it is connected to the environment in which those weaknesses exist. An internet-facing service, an unsupported system and an overprivileged account may each require attention for different reasons. The decision depends on what is reachable, what could be affected and which controls interrupt that route.

Start with a small number of defensible questions. Which externally reachable systems matter most? Who owns their treatment? What could a compromised account reach? Which legacy systems may compromise modern ones? Which overdue actions depend on a maintenance window, supplier or business decision? Where visibility is incomplete, make that uncertainty explicit instead of treating the absence of findings as reassurance.

A useful outcome is an owned treatment decision: remediate, reduce access, isolate, remove an unnecessary service or apply a justified interim measure. A longer list of findings, by itself, does not reduce exposure.

Include the identities used by AI services

Organisations using AI also need to secure that access. ASD's 29 September 2026 advice identifies compromised keys, tokens, sessions and third-party arrangements as routes to unauthorised use. It recommends clear ownership of AI accounts and credentials, limited privileges and monitoring of access and permission changes.

The practical question extends beyond whether someone can use a model. Can that identity administer the account, create credentials, retrieve organisational files or invoke connected tools? These permissions have different consequences and should not be treated as interchangeable. Include AI service identities in the existing access-management conversation rather than assuming the model provider controls every relevant risk.

Validate the controls that limit an incident

Prevention remains important, alongside the ability to constrain and respond to a compromise. Review whether least privilege, segmentation, monitoring and response arrangements work together in the systems that matter. A control named in a plan is a starting point for that discussion; current evidence establishes what it is doing.

After a treatment, verify the intended change. If access was restricted, confirm the restriction. If a response dependency changed, exercise the relevant procedure. Keep formal assessments and documented decisions, while checking the assumptions that could change between those assessment points.

Strategic Cyber's position is that exposure, treatment and assurance should be connected. This is a practical risk-management approach, not a claim that government guidance endorses a particular delivery model. Mandatory security, assurance and authorisation requirements continue to apply.

Talk to Strategic Cyber about connecting your current technical exposure with cyber risk priorities and assurance through our Cyber Risk Advisory service.

Further reading

ASD — Frontier AI models and their impact on cyber security update, updated 8 May 2026

ASD — Risks of AI misalignment to Australian organisations, 25 September 2026

ASD — Protect your organisation's AI services, 29 September 2026