A cyber security landscape in significant flux

Background

For almost a decade, the Essential Eight has provided Australian organisations with a simplified baseline for improving cyber security. Its eight mitigation strategies cover areas including application control, patching, multi-factor authentication, restricting administrative privileges and regular backups. Organisations could assess implementation against a maturity model ranging from Maturity Level Zero to Maturity Level Three.

It has been common for management to report to the board on an organisation’s maturity level measured by the Essential Eight. It has also been a framework by which external experts assess the cyber resilience of an organisation. Because of this, meeting a certain maturity level has often become a requirement to participate in government contracting or tender processes. 

However, feedback to the AICD indicated that the Essential Eight did not translate well across different technology environments (such as cloud environments) and was not suited to changing threats and technologies. 

The new framework  

The Essentials aim to provide organisations with a consistent and prioritised approach to cyber security across different technology environments. Instead of a single framework applied uniformly across different technologies, the Essentials are organised into environment-specific chapters that use the same underlying model while accounting for different threats, risks and operational considerations.  

The initial framework comprises three chapters: Essentials for enterprise IT, which evolves the existing Essential Eight; Essentials for operational technology, aimed at protecting operational technology environments; and Essentials for cloud, for environments delivered entirely through software-as-a-service and platform-as-a-service. 

What has changed? 

Board and executive accountability 

The ASD has published an Essentials overview for senior executives. Despite the title, the publication has implications for directors. It highlights how the Essentials place greater emphasis on formal executive and board-level accountability for cyber security, including oversight of organisational risk, investment and resourcing.  

Rather than treating implementation as solely a technical compliance task, the Essentials prompt a board to consider whether current governance arrangements give directors sufficient visibility of cyber risk. This extends to whether management can demonstrate the effectiveness of the organisation’s most important cyber controls.  

Over time, the Essentials should support more risk-focused conversations in the boardroom. A single maturity score under the Essential Eight can be easy to communicate but may conceal important differences between the protection of critical and less critical systems. The new approach should allow boards to interrogate where material exposures lie. 

Outcomes focus 

The Essentials also signify a shift from prescribed controls towards security outcomes, with organisations having greater flexibility to determine how they achieve the required outcomes. While the ASD continues to provide specific examples of appropriate measures, the framework is less centred on implementing the same technical controls across all organisations. 

This potentially makes implementation more adaptable to organisations with different technology environments, resourcing and risk profiles.  

Priority phases 

The Essentials includes priority phases, which set out the order in which the ASD recommends each domain be addressed. This is intended to help organisations sequence technical implementation in a risk-informed manner rather than attempting to uplift the entire environment at once. 

The framework prioritises identifying services and internet-facing edge devices ahead of business systems and staff laptops, reflecting the risks associated with systems that can provide pathways into organisational networks. This reinforces the importance of understanding an organisation’s critical assets and functions. 

Implementation

There will be a transition period rather than an immediate switch from the Essential Eight to the ASD Essentials. The ASD says organisations should continue to comply with their existing regulatory requirements until relevant regulators communicate any changes.

It is worth noting that existing controls and capabilities pursued under the Essential Eight will contribute to compliance with the Essentials framework.

The Essentials overview for senior executives provides a list of questions that the ASD recommends when considering a proposal to implement the ASD Essentials. These questions may also assist some directors who have a heightened focus on cyber resilience, for example by virtue of sitting on a risk committee. These questions include:

• Where does the plan depart from the ASD’s recommended sequencing, and what is the documented, risk-based justification?
• What are the anticipated disruptions to operations and user experience during implementation, and how will they be managed?

ASD releases Cyber Threat Report 2025-26 

On 26 October 2026, the ASD published its 2025-26 Cyber Threat Report (Report), which provides an update on the cyber threats Australia is facing, and what individuals, industry and government can do to strengthen their cyber resilience. 

The ASD highlights that during the 2025-26 financial year, it responded to more than 1,500 cyber security incidents and provided over 4,400 notifications to Australian entities about potentially malicious cyber activity, representing almost an 80% increase on last year. In the past year, state-sponsored cyber actors continued to target Australian organisations primarily to gain access to sensitive or non-public information. These attacks extended beyond government networks, and included critical infrastructure entities, private businesses and individuals. 

The Report states that FY2025-26 “demonstrated that the cyber threat environment continues to be shaped by compromises from well known weaknesses such as unpatched systems and social engineering.” Compromised accounts and credentials were one of the most frequently reported incident categories across government, industry and critical industry sectors, reflecting the value malicious actors place on legitimate access to networks and systems.  

In light of this, the Report highlights the importance of basic cyber security practices such as reviewing privacy settings and enabling passwordless authentication such as multi-factor authentication or passkeys. 

Based on the Report, a key emerging issue for boards is the impact of artificial intelligence (AI) on both sides of the cyber risk equation. The ASD warns that malicious actors are using AI to increase the scale, speed and sophistication of cyber-attacks, scams and phishing, making malicious activity more efficient and convincing. At the same time, AI can strengthen organisational defences by improving threat detection, vulnerability management, incident response and the analysis of large volumes of security information.