Doorstop, Parliament House

SUBJECTS: Annual Cyber Threat Report for 2025-26; MP Security

RICHARD MARLES, DEPUTY PRIME MINISTER: So in the last financial year we've seen ASD respond to 1,500 incidents. That represents an increase of 20% on the year before, which is a significant jump. And what we're seeing here is AI being used by malicious actors to find vulnerabilities in companies, organisations, IT systems. And this is a real challenge. So what we're asking of companies and organisations is to firstly look at their old systems. If you've got an old system which is connected to the internet, it is a gateway for a malicious actor. Secondly, it's really important that people are taking the time to harden their systems. And if that means that you've got to bring your system down for a couple of days, then do it and make sure you've got those processes and hardening in place. Thirdly, it's really important that organisations are using AI themselves. There are a number of AI products out there. You can go to cyber.gov.au which gives a whole lot of advice about how to use them. But it is a very important tool in terms of defending yourself in this current environment.

JOURNALIST: Minister, asking companies to upgrade their systems, no doubt, is a huge cost burden on them. Is the government open to the idea of providing support, particularly if you're encouraging them to take their systems down for a few days as well?

MARLES: Well, it's focusing on making sure that really old systems are not connected to the internet. I mean, people should be updating their systems as we do in a whole range of the ways in which we go about our life, and cyber health and cyber hygiene is no different. But if you're operating a really old system, that is a gateway for a malicious actor and it is really important that companies are taking the time to harden their systems. And sometimes that does mean that you need to take the system down for a couple of days to do that work. That's what is critically important here, so that your system can be as protected as possible.

JOURNALIST: You ask people to go look online at the options available in terms of upgrading their systems, (inaudible) company. How can you convince people that using the software that they're meant to be sort of hesitant about – AI, for example – is the best way to protect them from something like that?

MARLES: AI is here and it's real. People need to engage. There's no turning the clock back in relation to that. Malicious actors are using AI to find vulnerabilities in systems. That's really what this report is showing. But AI can be a tool to defend yourself as well. There are AI products out there and there's a lot of information on cyber.gov.au, which the ASD provides, which can help people to use this same tool to protect themselves, and that's really important in this day and age that that's what people are doing.

JOURNALIST: Are you satisfied that government computers and technology is match fit up against this threat of AI?

MARLES: Yeah look, actually, in terms of the last year there's a good story there. When we're talking about government systems and larger companies which regularly engage with ASD, for example, the average cost of a cyber incident has gone down by about 27%. And I think what that says is that when that focus is there, when you are able to harden your system, certainly getting that advice from ASD, you can protect yourself in this world. And we are seeing that across government systems, and we're seeing that in respect of large companies as well. But it's really in those medium companies where the damage is being done. There, what the report says is that the average cost of an incident has gone up by 45%. I think what that says is that this is really the sector that we need to be getting to in terms of those messages around hardening your systems.

JOURNALIST: Can I just ask one more. The Department of Finance last night revealed that an extra nine electorate offices will be in line for security upgrades. Is the government looking at ways to maybe overhaul and create a new base standard in terms of security for electorate offices, particularly in the wake of what happened to Helen Haines?

MARLES: Well look, we take advice from our security agencies around what is required in terms of providing for the security of MPs, and we listen to that advice and we act. Obviously what occurred last week is just an appalling event and all of our thoughts are with Helen Haines, and it certainly has put a focus on the safety of members of Parliament. We do have among the best security agencies in the world. They are giving us advice in relation to this and we'll act on that advice. 

JOURNALIST: The nine electorate offices that have been flagged for an upgrade, is there scope for that to be broadened out? And do you know why it was those nine in particular?

MARLES: Look, I'm not aware of specific advice in relation to those electorate offices, but what I do know is that our security agencies are constantly monitoring all MPs and on a, you know, individual basis. That advice is then taken up in terms of the security that is provided and I think that's what's happened here.

ENDS