The Australian Information Security Association (AISA) has warned companies against investing heavily in artificial intelligence-powered cybersecurity tools while neglecting basic security measures. The warning follows a sharp increase in cyber incidents, with organisations continuing to face risks from unpatched software, exposed systems and weak security controls.
Why Is AISA Warning Companies?How Serious Are Cyber Threats?Can AI Improve Cybersecurity?What Problems Do Security Teams Face?What Should Businesses Prioritise?When Should Cybersecurity Planning Begin?
Why Is AISA Warning Companies?
AISA has urged organisations to address existing security weaknesses before spending substantial amounts on advanced AI-based defence systems. The association said many businesses still struggle with outdated software, unnecessary internet exposure and poor visibility over their IT infrastructure.
Dr Rajiv Shah, an AISA spokesperson, said cybersecurity success should be measured by the reduction in actual risks rather than the adoption of the latest AI technologies.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
He cautioned that sophisticated security products offer limited protection when organisations leave known vulnerabilities unresolved.
How Serious Are Cyber Threats?
The warning follows the Australian Signals Directorate’s annual cyber threat report, which recorded a significant increase in malicious cyber activity.
Australia’s Cyber Security Centre responded to more than 1,500 cybersecurity incidents during 2025-26, representing an increase of over 20% compared with the previous year. Notifications to organisations concerning potentially malicious cyber activity also rose by almost 80%.
Australians reported cybercrime approximately every six minutes, reflecting the continuing pressure on individuals, businesses and security agencies.
Can AI Improve Cybersecurity?
AISA acknowledged that artificial intelligence has an increasingly important role in detecting threats and defending digital infrastructure.
AI-powered technologies can strengthen security operations as cybercriminals increasingly use automation to launch faster and more sophisticated attacks. However, the association cautioned that AI security products serve different purposes and may not suit every organisation.
Businesses must first understand their existing technology, identify vulnerabilities and determine which systems genuinely require internet connectivity.
AI adoption should follow a clear assessment of security requirements rather than becoming an automatic response to emerging cyber threats.
What Problems Do Security Teams Face?
AISA also raised concerns about growing pressure on cybersecurity professionals responsible for protecting organisational systems.
As attacks become faster and more complex, security teams face increasing demands to investigate incidents, detect threats and maintain existing defence mechanisms.
The association urged company boards and senior executives to ensure that cybersecurity departments receive sufficient staffing, training and operational support.
It also emphasised realistic workloads, professional development and employee wellbeing. Introducing additional AI tools without adequate re teams
What Should Businesses Prioritise?
AISA recommended that organisations focus on established cybersecurity practices, including maintaining accurate asset inventories, applying security patches promptly and strengthening access controls.
Businesses should also review unnecessary internet connections and ensure that existing security arrangements remain effective. Senior management must examine whether security teams have sufficient re new technologies
The association stressed that AI should support measurable improvements in cybersecurity rather than serve as a replacement for essential protective measures.
When Should Cybersecurity Planning Begin?
AISA said cybersecurity requirements should be considered during technology design and procurement, rather than after new systems have already been installed.
Companies frequently underestimate the long-term costs of maintaining infrastructure, updating software and managing emerging vulnerabilities.
Security responsibilities must therefore be incorporated into budgets, purchasing decisions and operational planning from the beginning.
The association also called for clearer expectations from technology vendors regarding ongoing security support. The warning reinforces the need for organisations to strengthen existing safeguards before expanding their reliance on AI-powered cybersecurity products.
