Every October the Australian Signals Directorate publishes its Annual Cyber Threat Report, and every year the numbers get worse. This year the message changed as well.

ASD Director-General Abigail Bradshaw used the launch of the 2025-26 report to name legacy technology, meaning outdated hardware and software that can no longer be patched, as one of Australia’s “most persistent” cyber security vulnerabilities. “Australia must accelerate the modernisation of its technology and cybersecurity foundations to protect the systems we rely on every day,” she said.

A month earlier, speaking at the Sydney Dialogue, she was blunter: “We are sitting on, in Australia, an enormous legacy technology debt.” And then the line that deserves to be read aloud at every board meeting this quarter: “If we don’t move fast enough, almost certainly the legacy technology will be the first to be compromised in a major AI-enabled attack.”

For as long as I have been advising boards, I have made the case that technical debt is a business problem rather than an IT one. What has changed is the interest rate.

AI has changed the economics of attack

The report is direct about why. Frontier AI models have “changed the game with speed and opportunity”, allowing state-sponsored actors and criminals to “identify vulnerabilities, develop exploits and launch attacks at greater scale than ever before”. ASD’s notifications to organisations about potentially malicious activity rose 80 per cent on the previous year. Its incident response team handled 20 per cent more incidents. A report now lands with ASD about once every six minutes.

Finding and exploiting weaknesses in old, unpatched systems used to take skilled people and time. It now takes compute. Attackers no longer need to choose their targets carefully. They can scan everything and go after whatever gives way first, which, as Bradshaw says, will be the legacy technology.

That is the equation boards need to understand. The more complex your IT environment, the more legacy systems that hang around, and the more compromises that have been made with your technical governance along the way, the higher your risk of a catastrophic cyber breach. Each of those factors used to be a cost and an inconvenience. Each is now an attack surface being probed by adversaries that do not sleep and do not get bored.

Technical debt has become a critical security problem

Most organisations I meet know they carry technical debt. Fewer have a formal plan for it. Fewer still have a deliberate strategy for how their technology function should develop and be managed over the next three to five years, as distinct from a list of projects and a renewal calendar.

That gap has always had a cost. Organisations without a plan fall behind in the race for business efficiency, carry more cost than they need to, and find that every new initiative takes longer than it should because it has to be bolted onto something old. What is different now is that the same organisations are also rolling the dice on a growing cyber risk and a declining security posture, and the dice are increasingly loaded against them.

ASD states the principle directly: “The less legacy technology exposed to the internet, the fewer opportunities malicious actors have to gain access.” Bradshaw went a step further at the Sydney Dialogue, suggesting that the most powerful thing organisations can do is “set some legacy technology reduction targets” and move towards them. That is a strategy statement, not a security control. It assumes you know what you have, why you have it, and what it would take to be rid of it.

The mid-market blind spot

Here is the part of the report that should worry mid-sized Australian organisations most. Medium-sized businesses were hit hardest in 2025-26, with the average cost per cyber incident up 45 per cent year on year to $141,300. The equivalent figure for large businesses fell.

That is not a coincidence. Large enterprises have the scale to employ architects, strategists and security leaders, and they are well served by the big consulting firms, who understandably build their practices around the ASX 100. Mid-sized organisations have neither advantage. They cannot justify a full-time enterprise architect or a head of technology strategy, and the major advisory firms are rarely structured to serve them well.

So they do what is sensible in the circumstances. They ask the people already in the building: the managed service provider, the software vendor, the reseller. These are often capable, well-meaning people. But their advice carries a technology bias and a structural conflict of interest that no amount of good intent can remove. A vendor will rarely recommend you retire its own product. A service provider paid to manage complexity has little incentive to reduce it. Neither is accountable for the overall shape of your architecture five years from now.

The result is an environment that nobody designed. It accumulated. And accumulated environments are exactly the ones ASD is describing: complex, partly unsupported, and full of dependencies that nobody fully understands and nobody can safely remove.

Excellence by design, not by accident

This is the thinking behind Beyond Technology’s IT Excellence by Design methodology. It combines two things that are usually done separately or not at all: an independent review of the current architecture and operating model, and the deliberate development of a strategy for where the technology function needs to go.

The review matters because you cannot reduce what you have not mapped. It surfaces the unsupported systems, the single points of failure, the undocumented integrations and the quiet governance compromises that build up over years of reasonable short-term decisions. The strategy matters because the review alone changes nothing. It sets reduction targets for legacy and complexity (our guide to deciding what to fix, replace or retire covers how), sequences the work so that security and business value move together, and gives the board a defensible basis for the investment.

The aim is simple. Organisations should not sleepwalk into critical and unresolvable dependencies that leave them reliant on dangerous unsupported systems, or into architectures so complex they cannot be defended against adversaries now equipped with AI. Those outcomes are almost never chosen. They are the default when nobody is accountable for the design.

What mid-sized boards should do now

Bradshaw’s advice to the country applies just as well to a single organisation: accelerate modernisation, set legacy reduction targets, and prioritise security over the convenience of leaving things as they are. She has also said that “system security must be prioritised over system availability”, which is a hard conversation when the system in question runs the business. It is a conversation worth having before an adversary forces it.

For mid-sized Australian organisations, the practical answer is to work with a trusted independent advisor who has no product to sell and no managed service to protect. Start with a review of the current system architecture and operating model. Then build a deliberate strategy to continually improve IT capability while removing technical debt and unnecessary complexity from the environment, and hold the organisation to it.

The threat has changed. The cost of standing still has changed with it. What has not changed is that the organisations that come through this well will be the ones that decided, on purpose, what their technology should look like.

Greg Spencer is Managing Partner at Beyond Technology Consulting, an independent, vendor-agnostic technology advisory firm that has advised Australian boards and executives since 2006.

References

  • Australian Signals Directorate, Annual Cyber Threat Report 2025-26 (2026)