More Australian organisations have been targeted in the past financial year, according to the latest Cyber Threat Report from the Australian Signals Directorate.
The public sector recorded nearly half of the 1500 incidents reported to the Australian Cyber Security Centre, with one case classed as an extensive incident of the second-highest severity.
The number of incidents has risen 36 per cent in the past five years.
The centre had 82,000 reports made to it in the past financial year, or one every six minutes.
The directorate's director-general, Abigail Bradshaw, warned service outages would likely become the new normal, urging companies to prioritise security over access.
"They are creating enormous opportunities, but they are also enabling malicious cyber actors to identify vulnerabilities and to conduct attacks faster, at greater scale, and with greater precision than before," Ms Bradshaw said.
"This shift will only accelerate."
Legacy technologies - software which is no longer supported by vendors - have been labelled Australia's biggest cybersecurity weakness.
The directorate has warned all sectors of the Australian economy are at risk.
"Organisations must take action to improve basic cyber hygiene," Ms Bradshaw said, noting the public will need to get used to frequent network outages in response to attacks and updating software.
"System security must be prioritised over system availability in order to deal with increased vulnerability discovery by new AI models ... the prospect of compromise has increased."
How cyber attackers target Australian businesses and individuals largely hasn't changed, with scraping usernames and passwords and exploiting them remaining major tools of the trade.
But the speed at which online criminals are able to gather information and weaponise it has drastically increased with AI tools, particularly in exploiting vulnerabilities in software.
Medium-sized businesses have recorded a major increase in cybercrime losses as opposed to larger businesses, which the directorate understands is due to executive-level IT roles being outside the reach of smaller operators.
The centre said the cost of self-reported cyber crime on a medium-sized business was $141,300, up 45 per cent.
Australian authorities have been working with Five Eyes partner nations to constantly test emerging frontier models, including the Anthropic-owned Mythos 5 model renowned for finding and exploiting software vulnerabilities with exceptional speed.
The directorate is urging a closer relationship with frontier model operators to better respond and prepare for the impending wave of attacks using AI.
The annual update does not cover a series of recent high profile cybersecurity incidents, including the global PHP outage and the breach of an OpenAI agent into publicly available Australian government data.
The full impact of frontier AI model attacks is likely to come through the next update.
