Go Back Up

University of Sydney Code Library Breach: Disclosed 18 Dec, 2025

Personal details of about 27,500 current and former staff exposed.

18 Dec 2025 - Syd Uni breached
Read more

Who Found It First? Detection Lessons From ASD's 2025-26 Threat Report

Blog Defence Threat Emulation 8 November 2026 8 min read

Warm gouache illustration of a dark-haired woman in a rust cardigan at quiet green security dashboards, with an ACSC call on her desk phone and an intruder among the server racks behind glass

Buried in the coverage of the latest threat report from the Australian Signals Directorate (ASD) was a story that should make every security manager a little uncomfortable. According to the Australian Broadcasting Corporation (ABC), ASD was tipped off to the sale of 5 terabytes of data stolen from a business that was unaware it had been hacked. ASD got in and destroyed the data before it could be sold. Good outcome. Awkward way to find out.

That business is not alone. The Annual Cyber Threat Report 2025-26 (ACTR), published by ASD's Australian Cyber Security Centre (ACSC) on 26 October 2026, says the ACSC responded to over 1,500 incidents last financial year, up more than 20%. Of those, 362 were identified following proactive ACSC notifications to the victim. In other words, hundreds of Australian organisations learned about an intruder because a government agency rang them, not because their own monitoring did.

So the question we keep coming back to after reading the report is a simple one. If an attacker was in your network today, who would find them first?

What the Report Actually Says

The ACTR is ASD's seventh, and it is a long read. The parts that matter for detection are spread across several chapters, so here they are in one place.

The ACSC issued over 4,400 notifications of suspicious activity, almost 80% more than the year before. More than 51% of individual notifications came from declassified intelligence. A single collective notification to 340 entities in May 2026 about cPanel vulnerabilities turned into more than 60 confirmed incidents. Extensive compromises rose from 26 to 40.

For critical infrastructure (CI), the ACSC responded to 154 incidents. The top initial access techniques were Phishing (36%) and Valid Accounts (16%). That second figure is the one we would circle in red. An adversary using a legitimate account does not trip the alarms that malware does. They log in, look around and behave like a slightly curious employee.

The report is also blunt about state actors. It describes state-sponsored actors seeking to pre-position on systems for later disruption, and it highlights the April 2026 advisory on China-nexus covert networks of compromised devices, where actors route their activity through hijacked small office and home routers. Those networks churn so quickly that static Internet Protocol (IP) address block lists struggle to keep up. Pre-positioning only works if nobody notices, which makes it a detection problem before it is anything else.

Then there is speed. The ACSC has observed that most vulnerability exploitation happens within two weeks, with some flaws exploited within 48 hours of a patch or advice being released, and it expects artificial intelligence (AI) driven tools to compress that window further over the next 12 months. Meanwhile, it also recorded successful exploitation of a vulnerability identified in 2008. Attackers are getting faster at the new stuff without giving up on the old stuff.

Why Notification Is Not a Detection Strategy

ASD's notification capability is genuinely impressive, and the growth in notifications reflects real investment. We are glad it exists. But it is a safety net, and nobody plans a trapeze act around the net.

A notification tells you that something is wrong. It rarely tells you how long the actor has been there, what they touched or whether they are still inside. Those answers only come from your own telemetry. When we are brought in to respond to an incident, the first hours are usually spent establishing what logs exist, how far back they go and whether anyone was watching them. Where the answers are good, the investigation is about the attacker. Where they are not, it becomes an archaeology project, and the honest finding is often "we cannot rule it out".

Two-panel warm gouache illustration: Our SIEM this quarter shows a relaxed woman beside zero-alert security information and event management dashboards; The phone call shows her startled by a ringing office phone displaying ACSC
A quiet dashboard is only good news if it would have seen the intruder.

The ACTR makes the same point with a far better example than ours. Case Study 6 describes a mid-2025 ransomware incident that disrupted building systems, including cameras, access control, lighting, lifts and more than 30 virtual servers. Because the organisation had comprehensive event logging in place, it could show how the actor got in, which systems were affected and what the actor did. Crucially, the logs showed that no data had been stolen. That is the difference between a bad week and a notifiable data breach, and it came down to logging decisions made long before the incident.

It is no accident that best practice event logging is one of the five Cyber Action Year priorities, or that the ACSC is urging organisations to adopt an "assumed breach" mindset. The report also advises large enterprises, CI operators and government to adopt comprehensive monitoring and logging. If you assume someone is already inside, the obvious next question is whether you would see them.

Getting to "We Found It First"

None of this needs a moonshot. Most of it is unglamorous work done well and then tested. ASD's Best practices for event logging and threat detection sets out four key factors, and it is a sensible baseline:

  • An enterprise-approved event logging policy
  • Centralised event log access and correlation
  • Secure storage and event log integrity
  • A detection strategy for relevant threats

Given what the ACTR says about how attackers are getting in, we would prioritise the following:

  • Identity first. With Valid Accounts so prominent in CI incidents, make sure sign-in, multi-factor authentication (MFA), privilege change and token activity from your identity provider and cloud tenants reaches your security information and event management (SIEM) platform, and that someone has written detections for unusual use of legitimate accounts.
  • Edge devices and virtual private networks (VPNs). Firewalls, VPN concentrators and other edge appliances are popular entry points and are often poorly logged. Forward their logs, keep them long enough to be useful and baseline normal remote access so covert network traffic stands out, as the April 2026 advisory recommends.
  • Retention that matches dwell time. If an actor has been pre-positioned for months, a few weeks of logs will not tell the story. Check retention against the investigations you might actually need to run.
  • The operational technology (OT) boundary. For CI operators, monitor the connections between corporate and operational networks. ASD's CI Fortify guidance asks operators to be able to isolate vital OT and enabling systems for three months, and you cannot isolate what you cannot see.
  • Coverage you can prove. Map your detections to MITRE Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) techniques that appear in the ACTR and be honest about the gaps.

That last point is where most programmes stall. A detection rule that has never fired against real attacker behaviour is a hypothesis. To turn hypotheses into evidence, we suggest:

  • Run adversary emulation or purple team exercises using the techniques the ACTR reports, such as phishing, valid account misuse and exploitation of public-facing applications.
  • Check every exercise step against what your security operations centre (SOC) actually saw, what alerted and how quickly someone responded.
  • Fix the gaps, then rerun the same steps to confirm the fix, rather than moving on to the next shiny scenario.
  • Repeat on a schedule, because logging pipelines quietly break, agents fall off hosts and new systems arrive without anyone telling the SOC.

The ACSC clearly sees value in this too. Exercise Cyber Arrow in October 2025 brought together over 175 CI and government organisations and used adversary-modelled Tactics, Techniques and Procedures (TTPs), and Horizon Power said it was able to "validate its detection and response capabilities" through the exercise. A national exercise once a year is a great start. Your own environment changes far more often than that.

It is also worth noting that ASD released the Essentials series in October 2026 as the evolution of the Essential Eight. Many organisations will spend the next year working through that transition. Prevention controls matter, but the ACTR's numbers are a reminder that some attackers will get through anyway, and visibility is what decides how that story ends.

Conclusion

The 2025-26 ACTR is full of numbers, but 362 is the one that stuck with us. Each of those incidents was real enough for ASD to respond to, and each was found because someone outside the organisation was looking. ASD will keep making those calls, and that is a good thing. The goal is to make sure that when the phone rings, your team can say "yes, we saw it, and here is what happened" rather than "can you tell us more?".

If you would like to know whether your logging and detection would catch the techniques in this year's report, Alchemy Security's continuous threat emulation and SIEM and logging services are a good place to start. And if the phone has already rung, talk to us.

Last updated: 9 November 2026

References

Ready to Transform your Business with Little Effort Using Brightlane?

Register Now