Australia's Cyber Chief: Legacy Tech Is the AI Attack Surface

On Monday, at ASPI's Sydney Dialogue AI Masterclass in Canberra, the head of Australia's Signals Directorate delivered a sentence Australian business owners should read twice. "We are sitting on, in Australia, an enormous legacy technology debt," Abigail Bradshaw said, as reported by ABC News on 15 September 2026.

Her framing was binary. "AI will either do one or the other — it'll be a catalyst for decisions about replacing legacy technology; or, if we don't move fast enough, almost certainly the legacy technology will be the first to be compromised in a major AI-enabled attack." She was speaking to policymakers about state-scale risk. She was also, whether she meant to or not, describing the average Australian SME's tech stack. Bradshaw's second call — for a formal AI "early warning system" of the sort Australia already has in a cyber context — sits on top of that. The government does not yet know how many AI agents are operating on the internet at any moment. Neither does anyone else.

The word "legacy" sounds like a mainframe problem. It isn't. Legacy is the accounting software that stopped getting security patches two versions back. The CRM you can't migrate off because the export function was never finished. The on-premises PBX still in the cupboard because the port took a fortnight and nobody wanted the outage. The Windows 10 machine on reception. Each one is a public-facing service running yesterday's assumptions about what an attacker could reach at scale.

The OECD's 2026 D4SME survey found 46 per cent of SMEs have no meaningful digital security — while 61 per cent are already using AI tools that touch their business data. Bradshaw's binary lands on that group first. The ASD's own numbers, from its Annual Cyber Threat Report 2024–25, sharpen the picture: the average self-reported cybercrime cost per small-business report is now $56,600 — up 14 per cent year on year — and the agency logs one cybercrime report every six minutes. Those numbers predate AI-augmented attackers running phishing generation, credential stuffing and vulnerability scans at machine speed against exactly the unpatched software Bradshaw named.

Want to know what this means for your business? We'll map it in one call.

The other half of Bradshaw's message got quieter coverage. She wants Australian organisations to use AI defensively too, and she was blunt about how well it works inside her own agency: "What would have taken cybersecurity experts in ASD weeks and weeks of work has been done in hours." ASD is running specialist tools — Bradshaw named Anthropic's Mythos and OpenAI's cyber variants. Your business is not. But the commercial versions of those capabilities are now inside every serious business platform you would migrate to — modern accounting, modern field service, modern email — as anomaly detection, phishing filters and automatic patching. That is the compound benefit hiding in her speech.

It also changes the calculus. Every legacy retirement you complete this quarter kills an attack surface and swaps it for an AI-defended one. The cheapest AI adoption most SMEs can make is often the one that also unloads a decade-old exposure. Framed that way, replacing the on-prem accounting install with a supported cloud version is not a discretionary upgrade — it is the security move Bradshaw is asking for. If you'd like to see where the exposures live in your own business, and where AI would earn you more than it costs, check your business's AI exposure.

Bradshaw made the specific ask herself: "set some legacy technology reduction targets and move towards those." For an SME, that is five moves, in order. First, run the free Cyber Health Check at cyber.gov.au — anonymous, roughly 15 minutes, produces a tailored action plan. Second, inventory the stack and list anything past end-of-support or more than two versions behind. Third, prioritise whatever holds customer data, financial records or supplier payment details — those are where the $56,600 average comes from. Fourth, turn on the AI-native security features in the platforms that already offer them; they are usually a checkbox, not a purchase. Fifth, when the next piece of software comes up for renewal, treat built-in security AI as a specification, not a nice-to-have. The businesses that come out of the next 18 months intact will be the ones that stopped budgeting for legacy software's last renewal.

Key takeaways

Common questions

Related notes

Which piece of your stack would Bradshaw call "legacy"?

Every SME has one — the accounting install nobody wants to migrate, the CRM two versions behind, the phone system still on-premises. The businesses that come out of the next 18 months in one piece are the ones that stopped renewing that software and replaced it with a modern, AI-defended equivalent. A short conversation is enough to work out which one to move first. Book a call.