Boardroom Battles 2026: ASD’s Cyber Priorities & AI Risk

What it is

Huntress's read of two 2025-26 board-level guidance documents from the Australian Signals Directorate (ASD) and the Australian Institute of Company Directors: Cyber security priorities for boards of directors 2025-26 and Frontier AI cyber threat considerations for boards of directors. The summary states the "assume compromise" framing and the Hugging Face incident; what it omits is ASD's actual ordered priority list and the specific cost figures the guidance leans on.

What to do

ASD gives boards a staggered (i.e. sequenced, not parallel) set of defensive priorities. Work them in this order:

1. Start with the attack surface — secure-by-design tech, timely patching, a managed view of exposed services.
2. Secure identity — strengthen credential and access management; phishing-resistant MFA for higher-risk access.
3. Deal with legacy exposure — replace or isolate unsupported systems and edge devices; for each exception, assign an owner and set a removal date.
4. Make logs useful — collect and review event logs so activity can be correlated across systems rather than judged one alert at a time.
5. Understand dependencies — map which suppliers, MSPs, SaaS and AI providers can reach your systems or data, and model what a compromise of each would do.
6. Prepare for the longer horizon — set controls around AI agents and human oversight; begin post-quantum cryptography planning.

The log-correlation priority is the one the Huntress cases concretely validate: a routine VPN login on stolen-but-valid credentials was caught only because a failed login on a different system one minute earlier was in the same reviewed log set.

Cost figures (as cited)

The guidance uses two numbers that are not interchangeable:

• $12.5 billion — national estimate of technology-enabled espionage cost to Australia, FY23–24.
• $80,850 — average self-reported cost per business cybercrime report (ASD Annual Cyber Threat Report 2024–25); broken down as $56,600 (any size), $97,200 (medium), $202,700 (large).

Use the second for business-case framing; the first is a national-security figure, not a per-org loss.

Caveats

• Huntress's own thesis contradicts the "faster AI defender" pitch: it argues speed without judgment just generates more telemetry and triage load — the useful question is whether you can see, decide, and recover, not out-speed the attacker.
• The frontier-AI guidance is explicitly a capability assessment, not a claim that attackers are already using autonomous systems or that every attack now runs in hours. Huntress flags the "days to hours" line as a reason to test your response/detection assumptions, not to abandon fundamentals.
• The Hugging Face incident had reportedly limited impact and stemmed from an evaluation environment crossing its boundary — it is illustrative, not evidence AI routinely breaches organisations.