Australia’s evolving cyber threat landscape: What it means for superannuation
The Australian Signals Directorate’s latest Annual Cyber Threat Report highlights a rapidly evolving cyber threat environment, reinforcing the importance of collaboration, preparedness and resilience across Australia’s superannuation ecosystem.
The Australian Signals Directorate’s (ASD) Annual Cyber Threat Report 2025–26 provides a timely reminder of the growing sophistication and scale of cyber threats facing Australian organisations.
During 2025–26, ASD’s Australian Cyber Security Centre (ACSC) responded to more than 1,500 cyber security incidents, a 20% increase on the previous year. Financial and Insurance Services accounted for 30% of critical infrastructure incidents responded to by ASD’s ACSC, the largest share of any industry division.
For the superannuation sector, these findings highlight an important reality: cyber resilience extends beyond the security of individual organisations. It depends on the strength of the interconnected systems, services and relationships that support the movement of superannuation transactions.
The cyber threat landscape in numbers
1,500+ cyber incidents
Responded to by ASD’s ACSC during 2025–26, up 20% year-on-year.
30% of critical infrastructure incidents
Responded to by ASD’s ACSC involved Financial and Insurance Services.
39% involved phishing
Phishing was the most prevalent initial access technique in ASD’s analysed incidents.
66% increase in data breach incidents
Compared with the previous reporting period.
Source: ASD’s ACSC, Annual Cyber Threat Report 2025–26. Figures relate to different incident populations and are not sector-wide incident rates.
Five key findings for the superannuation sector
- AI is accelerating the cyber threat environment
Artificial intelligence is changing both the speed and sophistication of cyber-attacks.
The report highlights how malicious actors are using AI to identify vulnerabilities, automate attacks and create increasingly convincing phishing and social engineering communications.
ASD also notes that vulnerabilities that may previously have taken weeks to exploit can now be exploited within days or even hours.
What this means for superannuation: Organisations must be equipped to identify, assess and respond to emerging threats quickly. Timely patching, proactive monitoring and effective information sharing are increasingly important across interconnected systems. GNGB has proposed changes to the STN Information Security Requirements (ISR) to enable a more agile, risk based approach to vulnerability patching which we are seeking feedback on.
- Identity and access remain critical vulnerabilities
Phishing continues to be a leading entry point for cyber-attacks, accounting for 39% of initial access techniques in ASD’s incident analysis. The use of valid accounts also featured in 15% of analysed incidents.
These findings reinforce the importance of protecting identities, credentials and access to sensitive systems.
What this means for superannuation: Accelerate the adoption of phishing-resistant MFA for privileged users, ensuring account recovery and reset processes are protected. Strong authentication and identity verification are essential where authorised users can access STN data including member information, payment details or initiate transactions. Maintaining trust in the identities and permissions used across the Superannuation Transaction Network (STN) is fundamental to its security.
- Supply chain security is a shared responsibility
Cyber risks do not stop at organisational boundaries.
The report highlights the potential impact of compromised suppliers, software repositories and third-party technology providers, where a single vulnerability can affect multiple downstream organisations.
For the superannuation sector, which relies on a complex network of funds, gateways, administrators, clearing houses and technology providers, these dependencies create shared risks.
What this means for superannuation: Understanding third-party dependencies, assessing supplier security and identifying potential concentration risks are essential to maintaining resilience across the broader ecosystem.
- Coordinated incident response is essential
One of the report’s strongest messages is the importance of collaboration when responding to significant cyber incidents.
ASD highlights coordinated response arrangements within the financial sector, as well as Exercise Cyber Arrow, which brought together more than 175 organisations and government entities to strengthen collective preparedness.
These examples reinforce the value of shared intelligence, clear responsibilities and coordinated decision-making.
What this means for superannuation: A significant incident affecting shared infrastructure or interconnected services requires more than an individual organisational response.
This is a key focus of GNGB’s Operation Honey Bee exercises, which bring industry participants together to test response capabilities, identify dependencies and strengthen coordinated incident management across the STN.
- Preparing for the post-quantum transition
The report also reinforces the need for organisations to begin preparing for the transition to post-quantum cryptography.
ASD recommends that organisations cease using traditional asymmetric cryptography and transition to post-quantum cryptography by the end of 2030, or sooner.
While this may appear to be a longer-term challenge, identifying cryptographic dependencies and planning transition activities takes time, particularly across interconnected systems.
What this means for superannuation: The sector will need to consider not only the security of individual systems but also how to maintain interoperability, trusted communications and secure data exchange throughout the transition. The STN PQC Roadmap initiative is being designed to provide a pathway for STN participants.
Beyond prevention: Protecting transaction integrity and supporting recovery
Another important theme emerging from the report is the need to plan for cyber incidents, not simply attempt to prevent them.
ASD advocates an assumed breach approach, recognising that organisations must be prepared to detect, contain, investigate and recover from incidents.
The report highlights the importance of comprehensive event logging and maintaining reliable evidence to understand the extent and impact of an incident.
For the STN, this has particular significance. In the event of a cyber incident, the ability to identify affected transactions, establish what has occurred and support accurate reconciliation is critical.
Restoring system availability is only part of the recovery process. Maintaining confidence in the integrity of transactions is equally important.
Building resilience through collective action
The findings of ASD’s Annual Cyber Threat Report reinforce a consistent message: effective cyber resilience requires both strong individual organisational controls and a coordinated, ecosystem-wide approach.
For Australia’s superannuation sector, this means understanding shared dependencies, strengthening identity and access controls, preparing for emerging technologies and ensuring incident response arrangements are regularly tested.
Through initiatives such as Operation Honey Bee, industry collaboration and ongoing engagement with STN participants, GNGB continues to support a more connected and resilient superannuation transaction ecosystem.
As the cyber threat landscape evolves, maintaining trust in Australia’s superannuation system will depend not only on how individual organisations prepare and respond, but on how effectively the industry works together.
Source: Australian Signals Directorate, Australian Cyber Security Centre, Annual Cyber Threat Report 2025–26.