Almost a quarter of incidents were found from outside
Of the cyber security incidents ASD responded to last year, 362 were identified after ASD told the organisation. What that says about who tests your posture, and when.
The Australian Signals Directorate published its Annual Cyber Threat Report 2025–26 this month. Most of it is about threats. One figure in it is about something else: who found out first.
The numbers
In the 2025–26 financial year, ASD’s Australian Cyber Security Centre responded to 1,524 cyber security incidents. Of those, 362 were identified after ASD notified the organisation of potential malicious activity on its network. That is almost a quarter.
The notifications were not rare. ASD notified organisations more than 4,400 times over the year, almost 80% more than the year before. More than 2,200 of those were individual notifications. The rest went out collectively, to more than 2,100 organisations.
One collective notification shows the same pattern at a smaller scale. In May 2026 ASD wrote to 340 organisations about vulnerabilities in cPanel, a widely used web hosting control panel. More than 60 confirmed incidents followed.
What the figure does not say
It does not say these organisations were careless, or that their own monitoring had failed. More than half of ASD’s individual notifications came from declassified intelligence. That is where the warning came from. It does not show whether an organisation’s own monitoring could have found the same activity, and the report does not say.
It does not say what each organisation believed about its own security before the notification arrived. The report does not record that, and we do not know it.
What it does say is narrower. For almost one incident in four, the organisation first learned of it from someone else.
Who tests your posture, and when
Every organisation keeps an account of its own security: a statement of applicability, a risk register, a maturity score, a dashboard. The organisation writes that account, about itself, at a time it chooses.
The test of the account usually comes at a time it does not choose, from someone it did not appoint. Sometimes that is an auditor. For 362 incidents ASD responded to last year, it was a notification from ASD.
When that happens, the question that follows is not whether the account was written in good faith. It is what the account rested on, and whether that was still true on the day. A posture that records its evidence and the date it stops holding can answer that question. A posture that records only a conclusion cannot, however honestly it was written. That is the case for putting an expiry date on every claim.
What to do with it
Two things, neither of which needs a tool.
First, if ASD contacts you about potential malicious activity, respond. The report asks for this directly, and gives a way to check that a call is genuine: ring 1300 CYBER1 (1300 292 371) and quote the incident or reference number.
Second, ask of your own posture the question an outside notification would ask. Which of these claims would still hold if someone checked today, and what would we show them? Start with the claims you cannot answer for.
What Frank does, and does not do
Frank does not detect intrusions, and it would not have found any of these incidents. It is not a monitoring tool. It reads the account an organisation keeps of itself, such as its statement of applicability and its registers, and shows where that account rests on nothing observable, contradicts itself, or has outlived its evidence. It gives no credit for a claim with nothing behind it.
You can see what your own account rests on. Start by seeing where you stand. It reads the documents you already have and shows you which claims have evidence behind them, and which do not.