“An organisation that goes dark each time will lose more days to its own practices than to any hacker. Hitting the off button is not a long-term strategy,” say ALEX KOVACESKI & RICHARD CALVER. 

The cyber apocalypse will not arrive with a bang but a whimper. The makings are already here.

On the evening of October 21, the websites of the Bureau of Statistics, Treasury, Parliament House and cyber.gov.au (the government’s cyber advice site) went dark. Nobody had hacked them.

Two bugs had been found in PHP, the software behind about seven in 10 websites, after 14 years in the code. The presence of the bugs gave attackers an opportunity that they used.

The agencies could not fix their sites faster than hackers could exploit them, so the sites were simply switched off. That is what happens when three critical and connected shortages meet: people, time and money.

The first is people. Australia had 137,500 cyber security professionals in 2024. The Australian Computer Society says we need 54,000 more by the end of the decade. The wider technology workforce shrank in calendar 2025, to 967,000 and 58 per cent of Australian cyber teams report positions they cannot fill, and only a third are training other staff to step up.

The second is time. In 2025 a record 48,185 software bugs were logged with the CVE Program, the international register of known vulnerabilities. That is 132 a day, and this year there are more. Most of the newest have not yet been assessed for how dangerous they are. Attackers typically use a new bug within five days of its publication. The people meant to fix them are always behind.

The third is money. The Australian Signals Directorate’s (ASD) annual threat report, released recently, recorded more than 1500 incidents, up 20 per cent on the previous financial year, and 4400 warnings to organisations about malicious activity on their networks, up 80 per cent. The average cost of a cybercrime report for a business rose 16 per cent to $93,500. 

Last year’s report found the ACT had the highest average loss per cybercrime report in the country, about $37,700 (ASD Annual Cyber Threat Report 2024-25).

The ASD also recorded attackers successfully using a bug first identified in 2008. ASD director-general, Abigail Bradshaw, called legacy technology one of the nation’s most persistent weaknesses, and the federal defence and home affairs ministers asked organisations to put security ahead of keeping services running.

In plain terms: if you cannot fix it, turn it off. As an emergency measure that is right, and on October 21 it worked; nothing was breached.

As a normalised response it is ruinous. Of the 48,185 bugs logged last year, fewer than one in 50 was ever used in a real attack, yet every new critical one now arrives with the same advice: turn it off.

Britain had 32 government services out of action in the same week we are talking about and found no breach either. An organisation that goes dark each time will lose more days to its own practices than to any hacker. Hitting the off button is not a long-term strategy.

We suggest that two approaches work. The first is to have less to defend: fewer systems, fewer suppliers, fewer websites. The ASD’s advice points the same way: replace old technology, keep proper records of what happens on the particular network, and know your suppliers.

GovCMS, the one shared platform behind hundreds of Commonwealth websites, shows the return from these practices: the PHP fix was applied once and the sites came back at the same time. 

The second is to use AI aggressively. The same technology that found the PHP bug can untangle a 30-year-old system nobody understands, rebuild it on a modern platform and retire the original, in months rather than years. It can patch and check around the clock. Used this way, AI is how you end up with fewer things to switch off. Rather than create the apocalypse, AI can deliver us from it. 

Dr Alex Kovaceski is an AI strategist and Richard Calver an industrial relations lawyer.

News all day, every day at CityNewsQBN.com.au.