Australia’s Critical Infrastructure Security Centre (CISC) released its 2026 Critical Infrastructure Annual Risk Review, identifying trusted insiders, cyber incidents, physical threats, supply chain vulnerabilities and natural hazards as key risks affecting the country’s critical infrastructure over the past 12 months. The fourth edition of the annual review, released during Critical Infrastructure Security Month 2026, examines threats and hazards facing essential services across energy, food, water, transport, communications, health, banking and finance, highlighting need for owners and operators to understand potential impacts of interconnected risks across these sectors.
The review aims to strengthen the resilience of Australia’s critical infrastructure by helping owners and operators develop better understanding of risk exposure, assess potential consequences and identify appropriate mitigations.
The CISC said its work will continue to promote a proportionate, risk-based security culture, raise awareness of risks and their interdependencies, and identify measures to reduce vulnerabilities across multiple hazard categories. The guidance is intended to support informed risk management decisions and strengthen the reliable delivery of essential services.
“Our critical infrastructure is under constant threat in a dynamic, diverse and degraded security environment. Rapid advances in artificial intelligence, automation, digital connectivity and other new technologies are improving how essential services are delivered, but they can also introduce or extend vulnerabilities that can lead to service disruption and potentially exploitation of Australians’ information,” Tony Burke, Australia’s Minister for Home Affairs, Minister for Immigration and Citizenship, and Minister for Cyber Security, wrote in the 2026 Critical Infrastructure Annual Risk Review. “While more Australian organisations are adopting AI systems and digital platforms to drive greater efficiency, innovation and productivity, it’s also important to understand how the risks they bring are interconnected. The Australian Government is working with technical experts and international partners to improve cybersecurity across the economy and strengthen the protection of key sectors, including energy, water, healthcare, transport and communications.”
Burke added that the Australian Government and the Department of Home Affairs remain committed to providing clear, practical guidance to help critical infrastructure operators manage these risks, understand their regulatory responsibilities and protect the systems and assets that support Australia’s economy and national resilience.
The 2026 Critical Infrastructure Annual Risk Review finds that AI is extending its reach across every category of hazard. AI is rapidly uncovering cyber vulnerabilities, and defending against them will require AI-enabled mitigation as new technologies reshape the threat environment. Digital supply chain risk is mounting, driven by reliance on AI tools for software and shifting demand for the hardware that powers AI. Physical security for AI infrastructure and connected technologies is now a frontline resilience challenge. AI-fuelled mis- and disinformation are eroding public trust in government and operators, particularly during natural hazards, when communities are most vulnerable. Governance guardrails for AI use in operations are now a key personnel security requirement.
The review describes a global polycrisis, with Australia’s risk environment shifting from complicated to complex. Geopolitical tensions, conflict, grey zone activity and trade disputes are disrupting supply chains, while technology rewires the global economy. Operators face overlapping crises, including climate change, regional conflict, supply chain disruption and emerging biohazards, that amplify and reshape one another. Each is broad in scope, prone to cascading effects and hard to predict. One crisis can trigger or worsen another, producing harms different from, and worse than, what each would cause alone. The review stresses that these crises must be understood and addressed as a whole.
Risk prioritisation improves resource allocation, decision-making and risk management efficiency by breaking risk into manageable parts, which matters when resources are limited. It should be guided by an organisation’s risk tolerance and adapt as the strategic environment and objectives change. Depending on internal and external factors, organisations can apply one or a combination of four approaches in their enterprise risk management: impact-led (risks causing the most damage or disruption to critical operations), likelihood-led (risks that are more likely or frequent, whatever their impact), cost-led (risks with the greatest monetary impact) and resource-led (risks that can be addressed with readily available personnel, equipment and funding).
The review’s graphics compare each hazard’s risk issues by plotting qualitative assessments of plausibility and damage, drawing on CISC’s understanding of the national critical infrastructure risk landscape and an all-hazards approach. Plausibility reflects likelihood, based on CISC’s analysis of the threat or hazard and the vulnerability of critical infrastructure to it. Damage reflects the broad consequence for critical infrastructure sectors, based on worst-case impacts. Examples of risks plotted include contracted workforce insider risk, pre-positioned cyber risk, AI implementation risk, third-party cyber risk, and geopolitically driven supply chain disruption.
Over four years of the Critical Infrastructure Annual Risk Review, reporting on the risk environment has shifted from a focus on traditional operational and cyber risks toward highlighting complex, interconnected systemic risks. This shift has been driven by technology advancements, geopolitics, supply chain concentration, interdependency and human factors. Managing the convergence of these trends is an important emerging challenge for risk professionals, and critical infrastructure resilience is becoming less about protecting individual assets and more about managing complex, interconnected systems and long-term, systemic vulnerabilities across technology, people, physical assets and geopolitical environments.
Artificial intelligence has evolved from an emerging technology risk in 2023 to a dominant threat multiplier in 2026, increasing the number of threat actors and lowering the capability they need to cause harm. Cyber threats are becoming faster, more complex, harder to detect and accessible to a wider range of adversaries. Australia’s critical infrastructure operators must therefore prepare for disruptions driven by emerging and evolving technology risks that are converging across different threat and hazard domains.
Technology supply chain risks are also becoming complex, systemic and geopolitically driven. Intertwining factors have created a concentration risk, arising from strategic geopolitical vulnerabilities and reliance on a small number of providers for cloud platforms, software, technology manufacturing and critical mineral supply. This matters because single points of failure are creating systemic risks that extend well beyond individual organisations, while foreign ownership, control and influence introduce opportunities for interference, coercion or exploitation.
Increasing interconnectedness has emerged as a major risk driver in every previous Annual Risk Review, and it is now advancing the probability of cascading failures. Disruption to one asset, supplier or sector can rapidly propagate across critical infrastructure sectors and operations, amplifying consequences. Threat actors are deliberately targeting assets capable of producing downstream impacts, while operators face greater exposure through shared infrastructure, third-party dependencies, cloud services and connected operational technologies.
Finally, trust, human factors and social resilience have become integral elements of strategic security risk. Operators are contending with misinformation, declining social cohesion, workforce shortages, insider threats, employee misuse of technologies, weak recruitment security and remote or offshore workforces. Because public trust and workforce capability are critical determinants of resilience, critical infrastructure resilience increasingly depends not just on technology, but on trusted information, skilled personnel, effective governance, community support and the ability to counter misinformation during crises.
The 2026 Critical Infrastructure Annual Risk Review identified that AI has exposed cybersecurity gaps that will persist as threats evolve. Frontier models are rapidly finding and exploiting vulnerabilities, outpacing defences and giving low-capability actors access to attacks that once required extensive resources. Examples include OpenAI agents autonomously infiltrating Australian government websites in 2026 and a state-sponsored actor manipulating Anthropic’s Claude Code in late 2025. Traditional frameworks are no longer sufficient, and tailored approaches, including AI-assisted detection and response, are needed.
AI is also intensifying mis- and disinformation, undermining trust in critical infrastructure information and complicating incident communication. Reliable communication, digital information literacy and factual messaging through credible channels are the recommended responses.
State-sponsored actors continue to pre-position within OT systems, using ‘living-off-the-land’ techniques to maintain persistent, undetected access. Iran’s Seedworm has targeted US critical infrastructure since 2017, and AI will almost certainly enhance pre-positioning, so mitigation must be continually reviewed, including air gapping and restricted connectivity to IT environments and the internet. Concentrated dependencies on a few third-party providers expose infrastructure to cyber vulnerabilities at scale, as CrowdStrike and Canva outages showed, and foreign ownership, control and influence over a dominant provider can enable persistent access or surveillance.
It also recognized that legacy systems remain highly vulnerable because they lack modern security controls, and emerging technologies, including quantum computing, will worsen the risk. The Enhanced CIRMP Rules require entities to understand third-party providers and mitigate legacy system risk.
The 2026 Critical Infrastructure Annual Risk Review identified that critical infrastructure supply chains have been exposed as fragile, with just-in-time logistics, single points of failure and complex vendor ownership making geopolitical risk part of everyday operations. The closure of the Strait of Hormuz showed diversification gaps, with flow-on effects reaching products such as bitumen, sulphur, plastics, insulation material and OT. Global competition for technology value chains, from critical minerals to chips, is adding complexity, as AI consumes a large share of the world’s computing hardware, power and resources and nation-states use control of supply chains as a geopolitical lever.
Foreign market dominance also enables interference and coercion, including restricted access to components and compromised hardware or software, so vendor scrutiny should focus on products that are business critical, hard to replace, highly connected or capable of collecting data, in line with the FOCI Risk Assessment Guidance. Reliance on AI tools is widening the digital supply chain risk surface through layered, opaque dependencies, which makes comprehensive mapping and independent security evaluation essential.
Also, financial pressure is a further risk, because rising costs can lead operators to favour lower-cost vendors that may lack security maturity or face foreign influence, embedding long-term fragility. Operators are urged to map dependencies beyond linear connections and balance efficiency with diversification.
The review’s outlook identifies emerging risk drivers that are likely to shape Australia’s critical infrastructure risk profile, with technology trends intersecting in complex and unpredictable ways. AI is creating a growing asymmetry between the cost of attack and defence: frontier capabilities are making cyberattacks more scalable, automated and accessible, while effective defence will depend on access to powerful models, computing infrastructure and skilled operators.
Rising hardware, energy and water demands, along with sanctions, export controls or bans on foreign models, may push defence costs higher, leaving smaller operators struggling against automated, persistent threats. Control of critical supply chain nodes, including manufacturing capacity, raw materials, logistics networks, digital platforms and chokepoints such as the Strait of Hormuz, will also be increasingly weaponised as a geostrategic tool. Even limited disruption from conflict, coercion or interference could have repercussions for Australia’s critical infrastructure and economic security.
The review argues that resilience must become a collective endeavour, because all sectors rely on common enabling systems such as cloud platforms, energy networks, space-based assets and submarine cables, and no operator can guarantee uninterrupted availability alone. With cyber threats, geopolitical tensions and climate events converging, system-wide resilience through information sharing, mutual support, coordinated planning and shared capabilities will be critical.
Human factors will matter more in an automated future, as AI cannot replace human judgement and oversight, particularly during major disruptions and where legacy systems remain in use, so operators need to invest in workforce development, knowledge transfer and succession planning.
Furthermore, operators must also address quantum risk before vulnerable cryptography becomes a liability, since quantum computing is expected to render current encryption standards obsolete. Early steps include prioritising sensitive data, assessing cryptographic dependencies across OT and IT environments, and developing a transition plan, while ASD’s CI Fortify guidance on isolating vital OT remains an important preparation and recovery measure.
