ASD Says Legacy Technology Will Be the First Casualty of AI-Enabled Attacks. A 90-Day Plan for Boards

Australia’s top signals intelligence official has said out loud what most security leaders already suspect: the systems most likely to fall in the first serious AI-enabled attack are the old ones. Speaking at the Australian Strategic Policy Institute’s Sydney Dialogue AI masterclass on 15 September 2026, Australian Signals Directorate Director-General Abigail Bradshaw said Australia is “sitting on an enormous legacy technology debt” and that it will “be the first to be compromised in a major AI-enabled attack”. For a board, that is not a technology observation. It is a statement about where the next material incident will come from.

What Bradshaw said

The remarks were reported by Startup Daily and eWeek among others. Three points stand out.

AI has collapsed the time it takes to find weaknesses. Bradshaw said work that previously took ASD’s own experts “weeks and weeks” can now be done in hours with advanced AI models. Startup Daily reported that ASD used AI-assisted vulnerability scanning to cut its own legacy software by 37 per cent over twelve months. The same speed is available to attackers.

Legacy systems go first. Old software has known, unpatched and often unpatchable weaknesses. When the cost of finding and chaining those weaknesses falls to near zero, the systems that were “too hard to replace” become the easiest way in.

Set reduction targets, and be ready to patch in 48 hours. Her recommended response was pragmatic rather than heroic: “The most powerful thing we can do is set some legacy technology reduction targets”, replace end-of-life systems before they become the attack path, and accept that some vulnerabilities may need to be fixed within 48 hours even at the cost of availability. She also called for an AI “early warning system” so that government, industry and AI developers share emerging risks faster.

The scale of the problem in government alone is large: Startup Daily cited a Microsoft-commissioned report putting the cost of the Commonwealth’s legacy systems at $13 billion in lost service hours, maintenance and inefficiency, against a $2.4 billion allocation in the 2026 budget for updating social services and health ICT.

Why this is a board matter, not an IT ticket

Legacy technology persists for reasons that sit above the IT department: the replacement is expensive, the system still works, the people who understand it have left, and the business process on top of it has never been redesigned. Every one of those is a decision the board and executive have made, usually by not making it.

Bradshaw’s framing changes the risk calculation. A system that was an acceptable residual risk when exploitation required a skilled human for weeks is not the same risk when exploitation can be automated in hours. The likelihood side of the register has moved, and the treatment has not.

Directors do not need to understand the technology. They need to be able to answer four questions:

1. What are our legacy systems, and which of them hold data or run processes we cannot afford to lose?
2. Which of those can no longer be patched, and what compensating controls sit around them?
3. How quickly can we apply a critical patch across the environment, measured, not estimated?
4. What is the plan and the funded timeline to retire the worst of them?

If management cannot answer those within a meeting, that is the finding.

Where the Essential Eight already points

None of this requires a new framework. The Essential Eight, ASD’s own baseline for mitigating cyber incidents, already treats legacy technology as a first-order problem. Two of the eight strategies, patching applications and patching operating systems, set explicit expectations at each maturity level for how quickly patches are applied and for removing software that is no longer supported by its vendor. The maturity model is blunt about unsupported software: at the higher levels it is to be removed, not tolerated.

The practical implication is that a legacy reduction program and an Essential Eight uplift are the same program looked at from two ends. Boards that have asked for an Essential Eight maturity assessment already have the inventory they need; the missing step is turning the unsupported-software findings into a retirement plan with dates and owners.

A 90-day plan

The following is a sequence a board can reasonably ask management to run and report on. It does not fix legacy debt in 90 days. It gets the organisation to a position where the debt is known, prioritised, funded and being reduced on a schedule.

Days 1 to 30: know what you have.
– Produce a single inventory of systems, applications and network equipment, with vendor support status for each. Tools help, but the pass mark is a list the CIO will sign.
– Flag everything end-of-life or end-of-support. For each, record what data it holds, what process depends on it, and what is exposed to the internet.
– Measure current patch performance: for the last three critical vendor patches, how many days from release to full deployment? That number, not a policy document, is the baseline.

Days 31 to 60: rank and contain.
– Rank legacy systems by exposure and consequence. Internet-facing plus sensitive data plus unpatchable goes to the top.
– For the top items that cannot be replaced quickly, put compensating controls in place now: isolate them on the network, remove direct internet exposure, restrict administrative access, increase logging and monitoring, and confirm they are covered by tested backups.
– Agree a 48-hour critical-patch process for the systems that can be patched, including who can authorise downtime. Test it on a real patch.

Days 61 to 90: set the targets and fund them.
– Set legacy reduction targets, in Bradshaw’s phrase, with numbers and dates: for example, the count of unsupported systems to be retired or replaced in the next 12 months, and the residual list with named owners.
– Put the cost in the budget cycle now rather than after an incident. The cost of replacement is knowable; the cost of a breach through an unpatchable system is not.
– Add two standing items to the board’s risk reporting: unsupported systems in production, and median days to deploy critical patches. Trend both.

What good looks like at the board table

A board that has done this does not have zero legacy technology. It has a list, a ranking, a set of compensating controls it can describe, a patch performance figure it tracks, and a funded retirement schedule that shortens every quarter. That is a defensible position with a regulator, an insurer and a shareholder. “We knew it was old and we were going to get to it” is not.

Bradshaw’s early-warning idea is worth watching, and information-sharing arrangements will improve over time. But the part of her message that is entirely within an organisation’s own control is the reduction target. Attackers will use AI to find the old systems. The only question is whether the organisation finds them first.

How CISO Advisory can help

CISO Advisory Australia provides independent, senior security leadership to boards and executives, with no products to sell. We can run the inventory and ranking described above as part of an Essential Eight maturity assessment, design the compensating controls for the systems that cannot be replaced yet, and provide ongoing virtual CISO oversight so the reduction targets are reported to the board and actually met. For organisations working towards certification, the same work feeds directly into ISO 27001 asset and vulnerability management requirements.

If your board cannot yet answer the four questions above, talk to an independent CISO. We are available 24/7 on 07 2112 8502.