The 2026 National Defence Strategy (NDS) and Integrated Investment Program (IIP) mark a notable sharpening of Australia's posture on cyber. Where the 2024 strategy treated cyber threats as an intensifying problem, the 2026 documents adopt a present-tense alarm: espionage and foreign interference are already at “extreme levels,” and authoritarian regimes are increasingly willing and able to disrupt critical infrastructure. That rhetoric is matched by money, technical prescriptions and a clearer embrace of offensive cyber power.
A$27–38 billion for cyber, space and electronic warfare
The headline figure is substantial and broadly consistent with the 2024 allocations, but the IIP shows a meaningful change in composition. Investment in offensive and intelligence-led cyber capabilities — particularly activity under Redspice, Australia’s signals intelligence and cyber uplift program — has roughly doubled, rising from between A$6.4 billion and A$8.4 billion to between A$10 billion and A$15 billion. At the same time, funding for hardening Defence’s own network infrastructure has halved, suggesting a rebalancing from passive resilience toward active cyber effects and intelligence collection.
Redspice, AI, and the move from promise to delivery
The 2026 documents make artificial intelligence an explicit core enabler for both defensive and offensive cyber activity. Redspice’s AI component — previously described in 2024 as background — is now identified as the vehicle for processing growing data volumes and enabling capability across the cyber spectrum. Defence and the Australian Signals Directorate (ASD) have reported “significant progress” on the program, though those claims rest largely on ASD reporting rather than independently verifiable public metrics.
Technical specificity: zero-trust and advanced encryption
The IIP explicitly names advanced encryption and “zero-trust architecture” as the approach for protecting Defence networks — language absent from 2024. Zero-trust rejects perimeter-based models that assume devices and users inside a network boundary can be trusted; instead, entities are treated as untrustworthy by default and must always be verified. That architectural commitment signals a move from acknowledging the problem to specifying how Defence will defend itself in an environment where adversaries can automate vulnerability discovery.
Legacy systems, AI-enabled discovery, and the post-quantum timeline
The strategy confronts real technical constraints. Defence’s logistics, command-and-control architecture and classified communications include legacy software that is hard to patch without disrupting operations and is increasingly visible to adversaries equipped with AI-enabled discovery tools. The post‑quantum problem compounds this: the model of “harvest now and decrypt later” means encrypted data collected today could be readable once quantum capability matures. The ASD has set timelines for a transition to quantum-resistant cryptography, aiming for full completion by 2030, but progress among Defence-adjacent entities and critical infrastructure operators is uneven.
What this means for technologists, policymakers, and Southeast Asian partners
- Technologists and security teams: expect priority focus on zero‑trust implementation and migration planning for post‑quantum cryptography, while balancing operational disruption against exposure from AI-enabled reconnaissance.
- Policymakers and procurement leaders: will need to translate the IIP’s technical commitments into detailed guidance and measurable milestones, and to reconcile doubled offensive funding with reduced hardening budgets inside Defence.
- Southeast Asian partners and critical infrastructure operators: are named explicitly as a priority for engagement — information-sharing, confidence‑building and capacity‑building are described as force multipliers that extend Australia’s reach without equivalent spending increases.
For all its greater clarity, the NDS leaves the hard work ahead: turning funding and doctrine into demonstrable outcomes. The documents signal that Defence is “asking the right questions, funding the right programs and being honest about the environment it faces,” but they also flag that demonstrable progress will require concrete guidance on zero‑trust across supply chains, clearer transparency on the post‑quantum transition, and a carefully managed integration of offensive cyber capabilities into military operations and alliance frameworks without elevating escalation risks. The strategy is the necessary first step; the test will be whether Defence can show, in measurable ways, that intent has yielded capability.
NDS 2026 – More resourcing for a complex cyber threat environment
