Surprisingly Useful AI Article Enhancements
For years, the cyber threat conversation has been dominated by malware. New variants, zero-days and malicious files have shaped how organisations think about risk and how security strategies are built. But in Australia, that framing is starting to look outdated.
Australian businesses are facing a cybersecurity threat landscape that looks markedly different from the rest of the Asia-Pacific region, and that difference underscores a broader shift in how adversaries are operating. According to WatchGuard Technologies’ latest Q4 2025 Threat Landscape data, there has been a significant change in attacker behaviour, with network-based attacks now eclipsing malware attacks in Australia by a wide margin.
Australia’s unique threat mix
Between October and December 2025, WatchGuard blocked 96,049 network attacks targeting Australian organisations, compared with 8,510 malware attacks over the same period. In stark contrast, the broader APAC region, which accounted for 31 per cent of global malware detections, represented only 4 per cent of network attacks. This reinforces how Australia’s pattern diverges from regional and global trends.
Attackers are now prioritising continuous scanning and exploitation of internet-facing systems such as websites, cloud services, servers and network infrastructure,; rather than relying solely on traditional malware delivery.
Scale and persistence matter
This shift is not subtle. Earlier in 2025, data from WatchGuard showed network attacks far outstripped malware even in month-by-month snapshots. In August 2025, Australia recorded more than 65,000 network attacks compared with around 5,000 malware threats blocked. Attackers are probing systems roughly 90 times per hour, reflecting high volumes of automated scanning and exploitation activity.
Meanwhile, the vast majority of malware detected locally is made up of known variants rather than novel “zero-day” threats. In the recent Q4 reporting period, 92 per cent of malware detections were known threats, underscoring that attackers are having success by targeting familiar vulnerabilities at high volume.
National context: cyber incidents rising
The broader Australian cyber environment shows rising demand for vigilance. The Australian Cyber Security Centre (ACSC) reported an 11 per cent increase in cyber security incidents in FY 2024-25, with more than 1,200 incidents responded to and over 1,700 notifications of potentially malicious activity, up 83 per cent on the prior year. Denial-of-Service (DoS/DDoS) incidents, a classic form of network-level attack, also rose more than 280 per cent.
Rethinking defence priorities
For Australian organisations, this evolving landscape has clear implications. Traditional cyber defences built primarily around malware detection and endpoint protection are no longer sufficient on their own. What’s required is continuous network visibility and proactive patching practices as attackers increasingly apply relentless pressure to find and exploit weaknesses in exposed infrastructure.
Australia is not becoming less secure, but it is becoming differently exposed. Recognising that distinction and responding to it is now one of the most important challenges facing business and security leaders alike.
Anthony Daniel is MD for ANZ & Pacific Islands at WatchGuard.
Last Updated on February 16, 2026 by Anthony Daniel
