The Australian Government, in an understandably conservative move during election year, has decided to structure its focus towards topics more directly influencing voters’ cost of living. In the short few weeks leading up to the May 3 election, the 2025-26 Federal Budget appears to be centred over issues such as social security, healthcare, home-ownership and education.
Ostensibly, the latest Federal Budget has no explicit new funding or allocation for cybersecurity efforts. However, as we will discuss in this article, cybersecurity allocations are embedded within the Defence and National Security programs that have secured specific budget allocations this year.
The question to ponder then is: would the lack of direct mention of cybersecurity within the Federal Budget have a negative impact on national efforts on cyber resilience? After all, building Australian cybersecurity is an endeavour that requires the combined, sustained effort of various stakeholders, from government to individuals – a team game that could result in disaster if one player were to drop the ball.
Would the lack of direct mention of cybersecurity within the Federal Budget have a negative impact on national efforts on cyber resilience?
The 2025 Federal Budget in a Nutshell
Source: 2025-26 Federal Budget
To provide a comparison, the 2024-25 Budget expressly mentions cyber resilience as one of the objectives in “securing Australia’s place in the world”, with an allocation of more than $388.2 million “to upgrade Australia’s communications infrastructure and overseas property, including in the Pacific”. A further, $1.8 billion was budgeted for Services Australia to manage claims, to continue emergency response capability and improve the cybersecurity environment.
Existing and “Hidden” Support for Cybersecurity
While funding has not been directly mentioned in the Federal Budget, the Budget does discuss funding for certain initiatives and strategies that have been recently put in place:
Support for the 2024 Independent Intelligence Review
The Federal Budget has allocated $44.6 million in initial investment to the Australian Intelligence Community, of whom the Australian Signals Directorate (ASD) is a member of, in response to The 2024 Independent Intelligence Review.
While explicit recommendations towards funding of ASD were absent, the Independent Intelligence Review does discuss the mission of economic security, which we firmly believe cybersecurity plays a significant role. Other parts of the Review also discuss AI, data and IT security, and the benefit of deeper partnerships with private industry through knowledge and capability sharing, particularly in the context of cybersecurity.
2024 Defence Integrated Investment Program
The Federal Budget has also allocated $330 billion to the 2024 Defence Integrated Investment Program, within which, $15-20 billion will be invested in both defensive and offensive capabilities against malicious cyber activity “in an increasingly contested cyber domain”, as well as to provide greater threat visibility and cyber resilience with respect to critical infrastructure.
While the 2025-26 Federal Budget does not directly fund cybersecurity efforts, The 2024 Independent Intelligence Review and the 2024 Defence Integrated Investment Program both recognise that cyber attacks and intrusions are real threats to national security, in particular, informed by ASD’s Annual Cyber Threat Report 2022-2023.
the operating environment for intelligence agencies also requires strong partnerships with Australian businesses … to help the private sector build its own resilience to cyber and espionage threats…
Existing Government Funding on Cybersecurity
In addition, to the funds allocated by the previous Federal Budget, the Australian Government has also previously committed funding towards bolstering Australian cyber resilience in the following ways:
Cybersecurity is a Shared Responsibility
Spending on cybersecurity has been on an upward trend and is set to continue. Gartner forecasts that worldwide end-user spending on information security is projected to total USD 212 billion in 2025, an increase of 15.1% from 2024.
This is only logical, given that the stakes continue to increase. In IBM’s Cost of a Data Breach Report 2024, it is reported that the global average cost of a data breach has been increasing as well, with the 2024 global average at $7.74 million. Australia’s average cost of a data breach in 2024 was reported to be $4.41 million, up from $4.28 million the previous year.
It is against this backdrop that makes it somewhat alarming to then be given the impression that no new government funding for cybersecurity is on the table. This is especially so considering that critical-infrastructure-related sectors tend to suffer significant costs, to say nothing of intangible damage.
National cyber resilience is a team sport, with the public sector, private sector, and individual residents, each playing a critical role. While the private sector generally has the expertise, it is only through government support that we can see:
- Implementation of policy
- Setting of standards
- Supports of critical infrastructure
- Coordination of intelligence
- Raising of public awareness
National cyber resilience is a team sport, with the public sector, private sector, and individual residents, each playing a critical role.
In addition, with the perception of cybersecurity public funding drying up (by being absent from the Federal Budget), there is the risk of the wrong optics being sent, creating a ripple effect that weakens the ecosystem. Currently, the ASD reports an uptrend of average cost per self-reported cybercrime by individuals as well as small businesses. With the reduced government support, this number is surely set to rise, with SMEs and individuals left without guidance and education on how to protect themselves from cyber threats. The perceived reduction in support might also compel SMEs to reduce their own spending on cybersecurity, having no insufficient stewardship on how to protect themselves. Underinvestment by the Government in national education and scam prevention tools, would make less savvy end-users more vulnerable to attack as well.
The omission of cybersecurity from the budget is also otherwise counter to the Government’s drive to “building a stronger economy”, through “securing Australia’s place in the world”, as represented in the Federal Budget. The Government is gunning for Australia to be the “partner of choice in the Pacific, for regional stability and economic prosperity”, as the budget itself states, and this can only be the case if partnering with Australia continues to give a sense of security. According to the Nozomi Networks OT/IoT Cybersecurity Trends and Insights 2024 2H report, Australia is now the fourth most targeted country with a marked increase in attempts to gain access to critical infrastructure industries. While Australia still has a solid global ranking when it comes to cybersecurity, the Nozomi report is a clear reminder that we shouldn’t rest on our laurels. Now is hardly the time to cut back on cybersecurity spending.
Conclusion
Australia’s economic and national security are increasingly intertwined as we grapple with global risks and the evolving security environment.
While at first glance the Federal Budget appears to suggest that cybersecurity is no longer considered a significant portion of national security, the truth is that investment in cybersecurity is still there but nested in larger budgets dedicated to Defence and National Security.
While it may seem that indirect allocation is better than no allocation at all, building a cyber resilient nation requires effort, prioritisation and coordination from both the public and private sector. In the arms race against cyber threat actors, cyber defence investment should scale with the cost of cyber attacks. Were we to stop keeping up, this could at best, incentivise threat actors to double down and strike while the iron is hot. In turn, a hotbed of cyber attacks may diminish investor confidence and deter foreign investment.
It is thus critical for the private sector to be aware – and assured – that while silent from the Federal Budget, government spending on cyber resilience is still very much on the table. That being said, with the cost of cyber attacks being on the rise, cyber defence spending should only increase in correlation. The Government should be seen to be leading the charge towards national cyber resilience, rather than falling behind, dropping the ball.
PRASHANT HALDANKAR
The co-founder and the Chief Information Security Officer (CISO) at Sekuro, a global cybersecurity and digital transformation company headquartered in Sydney, providing end-to-end cybersecurity and digital resiliency services and solutions. Prashant leads the business resilience function globally with extensive experience establishing and maintaining cybersecurity visions, strategies and information asset protection frameworks for enterprises.
