Modernising (and securing) Australia’s industrial stack

ARM Hub is helping modernise Australia’s industrial environment. That work fundamentally improves the security posture of Australian small and medium-sized enterprises (SMEs) by delivering modernised data and systems that support secure AI adoption and reduce the risk of attack.

This work matters most for SMEs in manufacturing and infrastructure supply chains. Many do not have the resources, specialist expertise or internal capacity to examine and modernise their technology stack.

The real and immediate risk is legacy infrastructure. Attackers can use AI to identify vulnerabilities, develop exploits and accelerate cyber attacks [2][3], and older systems are the most exposed [7].

Delaying AI adoption does not remove the exposure.

It instead leaves businesses with older systems, limited visibility, and fewer options for applying modern security controls. The Australian Signals Directorate (ASD) states that organisations can use AI to strengthen cyber defence, provided they maintain strong fundamentals such as minimising attack surface, patching promptly, layered defences and improved threat detection. [6]

The risk in legacy systems

Australian factories, plants and utilities rely on operational technology, production software and connected machinery designed for a different threat environment. In guidance for critical infrastructure operators, ASD notes that operational technology environments often contain legacy devices, outdated protocols and slow replacement cycles. Many of these systems were not engineered to endure cyber security incidents, and many operators remain tied to long-standing engineering contracts written without cyber security in mind. [1]

These environments are hard to document, patch, monitor and isolate. The result is persistent risk for industrial operators and the businesses that support them. ASD’s CI Fortify guidance identifies the importance of understanding operational technology assets, managing dependencies, applying appropriate security controls and maintaining service continuity and resilience. [1]

SME systems may be undocumented, hard to patch and poorly connected to modern identity, monitoring and access controls. Businesses cannot protect systems they cannot see, understand or manage.

Co-founder and Executive Director of Australia’s Tech Policy Design Institute Johanna Weaver has warned that Australia’s ageing systems can hold sensitive information while receiving little maintenance, support or security updates. She has called for old systems to be decommissioned and sensitive data moved off them. [8]

Speaking in September about Australia’s legacy technology debt, ASD Director-General Abigail Bradshaw said AI would have one of two effects: it would either prompt decisions to replace legacy technology or, if Australia did not move fast enough, almost certainly make that technology “the first to be compromised in a major AI-enabled attack”. [7]

ASD advice supports modernisation

ASD’s 24 September 2026 alert on AI misalignment applies to organisations with public-facing websites or applications. It described incidents in which AI agents took actions their operators had not authorised. In one, an agent independently identified vulnerabilities, work traditionally done by human researchers. Existing security controls limited what the agents could do. ASD’s advice was to deploy AI securely and maintain strong cyber security fundamentals. [5]

ASD stated that there was no indication the activity represented a broader threat or malicious targeting against Australia. [5]

The broader guidance warns that attackers may use AI to target many victims at once and move quickly from initial compromise to data theft or extortion. [2][3]

ASD’s recommendations for medium-sized businesses provide a practical modernisation agenda. They include:

• Identify internet-facing services and remove those that are no longer required.

• Replace internet-facing services that no longer receive vendor security patches.

• Apply security updates rapidly and configure automatic updates where appropriate.

• Use AI carefully, in a secure and human-supervised way, to analyse security logs and test for vulnerabilities. [3]

Their guidance for small businesses sets out comparable steps, including enabling automatic security patches, reviewing companies that store or share sensitive data, scanning software developed for websites for vulnerabilities and removing unnecessary website functionality. [4]

(The full recommendations for both are published in ASD’s Defending against AI-enabled cyber attacks guidance. [3][4])

Each action depends on knowing what systems a business operates, how they connect and which data they handle. That is easier with a documented, current technology stack than with equipment installed decades ago.

The productivity case

The National Robotics Strategy records productivity growth of 1.2 per cent a year over the 20 years to 2021–22, the lowest rate in 60 years. It states that automation could increase annual productivity growth by 50 to 150 per cent. [9]

The average age of Australian manufacturing capital rose from 11 to 13 years over the decade to 2024. The Australian Government has identified investment in robotics, automation and advanced manufacturing as part of the response to ageing assets, labour pressures, stagnant productivity and the need to strengthen domestic capability. [11]

The strategy also identifies the barriers that hold industry back. Many businesses, particularly SMEs, hesitate over a perceived high cost of entry, and changing business processes and upgrading infrastructure can be costly. [10] ARM Hub helps businesses overcome these barriers through practical adoption and implementation support. [12]

Modernisation improves both security and competitiveness. Integrated data, current systems and clear technology inventories support stronger access controls, monitoring, patching, network segmentation and incident response. They also provide the foundation for the safe deployment of AI, robotics and automation.

What ARM Hub does

ARM Hub is the AI Adopt Centre for Australian manufacturing. It helps businesses design, test and deploy advanced technologies, from audits and roadmaps to prototyping, automation and AI. [12]

ARM Hub maps how a business’s technology fits together and identifies what to improve first. For manufacturers without an internal data science team, its Data & AI-as-a-Service provides data capability, governance and implementation support.

What modernisation delivers

Modernising to support AI:

• Brings unmanaged systems into view and under control.

• Reduces immediate exposure created by unsupported or poorly governed technology.

• Positions businesses to use AI-enabled defensive measures of the kind ASD recommends.

• Improves productivity, quality, consistency and operational decision-making.

• Strengthens the ability to recover from disruption and maintain business operations.

Businesses that delay modernisation stay exposed through legacy infrastructure as attackers’ tools improve, lack the foundation for contemporary defences and risk falling further behind on productivity.

Sources

1. Australian Signals Directorate, Australian Cyber Security Centre, “CI Fortify: Guidance for Australian critical infrastructure service continuity and resilience,” 13 October 2025. cyber.gov.au

2. Australian Signals Directorate, Australian Cyber Security Centre, “Defending against AI-enabled cyber attacks,” 6 July 2026. cyber.gov.au

3. Australian Signals Directorate, Australian Cyber Security Centre, “Defending against AI-enabled cyber attacks: Guidance for medium-sized businesses,” 6 July 2026. cyber.gov.au

4. Australian Signals Directorate, Australian Cyber Security Centre, “Defending against AI-enabled cyber attacks: Guidance for small businesses,” 6 July 2026. cyber.gov.au

5. Australian Signals Directorate, Australian Cyber Security Centre, “Risks of AI misalignment to Australian organisations,” 24 September 2026. cyber.gov.au

6. Australian Signals Directorate, Australian Cyber Security Centre, “Opportunities for AI in cyber defence,” 27 May 2026. cyber.gov.au

7. Cyber Daily, “ASD chief says Aussie companies’ ageing tech a growing concern in the age of AI,” 16 September 2026. cyberdaily.au

8. Guardian Australia, “Australia is run on legacy systems that AI agents can easily exploit, former UN cyber negotiator warns,” 28 September 2026. theguardian.com

9. Australian Government, Department of Industry, Science and Resources, “Australia’s robotics opportunity,” National Robotics Strategy, 28 May 2024. industry.gov.au

10. Australian Government, Department of Industry, Science and Resources, “Theme 2: Increasing adoption,” National Robotics Strategy, 28 May 2024. industry.gov.au

11. Ed Husic, “Address at the AFR Artificial Intelligence Summit 2024,” 28 May 2024. minister.industry.gov.au

12. ARM Hub, “AI & Robotics for Manufacturing Hub.” armhub.com.au