For years, the Essential Eight has been the go-to checklist for Australian organisations defending against cyber attacks. That is now changing. The Australian Signals Directorate (ASD) has launched ASD Essentials, a new cyber security framework that evolves the Essential Eight into a broader set of guidance covering enterprise IT, operational technology and cloud environments. The shift is more than a rebrand. It changes how organisations measure progress, where they focus effort and how they handle environments the original framework was never designed for.

Why ASD Essentials Is Replacing the Essential Eight

ASD points to its Annual Cyber Threat Report 2024-2025, which shows Australian organisations facing increasingly sophisticated threats. At the same time, modern technology environments have grown more complex, spanning on-premises systems, hybrid cloud and emerging technologies. A fixed list of controls struggles to keep up with that variety. The new framework takes a threat-informed, principles-based approach, giving organisations flexibility to achieve security outcomes without being tied to specific technologies.

5 Key Changes Under ASD Essentials

1. Phased priorities replace maturity levels. Instead of climbing maturity levels, organisations will work through phased priorities, directing effort to their highest-risk assets first. 2. Outcomes over checklists. The framework moves away from prescriptive security requirements toward principles and actions that help organisations assess whether intended security outcomes are actually being achieved. 3. New building blocks. It introduces cyber security principles, actions and domains, focusing uplift efforts on critical business functions and systems. 4. Environment-specific chapters. Each chapter applies the same underlying model but accounts for the threats, risks and operational realities of the environment it covers. 5. Risk-informed decisions. There is a stronger emphasis on decision-making supported by threat intelligence and each organisation's own context.

The First Three ASD Essentials Chapters

The series launches with three chapters:

• Essentials for enterprise IT is the direct evolution of the Essential Eight.
• Essentials for operational technology (OT) supports Australian critical infrastructure operators protecting their operational technology environments from cyber threats.
• Essentials for cloud supports organisations whose technology environment is delivered entirely through software-as-a-service (SaaS) and platform-as-a-service (PaaS).

ASD has also made AI-focused guidance available, helping organisations consider AI-enabled systems within their technology environments. The framework includes overview publications and supplemental publications alongside the chapters.

Who Should Pay Attention

The guidance is written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations. Small and medium-sized businesses that do not operate at enterprise scale can still apply it where relevant. ASD says the framework remains consistent with its best-practice advice and the Australian Government Information Security Manual. Industry consultation played a central role in its development, and ASD plans to keep engaging with industry, government and critical infrastructure stakeholders as technologies and threats change.

What ASD Essentials Means for Compliance Today

For now, nothing changes on the compliance front. Organisations should continue meeting their current regulatory obligations until regulators communicate any associated changes. ASD is in discussions with regulatory bodies about the impact and expected timeframes of the transition and says it will advise on expectations in due course. During the transition period, both the Essential Eight and ASD Essentials will remain available on cyber.gov.au, along with supporting resources and implementation guidance. For security teams, the practical takeaway is to start reviewing the new chapters now, map current Essential Eight controls against the new principles, and identify which critical business functions and systems would sit at the top of a phased priority plan.

The UK Ukraine AI partnership will give Britain access to Ukraine’s Avengers AI Labs, bringing together Ukrainian battlefield experience, operational data and engineering expertise with the UK’s AI ecosystem. The agreement, signed by President Volodymyr Zelenskyy and Prime Minister Andy Burnham in Ukraine, will focus initially on defence and national security. Under the partnership, British innovators and researchers will gain access to data and insights collected across the battlefield. The UK government described Avengers AI Labs as a “goldmine of battlefield data,” offering researchers access to real-world operational information used to train AI models.

How Avengers AI Labs Uses Battlefield Data

The data is collected through thousands of daylight cameras and infrared sensors deployed across the battlefield. The systems capture images and information involving tanks, artillery, air defence systems, infantry and aerial targets, including Shahed drones and reconnaissance UAVs. The data is used to train AI models to recognize and classify battlefield objects. Ukraine’s Defense Ministry has previously said that systems trained using the Avengers Labs platform analyze more than 100,000 drone video feeds each month and help identify about 70% of enemy targets in real time. The UK’s access to the platform is intended to allow British startups, researchers and engineers to work with operational insights and develop technologies based on real-world datasets. The partnership will initially bring together engineers, academics, businesses and military operational expertise from both countries to address national security challenges. The two countries will also explore additional platforms for future collaboration.

UK Ukraine AI Partnership Test New Defence Technology

Several pilot projects involving British startups have already been rolled out as part of the agreement. The companies named are Bristol-based Sintela, Oxford’s Mind Foundry and London’s Skyral. The first technology is due to be deployed at a UK defence site to help protect bases from protestors and hostile actors seeking intelligence. The project combines Ukrainian data with UK technology and turns buried fibre-optic cables into an AI-enabled sensor. The technology could also be used in other critical locations, including airports, prisons, railways and energy plants, according to the information released about the partnership. A second project will examine the development of next-generation low-power AI chips designed for future drones, robotics and autonomous systems. If successful, the technology could support machines designed to operate for longer, respond faster and function in environments where conventional systems face limitations.

AI Sovereignty and Defence Innovation

The agreement forms part of the UK and Ukraine’s 100 Year Partnership and expands cooperation between the two countries in AI and defence technology. The UK will provide access to its universities, researchers, technology companies and AI ecosystem, while Ukraine will provide access to operational experience and datasets generated during the war. Minister for AI Kanishka Narayan described the arrangement as AI sovereignty in practice, focused on developing national capabilities and turning frontline experience into technologies for military and critical infrastructure protection. The partnership also follows the UK government’s announcement that defence firm MBDA can release classified information on UK components for the long-range SCALP missile to establish local assembly lines in Ukraine. The broader agreement is intended to combine Ukrainian battlefield data with British scientific, engineering and technology expertise, with the initial focus remaining on defence, national security and the development of future defence technology.