Australian Security Intelligence Organisation (ASIO) Director General Mike Burgess, in a speech marking the 25th anniversary of the 9/11 terrorist attacks, has issued a direct warning on the escalating physical and cyber security risks facing Australian critical infrastructure, calling on public and private sector organisations to urgently strengthen their defences across data centres, AI facilities, and essential services.

The warning is reinforced by ASIO's 2026 Annual Threat Assessment, which describes a security environment that has degraded faster than previously anticipated. Foreign hackers are actively targeting Australian critical networks across water, energy, transport, and telecommunications sectors. China is identified as a top concern regarding espionage and potential disruption of critical infrastructure during a conflict, while the assessment highlights the increasingly interconnected nature of threats, encompassing terrorism, sabotage, espionage, and foreign interference.

"In last year's Threat Assessment (2025), we declassified part of ASIO's outlook to 2030. I warned we were entering a period of strategic surprise and security fragility and predicted the threat environment would become more dynamic, diverse and degraded by the end of the decade. Unfortunately, we are already there," says Burgess.

He says the threats are dynamic because great power competition is having an ongoing and profound impact on global stability and strategic interests. "Alliances and norms once considered unbreakable are being questioned. Many of the things we've taken for granted are being tested: social cohesion, economic stability, and supply chain certainty, among them," he adds. The emerging threats are increasingly diverse, he says, "because instead of discrete risks, we face multifaceted instability where state-sponsored aggression and domestic volatility intersect."

ASIO identifies three escalating risk categories. Active sabotage is an immediate concern, with state-backed hackers scanning and probing critical sectors including water, energy, and telecommunications. Foreign actors are moving closer to the threshold of high-impact cyber sabotage capable of disrupting the national economy. Espionage and foreign interference remain at extreme levels, compounding what Burgess describes as a fragile security climate.

Obligations for architects, builders, and facility operators

The 2026 assessment carries direct implications for the built environment. Architects and builders are expected to design physical and digital resilience into new projects. Building owners and managers must protect properties, data centres, and AI facilities. Employers carry a duty of care under Australian law to protect staff and assets from interconnected threats, where state-sponsored aggression and domestic volatility now intersect.

PSPF updates: zero trust and least privilege

The Protective Security Policy Framework (PSPF), updated in 2025 and 2026, mandates that Commonwealth entities build cyber strategies around zero trust architecture, eliminating implicit trust for users, devices, and networks. Continuous verification replaces the assumption of trust once granted, and least-privilege access controls require strict identity verification for all sensitive systems.

Physical security zones for data centres

The PSPF defines five physical security zones, from Zone One (unrestricted public access) through to Zone Five (maximum security, requiring high-level clearances and dual-factor authentication). Major commercial data centre facilities in Australia are expected to build strong physical defences, with some incorporating controls consistent with Zone Three requirements: enhanced perimeter fencing, mandatory biometric or card access checkpoints, continuous camera monitoring, and close escorts for pre-approved visitors on a need-to-know basis.

Main Image: Envato

Architecture & Design Team

Let’s connect!