The End of the Essential Eight (and What Comes Next)

Australia's flagship cyber security baseline is being retired. Here's where it came from, how it held up, and why the ASD is changing course — right as AI rewrites the rules.

For the better part of a decade, if you asked anyone in Australian IT "what's the baseline we should be hitting for cyber security?", the answer was two words: the Essential Eight. It's been the closest thing we have to a national standard — mandated for federal agencies, written into contracts, and used by everyone from law firms to construction companies as the yardstick for "are we actually secure or just hoping?"

In June 2026, the Australian Signals Directorate announced it's retiring it.

Not tomorrow, and not without a plan — but within about two years the Essential Eight as we know it will be folded into something new called the Essentials series. That's a significant call, and it hasn't come out of nowhere. It's the collision of two things: a framework that was quietly straining under its own age, and a threat landscape that AI has just kicked into a completely different gear.

This is a long read, because it's worth understanding properly rather than skimming a headline. We'll go through where the Essential Eight came from, what it actually is, how well it's really worked, what the new proposal is trying to fix, who the players are — and, at the end, what we at The Techy Side are doing about all of it.

Part 1 — Where the Essential Eight came from

The Essential Eight didn't spring into existence in 2017. Its roots go back to 2010, when the body then known as the Defence Signals Directorate (DSD — the ASD's earlier name) published a document called "Strategies to Mitigate Targeted Cyber Intrusions." It listed 35 strategies, ranked by effectiveness, and it was built on something most guidance of the era wasn't: real incident data. DSD had been responding to intrusions on Australian government networks and testing those networks itself, and it distilled what actually stopped attackers into a ranked list.

The insight buried in that document was blunt and, in hindsight, prophetic: a small handful of the strategies did most of the heavy lifting. So by around 2012, DSD was promoting the "Top 4" — application whitelisting, patching applications, patching operating systems, and restricting administrative privileges. These four were assessed to prevent the large majority of targeted intrusions the agency was seeing. They were made mandatory for Australian government agencies from April 2013.

The Top 4 worked, but they were narrow. They were strong on stopping the initial compromise but light on what happens after — recovery, credential theft, the human layer. So in February 2017, the ASD expanded the Top 4 into the Essential Eight: the original four, plus four more (multi-factor authentication, restricting Microsoft Office macros, application hardening, and regular backups). A companion Maturity Model followed in June 2017 to answer the obvious next question — "we've implemented it, but how well?"

Two framing points that matter for the rest of this story. First, the Essential Eight was always meant to be a baseline — the essential minimum — and sits as a subset within the broader "Strategies to Mitigate Cyber Security Incidents." It was never the ceiling; it was the floor. Second, it was designed very much around a particular world: Microsoft Windows environments, corporate networks, and the malware-and-intrusion threats of the early-to-mid 2010s. Hold that thought, because it's central to why it's now being replaced.

Part 2 — What the Essential Eight actually is

At its heart the Essential Eight is eight mitigation strategies, and they group cleanly into three jobs.

Stop malware getting in and running:

Application control — only approved software is allowed to execute; everything else is blocked by default.
Patch applications — keep apps like browsers, PDF readers and Office current, and patch the dangerous ones fast.
Configure Microsoft Office macro settings — block macros from the internet and only allow vetted ones, because macros have long been a favourite malware delivery route.
User application hardening — strip out the exploitable bits: block ads and untrusted content in browsers, disable legacy features like Flash and Java.

Limit the damage if they do get in:

Restrict administrative privileges — admin rights only for those who genuinely need them, reviewed regularly, and never used for everyday work like email and browsing.
Patch operating systems — keep Windows and servers current, and retire anything out of support.
Multi-factor authentication — a second factor beyond the password, especially for remote access, email and privileged accounts.
Regular backups — backed up, retained, and actually tested for restore, kept somewhere an attacker who owns your network can't reach and destroy them.

Sitting over the top is the Maturity Model, which scores each of the eight from Level 0 to Level 3:

Level 0 — significant weaknesses; gaps an attacker can walk straight through.
Level 1 — protects against common, opportunistic attackers using off-the-shelf tools and known exploits.
Level 2 — protects against attackers willing to invest more time and tailor their approach to you.
Level 3 — protects against adaptive, well-resourced adversaries who'll adapt when they hit resistance.

The model's guiding principle is that you lift all eight together to your target level rather than maxing one and neglecting another — a chain is only as strong as its weakest link.

The framework wasn't frozen in time. Its most substantial refresh came in November 2023, and the changes were telling: critical vulnerabilities flagged by vendors now needed patching within 48 hours; internet-facing applications within two weeks with weekly scanning; weak forms of MFA were ruled out in favour of requiring "something you have" alongside "something you know" (a push towards phishing-resistant MFA); centralised event logging and annual application-control reviews were pulled down from Level 3 to Level 2, raising the bar for what "moderately mature" even meant. In other words, the ASD kept ratcheting the standard up to keep pace with attackers. That matters, because even with that effort, the compliance numbers tell an uncomfortable story.

Part 3 — How effective has it been, really?

Here's where honesty is required, because the Essential Eight has been genuinely influential and quietly disappointing at the same time, and both things are true.

On the positive side, the underlying strategies are sound. They're evidence-based, they target the techniques attackers actually use, and an organisation that genuinely hits Maturity Level 1 or 2 across all eight is meaningfully harder to compromise than one that hasn't. As a shared language, the Essential Eight has been a huge win — it gave Australian businesses, insurers, auditors and government a common reference point where before there was a fog of competing frameworks.

The problem is implementation, and the evidence for that comes from the Australian National Audit Office (ANAO), which has audited federal cyber posture repeatedly. The Essential Eight was mandated for non-corporate Commonwealth entities under Protective Security Policy Framework Policy 10 from 1 July 2022 — so these are organisations required to comply, with the resources of the federal government behind them. And still:

ANAO has repeatedly found "ongoing low levels of cyber resilience" and high rates of non-compliance.
In one review of 18 entities, only one achieved a managing maturity level across all eight controls, and roughly 76% reported not fully implementing the Policy 10 requirements.
Successive audits found compliance wasn't improving over time — the same gaps kept reappearing year after year.
Even flagship institutions haven't been immune: the Department of Parliamentary Services was found to have only "partly effective" cyber security, falling short on seven of the eight controls despite being obliged for years to hit Maturity Level Two.

Perhaps most striking: the proportion of government entities reaching overall Maturity Level 2 actually dropped after the 2023 tightening — down to around 22% in 2025 from 25% in 2023. Not because they got worse, but because the bar moved and most couldn't keep up.

So why the gap between a good framework and poor outcomes? A few reasons that critics have consistently raised:

It's hard and expensive. Many controls — full application control especially — are heavy lifts that assume in-house IT capability small and mid-sized organisations simply don't have.
It's a static ladder in a moving world. Compliance became a point-in-time box-ticking exercise, when real security is continuous.
It's narrow. Built around traditional Windows networks, it doesn't map neatly onto how organisations now run — cloud, SaaS, microservices, mobile, and increasingly AI.

None of this makes the Essential Eight a failure. It makes it a product of its time that's now showing its age. Which brings us to what changed.

Part 4 — The turning point: AI rewrites the threat

If there's a single catalyst behind the timing of all this, it's artificial intelligence.

In June 2026, the Five Eyes cyber security agencies — the intelligence partnership of Australia, the US, UK, Canada and New Zealand — issued a rare joint statement with an unusually direct message: AI models capable of launching serious cyberattacks that could overwhelm the defences of governments and businesses are "months, not years" away, and leaders should "act now."

The concern is twofold. Offensively, generative AI lowers the barrier to entry for attackers and dramatically increases the speed and complexity of attacks — reconnaissance, exploit development, phishing and lateral movement that used to take skilled humans days can be compressed and scaled. Defensively, the agencies argued, organisations that fold AI into their security operations can find vulnerabilities earlier, monitor for unusual behaviour and respond faster — but only if they move.

The strategic problem this creates for a framework like the Essential Eight is fatal to its current form: if attack windows are shrinking to hours and the threat mutates monthly, a static compliance ladder revised every few years cannot keep up. You can be fully "compliant" against last year's checklist and still be wide open to this month's AI-accelerated technique. That's the gap the ASD is now trying to close.

Part 5 — The new proposal: the Essentials series

On 15 June 2026, the ASD and the ACSC opened consultation on the successor. The Essential Eight will evolve into a new "Essentials" series, with the current framework becoming the first chapter — "Essentials for Enterprise IT" — and further chapters to follow for areas like operational technology (OT). The existing Essential Eight will be retired within roughly two years.

The philosophical shift is the whole point. The ASD describes the Essentials series as offering "prioritised, threat-informed mitigations for contemporary technology environments, supported by practical tools and clear implementation guidance." Unpack that and it's a move from a static compliance ladder to a threat-informed, risk-prioritised, principles-based model. Instead of "climb these eight rungs and tick the boxes," the guiding question becomes "what adversary techniques are you actually facing, and where does your effort reduce the most risk?"

The framework is built on four core principles:

Flexibility — outcomes-focused guidance rather than one rigid set of prescriptive controls, so organisations already using other frameworks aren't forced to start over.
Threat-informed design — grounded in the ASD's own incident-response and uplift experience, so it reflects real adversary behaviour, including AI-enabled attacks.
Prioritisation and risk management — a risk-based approach so organisations focus effort where it has the biggest early impact and get more from their security spend.
Compatibility and future focus — designed to evolve. The ASD can add new guidance and services over time as the threat environment shifts, without a full redesign each cycle or a new regulatory shock.

A few practical reassurances came with the announcement. It's explicitly cost-conscious and not a rip-and-replace — existing Essential Eight tooling and investment "naturally maps into" the new framework, and organisations already doing the work will find it carries across. It stays linked to the Information Security Manual (ISM) to keep consistency for government entities, while deliberately moving away from relying only on prescriptive ISM-derived controls.

Consultation is open now via the ASD Cyber Security Partnership Program portal and runs until 12 July 2026 — genuinely worth engaging with if you run or advise on Australian IT, because the feedback from industry is meant to shape what the series becomes.

Part 6 — Who are the key players?

Understanding the landscape means knowing who's driving it:

The Australian Signals Directorate (ASD) — the federal intelligence and cyber agency that owns the framework. Formerly the Defence Signals Directorate; the same lineage that produced the original 35 strategies back in 2010.
The Australian Cyber Security Centre (ACSC) — the ASD's public-facing cyber arm (the cyber.gov.au people), responsible for guidance, alerts and partnership with industry. Stephanie Crowe, the ACSC's head, has been the public voice of the change, framing it as: "to defend against modern threats with modern tools, our guidance must evolve as well."
Jayden Cooke — the ASD technical expert who's articulated the principles-based design and the reasoning behind moving off purely prescriptive controls.
The Australian National Audit Office (ANAO) — not a designer of the framework, but arguably the most important scorekeeper. Its audits are the hard evidence of how compliance has really tracked, and a big part of why change was needed.
The Five Eyes cyber agencies — the international backdrop. Their June 2026 AI warning set the urgency and reflects that this isn't a uniquely Australian rethink; allied nations are grappling with the same shift.
The Information Security Manual (ISM) — the ASD's larger, detailed controls catalogue that the Essential Eight and now the Essentials series connect back to.
Industry voices — vendors and CISOs have broadly welcomed the move. Fortinet's chief information security officer Cornelius Mare called the Essentials series "a welcome update," arguing the old Essential Eight was a "mismatch" against a 2026 threat environment and represented poor return on investment for smaller businesses that could never realistically match the controls designed for large enterprises.

That last point is worth sitting with. Even the framework's supporters concede it asked too much of smaller organisations. Which is exactly the space most Australian businesses — and most of the clients we work with — actually live in.

Part 7 — Reading the tea leaves

Strip away the announcements and the direction of travel is clear, and it's the right one:

Security is moving from a checklist you pass to a posture you maintain. The future isn't "did you tick the eight boxes in your annual audit?" It's "do you understand the threats you face, are you prioritising the right mitigations, and are you reviewing that continuously as things change?" That's a healthier model. It's also a harder one to fake, and a harder one to do without a deliberate system behind it.

For businesses, three takeaways:

Don't down tools on the Essential Eight. It's still the live standard, it's still good practice, and the ASD has explicitly designed the transition so your current work carries forward. Keep going.
Start thinking in terms of risk, not compliance. The organisations that will adapt fastest are the ones already asking "where's our actual exposure?" rather than "what's the minimum to pass?"
Expect security to be continuous. AI has closed the gap between "a new technique exists" and "it's being used against you." Point-in-time assessments once a year won't cut it.

Part 8 — What The Techy Side is doing about it

This is the part I care most about, because seeing the shift coming is one thing — doing something useful with it for the businesses I look after is another.

I've been building an approach that treats security and IT strategy the way the ASD is now signalling everyone should: proactive, threat-informed, continuous, and prioritised by real risk — not an annual box-ticking scramble.

Concretely, that means giving each client a single, living view of where they actually stand. One place that brings together three things that are usually scattered or missing entirely:

A score — a clear, honest read of their security posture and IT health, anchored today on the Essential Eight but built as a threat-informed model, so it survives the shift to the Essentials series rather than needing to be torn up in two years. Something they can watch improve over time, quarter on quarter.
A roadmap — where they're heading. The gaps, the risks, the renewals, the upgrades, prioritised by impact, reviewed on a regular cadence rather than sitting in a document nobody opens. Real forward planning for their IT, the way a CIO would run it.
Their configuration and systems — the factual picture of what they actually have, so the score is grounded in reality and the roadmap points at real systems.

The whole idea is to get ahead of the client's risk instead of reacting to it — to know where the gaps are before they become incidents, and to have a plan that adapts as the standards and the threats move. The Essentials series is, in effect, the government endorsing exactly this way of thinking: know your threats, prioritise by risk, review continuously. I'd rather my clients were already living there when the new framework lands than scrambling to catch up to it.

If you run a business and any of this resonates — whether you're staring down an Essential Eight obligation, wondering what the Essentials shift means for you, or you simply don't have a clear picture of where your IT actually stands — reach out. I'm happy to talk it through, no sales pitch required.

The writing's on the wall. Better to read it early.