Cyber Security Act 2024: Ransomware Reporting and AI

Under the Cyber Security Act 2024, an organisation carrying on business in Australia with annual turnover above $3 million, or a responsible entity for a critical infrastructure asset, must report any ransomware or cyber extortion payment to the Australian Signals Directorate within 72 hours. AI helps by compressing the investigation behind that report. It never decides whether to pay.

What does the Cyber Security Act 2024 require on ransomware?

The Cyber Security Act 2024 is Australia's first standalone cyber security law. Its ransomware and cyber extortion payment reporting regime took effect on 30 May 2025. If your organisation makes a ransomware payment, or becomes aware one was made on its behalf, you have 72 hours to report it to the Australian Signals Directorate through the Australian Cyber Security Centre (ACSC).

Under the Cyber Security (Ransomware Reporting) Rules 2025, the obligation applies to entities carrying on business in Australia with annual turnover above $3 million in the previous financial year, plus responsible entities for critical infrastructure assets under the Security of Critical Infrastructure Act 2018. That captures almost every mid-sized organisation, and many have not updated their incident response plans to match.

The headline facts

• Reporting is triggered by a payment, not by the attack itself.
• You have 72 hours from making the payment, or from becoming aware a payment was made on your behalf.
• The turnover threshold is $3 million, set by the Cyber Security (Ransomware Reporting) Rules 2025.
• Reports go to the Australian Signals Directorate via the ACSC.
• There is no minimum payment value. A non-monetary benefit (data, services, goods) still counts.

How serious is the ransomware threat in Australia?

The ASD Annual Cyber Threat Report 2024-25 records that ASD's ACSC received more than 84,700 cybercrime reports through ReportCyber and responded to over 1,200 cyber security incidents, an 11% increase on the previous year. ASD described ransomware as one of the most disruptive cybercrime threats.

The same report found the average self-reported cost of cybercrime per report rose sharply for medium-sized organisations.

• ASD small category$56,600
• ASD medium category (up 55%)$97,200
• ASD large category$202,700

Those figures are the cost of incidents. On top sits the compliance exposure: a civil penalty of up to 60 penalty units for failing to report a payment within the window. The attack might be bad luck. Missing the 72-hour clock is a process failure.

Do you have to report a ransomware payment?

The obligation is narrower than the anxiety around it. If you never pay, the ransomware reporting duty does not apply, although other obligations may.

Work down from the top. Stop at the first answer that fits.

• Annual turnover under $3M and not critical infrastructureNo reporting duty under this regime
• Turnover above $3M, but no payment or benefit givenNo payment report needed (check breach duties)
• Turnover above $3M and a payment or benefit was madeReport to ASD within 72 hours
• Responsible entity for a critical infrastructure assetReport, plus SOCI Act obligations apply

The trap is "made on your behalf". If an incident response firm, managed security provider, insurer or parent company pays for you, the clock still runs for your organisation. Wire the obligation into contracts and your incident playbook, as well as finance approvals.

Why is the 72-hour clock an operations problem?

Lawyers can tell you what the form requires. They cannot tell you, at 2am on a Saturday, which systems were touched, what data left, and whether an outsourced IT provider has already authorised a payment. That is an operations and detection problem.

1. Hour 0DetectionEncryption or extortion demand surfaces. Often discovered by staff, not tooling.
2. Hours 0-12Triage and scopingIdentify affected systems, data exposure and whether SOCI or Privacy Act duties are also live.
3. Decision pointPay or do not payExecutive and legal decision. The payment is the event that starts the 72-hour reporting clock.
4. Within 72 hours of paymentReport to ASDSubmit the ransomware payment report through the ACSC channel.
5. Parallel trackOther notificationsAssess OAIC notifiable data breach duties and any sector regulator obligations separately.

The usual failure is "we could not assemble the facts in time because nobody could see across the environment", not a refusal to report. That is where AI earns its place, and where badly governed AI creates new exposure.

Where does AI help with ransomware reporting?

Used well, AI shortens the time between detection and a defensible understanding of what happened. Prevention is a separate problem with its own tools.

Detection and anomaly triage. Behavioural detection flags lateral movement, mass file changes and unusual data egress that often precede an extortion demand. The model learns normal and surfaces the abnormal for a person to judge, the same pattern covered in AI fraud detection.

Investigation acceleration. An AI investigation agent can correlate logs, endpoint telemetry, identity events and database access far faster than one analyst, then assemble a draft timeline of what was touched and when. We built RootCauseAI, our own investigation product, to do this inside the customer's environment so investigation data does not leave it. See also our write-up on an AI agent for IT support investigations.

Report drafting. Once facts are scoped, a constrained assistant can pre-fill the factual narrative for the ASD report and the separate OAIC assessment. People verify and approve.

	Manual only	AI-assisted, human-approved	Impact
Time to scope affected systems	Often days	Hours, where logs are centralised	Faster
Log correlation across sources	Manual, partial	Automated draft	Broader
Consistency of report facts	Analyst-dependent	Templated and checked	Higher
Human judgement on pay or report	Required	Still required	Unchanged

The last row matters most. AI does not decide whether to pay and does not file the report on its own authority.

Where does AI add risk during a cyber incident?

Three governance issues appear the moment you point AI at security telemetry.

Privacy. Security logs, identity records and forensic captures contain personal information. Feeding them into AI is a use governed by the Privacy Act 1988 and the Australian Privacy Principles. See Privacy Act compliance for AI.

Data residency. An incident is the worst time to discover your investigation tooling sends sensitive logs to a vendor cloud in another jurisdiction. Keeping investigation workloads on private AI infrastructure you control is often the safer posture.

Governance and human override. An AI agent with broad read access is itself an attack surface. Decision rights, audit trails and a kill switch are essential. Our AI agent governance guide sets out how.

AI inside a governed environment, with scoped access and human approval, is an asset under the 72-hour clock. An ungoverned agent with standing access to everything is a liability.

Which other reporting duties apply after a ransomware incident?

The ransomware payment report does not discharge your other obligations. These regimes have separate triggers and recipients.

1. 1Ransomware paymentReport to ASD within 72 hours of payment (Cyber Security Act 2024)
2. 2Data breachAssess OAIC notifiable data breach duties under the Privacy Act 1988
3. 3Critical infrastructureSOCI Act incident duties if you are a responsible entity
4. 4Sector rulesAPRA, ASIC or other regulator obligations where they apply

The OAIC notifiable data breaches scheme is triggered by likely serious harm from unauthorised access to personal information, whether or not anyone pays. The SOCI Act sets its own incident reporting timeframes for responsible entities. A healthcare or financial services organisation can be inside several regimes from one event.

The Act also includes a limited use provision that restricts how information shared with ASD and the National Cyber Security Coordinator during an incident can be used. It does not remove reporting duties and does not cover information given to other regulators.

What does the ASD ransomware payment report ask for?

The report covers your organisation and contact details, a description of the incident, the demand and who made it where known, the impact on your organisation, and details of the payment or benefit. The Australian Government's factsheet on ransomware payment reporting sets out the expected content.

That list demands a coherent account of what happened to which systems and what data was affected. If your environment is a patchwork of cloud apps, on-premise servers and unmanaged endpoints across several sites, assembling that inside 72 hours is hard. The form is easy. The investigation behind it is the work.

For a board, the useful reframe is that the law asks you to be able to know what happened to your own organisation quickly. That capability pays off whether or not you ever pay, because it shortens every incident and supports your privacy assessment and insurer discussions.

How do you build investigation capability without a large SOC?

Most mid-sized organisations cannot justify a 24/7 security operations centre and do not need one to comply. Three foundations get most of the way:

1. Centralised, retained logging. Identity events, endpoint telemetry and key application logs flow to one place and are kept long enough to reconstruct an incident.
2. A defined investigation runbook. Named steps, owners and decision points, so nobody invents the process under pressure.
3. Scoped, governed tooling that correlates fast. AI that drafts a timeline a person verifies, with least-privilege access and a clear answer to where the data goes.

What is a practical 30-day readiness plan?

1. Confirm scope. Check prior-year turnover against the $3 million threshold and whether you are a SOCI responsible entity. Tell the board.
2. Wire the 72-hour clock into your incident plan. Name who can authorise a payment, who owns the ASD report and what starts the clock. Extend this to contracts with providers, insurers and parent entities.
3. Decide your AI posture now. Choose whether investigation workloads run on infrastructure you control, scope access to least privilege and require human approval for pay and report decisions.
4. Rehearse. A 90-minute tabletop exercise that walks a simulated payment through detection, scoping, the decision, the ASD report and the OAIC assessment exposes more gaps than any policy.

For the wider control environment, see our AI governance framework and AI security checklist.

How Solve8 can help

Our consultants and engineers build centralised logging, investigation runbooks and AI-assisted investigation that runs on your infrastructure in Australia, with a person approving every decision. See our private AI infrastructure and managed AI services, or talk to us before you need it.