This was also a period in which new and serious concerns joined the list of existing cyber threats. Chief among these was the protection of Australia’s COVID-19 vaccine supply, including distribution processes, from malicious cyber actors. State and criminal cyber actors alike possess the capability to disrupt Australia’s critical infrastructure – including vaccine supply and distribution chains – with the pandemic only amplifying the opportunities for these actors to cause Australia harm. Even in the absence of direct and intentional targeting, there remains the potential for malicious cyber actors to inadvertently disrupt vaccine supply and distribution chains, making the threat more difficult to address. What does the future hold? As we develop new ways of using technology in our lives and businesses, Australia will continue to experience significant cyber threats. Networks will grow in complexity and become more difficult to defend – fuelled in part by the rapid spread of the Internet of Things. At the same time, malicious cyber actors will continue to capitalise on old but effective methods to compromise victims, while also embracing new technologies to modernise and industrialise their operations, including the use of automated tools and techniques to exploit large numbers of victims. The headlining global cyber security events of 2020 and 2021 – such as the SolarWinds Orion supply chain compromises, the exploitation of on-premises Microsoft Exchange server vulnerabilities and the volley of large-scale ransomware attacks – are now the new norm. Over the next 12 months, additional supply chain compromises will likely come to light, major vulnerabilities will continue to emerge and Australia will experience more major financially motivated cyber incidents, some of which could disrupt critical services. Despite the headlines, many of the compromises experienced by Australians will continue to be fuelled by a lack of adequate cyber hygiene. This delivers a significant advantage to adversaries and lowers the technical barrier to targeting victims in Australia, highlighting the need to uplift cyber security maturity across the Australian economy. Given the prevalence of malicious cyber actors targeting Australian networks – which is often under-reported to the ACSC – there is a strong need for greater resilience, and for Australian organisations and individuals to prepare to respond to and recover from any cyber attack to their networks. 24