Federal Budget 2026: The state of cyber security spending for the coming year

Treasurer Jim Chalmers’ speech does not mention cyber at all.

There is one mention of cyber security in the Budget 2026-27 overview, and that is only in reference to an example of tax cuts, where the worker in question happens to be a cyber security professional.

To find the details in this budget, we need to dig deeper. A lot deeper.

Budget Strategy & Outlook - Budget Paper No.1

Cyber security uplift makes an appearance on page 41 of Budget Paper No.1, the first of four times it can be found in the document upon a cursory search.

This is under the heading of ‘Strengthening government service delivery, where the government said it is putting aside a “$2.2 billion investment to improve the way Services Australia
delivers services to the Australian community,” which, among other things, will include efforts at cyber security uplift for the agency.

VIEW ALL

Then, all the way down on page 91, the government talks about managing what it calls “unavoidable issues”.

“The Government has provided $14.0 billion over five years to 2029–30 for unavoidable
policy decisions in this budget update,” the government said.

“Investments in these critical areas support the delivery of essential services and prevent cuts to services Australians rely on, and address urgent and unforeseen issues.”

Perhaps unsurprisingly, in this case, the cyber security element is in terms of service delivery in Services Australia centres, and securing the agency’s CIT systems.

We learn more on page 91, where the government outlines ‘Payment policy decisions over the forward estimates,’ and – again – securing Services Australia centres and their systems. Cyber security uplift, among other enhancements, is expected to “increase payments by $2.1 billion over the five years to 2029–30.”

Finally, on page 227, we learn that the “defence function” will consume 6.2 per cent of total expenses, which will include not only military operations, but also “national defence, through strategic policy advice and the delivery of capabilities to achieve an integrated and focused force, harnessing effects across the maritime, land, air, space, and cyber domains”.

And for Budget Paper No.1… That’s it, though that is hardly surprising.

Budget Measures - Budget Paper No.2

There’s a bit more meat here, but it’s worth remembering that the government has already revealed Project REDSPICE and the nation’s Australian Cyber security Strategy. Since those announcements, Canberra has been in station-keeping mode, managing spending around frameworks that have already been announced.

Here, we learn more about the spending securing Services Australia, which is expected to be “$160.4 million over four years from 2025–26” – probably a solid investment.

ICT governance spending for the Aged Care Quality and Safety Commission – which includes “cyber security capacity” – will also get a $33.7 million boost over the next year.

The main course, however, comes down on page 113 of the second set of papers, where we spend half a page on Horizon 2 of the 2023–30 Australian Cyber Security Strategy.

“The Government will provide $89.3 million over four years from 2026–27 to sustain and
enhance cyber security initiatives,” the government said.

“The Department of Home Affairs will partially meet the cost of this measure from within
existing resources.

“This measure builds on the 2023–24 MYEFO measure titled 2023–30 Australian Cyber
Security Strategy.”

Agency Resourcing - Budget Paper No. 4

We’re skipping Budget Paper No.3, Federal Financial Relations, as cyber doesn’t even make the cut, but in the fourth paper, we learn some more.

Though still nothing truly momentous, which, again, it should be said, is hardly surprising. As far as the government is concerned, it’s already done much of the heavy policy lifting.

Nearly every time an Australian politician opens their collective mouths right now we hear some version of “times are bad, don’t be surprised if they stay bad,” and this budget is no surprise.

“Australia faces an uncertain strategic and security environment,” this paper says.

“Geopolitical tensions, transnational crime, and cyber threats pose risks to Australia’s security and economic interests.”

This is on page 13, and we don’t hear about cyber security again until more than one hundred and seventy pages later… in the Appendix, where Agency Outcome Statements are listed.

Here we discover that the Australian Signals Directorate is still expected to do its job, as is the Department of Home Affairs.

The Cyber Daily view

This is a budget that will likely not leave many industry observers all that pleased, but as we have intimated, the broad strategies to keep Australia safe – and the attendant spending commitments – have already been outlined in depth and length.

Unfortunately, for the time being at least, the nature of the threat environment Australia faces – both criminal and geopolitically driven – requires a reactive stance informed by a broad policy that has been laid down and is now being iterated upon by stakeholders both public and private.

It could easily be said that, in cyber security terms at least, this is almost a “nothing to see here” set of documents, but that would, we believe, be somewhat of a disservice to what the government is attempting to achieve with this budget.

Big ticket items such as defence spending, cost of living, and tax reform are the highlights.

Cyber security remains a work in progress.

You can find the full set of budget documents here.