Digital Pulse | October 2026: AI agents get to work, cyber costs climb and new privacy rules arrive in December

Three things happened in October that business leaders should know about. Major software vendors began moving AI agents out of pilots and into everyday sales and service tools. The Australian Signals Directorate (ASD) published a clearer picture of the cyber threats Australian organisations face. And the privacy regulator confirmed what businesses must disclose about automated decision-making before new rules start on 10 December 2026. Below is what changed and what to do about it.

1. AI agents: from assistants to autonomous workers

AI agents can now carry out tasks themselves, not just suggest them. On 8 October, Microsoft released its Sales Development Agent in public preview. It researches prospects, personalises outreach, manages follow-up conversations and hands qualified opportunities to sellers. It works from its own Exchange email account and connects to CRM platforms (Microsoft). On 15 October, Agent Accounts in Copilot Studio entered private preview. It is designed to run agents for recurring business processes, with permissions, triggers and governance controls (Microsoft Partner Center).

Pricing is also changing. From 1 December 2026, usage-based billing will be switched on by default for new Microsoft 365 Copilot Business licences bought through Microsoft's Cloud Solution Provider (CSP) program. The default limit will be 4,000 Copilot Credits per user per month, which administrators can adjust. Microsoft says the change will not be available in Australia at first (Microsoft Partner Center).

Security agencies are urging caution. In May, ASD's Australian Cyber Security Centre (ACSC) and its Five Eyes partners published Careful adoption of agentic AI services. It advises organisations to assume agentic systems "may behave unexpectedly" and to "deploy agentic AI incrementally, beginning with clearly defined low-risk tasks". It also warns against giving agents broader permissions than they need (The Register).

What it means for your business: Agents that send emails, update records or start workflows carry different risks from chat assistants. They act in your name, use your systems and may cost money every time they run.

Takeaways:

• Start with one low-risk, clearly defined process, and widen the agent's scope only once you've checked how it behaves.
• Give each agent the minimum access it needs. Keep it away from sensitive data and critical systems at first.
• Require a person to approve any action that can't easily be reversed.
• Before you scale up, understand how each agent is billed and set spending limits.
• Note that several of these tools are still in preview. Features, pricing and availability may change.

2. Cybersecurity: costs are rising, but the basics still matter most

ASD's Annual Cyber Threat Report 2025–26 was released on 27 October. As reported by the Australian Cyber Security Magazine, it shows the following:

• ASD's ACSC responded to more than 1,500 cyber security incidents, an increase of more than 20%.
• The average self-reported cost of a cybercrime to a business was $93,500 per report, up 16%.
• Medium-sized businesses were hit hardest, with an average cost of $141,300 per report, up 45%. Small businesses averaged $55,400.
• There were 139 ransomware incidents, broadly in line with the previous year.
• The report says AI is lowering the technical barriers to cybercrime.

The report notes that year-on-year changes reflect changes in reporting and detection, as well as changes in malicious activity.

ASD has also launched ASD Essentials, which replaces the Essential Eight, first released in 2017. Instead of a fixed checklist of technical controls, the new framework sets security outcomes and lets organisations decide how to reach them. It is designed mainly for government, critical infrastructure and large businesses. For smaller organisations, ASD's Small Business Cyber Security Handbook puts multi-factor authentication, prompt updates, regular backups and staff training first (Information Age).

What it means for your business: Attackers are using AI to work faster and more convincingly, but most losses still come from weak spots that are well known and fixable.

Takeaways:

• Turn on multi-factor authentication, or passkeys where available, for email, finance and admin accounts.
• Patch quickly, keep tested offline backups and make sure staff know how to report suspicious activity.
• If you are a larger organisation aligned to the Essential Eight, review ASD Essentials and plan your transition.
• Treat AI agents and their connected tools as part of your attack surface, and include them in security reviews.

3. Responsible AI: automated decision rules start on 10 December

On 30 September, the Office of the Australian Information Commissioner (OAIC) released new resources on the automated decision-making transparency obligation. The obligation was introduced by the Privacy and Other Legislation Amendment Act 2024 and commences on 10 December 2026 (OAIC).

It applies when an organisation uses a computer program, such as an AI system, to make a decision, or to "do a thing that is substantially and directly related to making a decision". The decision must be one that could significantly affect a person's rights or interests, and the program must use their personal information. In those cases, the privacy policy must disclose:

• the kinds of personal information the program uses
• the kinds of decisions made solely by the program
• the kinds of decisions where the program carries out a related step

(OAIC; Allens)

The obligation is not limited to fully automated decisions. A tool that only screens, scores or ranks people may still be in scope.

For broader governance, the National AI Centre's Guidance for AI Adoption, published in October 2025, remains the government's main voluntary reference. It recommends naming an accountable owner for each AI system, keeping an AI register (including AI built into other software) and matching human oversight to the system's level of autonomy and risk (Dynamic Business).

What it means for your business: Many organisations use AI or automated scoring in lending, hiring, pricing, eligibility or customer service without having documented it.

Takeaways:

• List every system, including vendor tools, that makes or materially supports decisions about individuals.
• Update your privacy policy before 10 December, and get legal advice if you're unsure what is in scope.
• Start an AI register and give each system a named owner.
• Tell customers when AI influences decisions that affect them.

Final thought

This month's developments share one message: AI is now acting on behalf of businesses, and regulators, security agencies and attackers have all noticed. The organisations that do best won't necessarily adopt AI first. They will know where their AI runs, what it can access, what it costs and who is accountable for it.

Published by Corporality Media | Digital Pulse | October 2026