ASD’s seventh Annual Cyber Threat Report puts the average self-reported cybercrime cost for a medium business at $141,300, up 45%. Here are the five numbers worth taking to your board, what the report says about AI, and a one-page action list you can start this month.
TL;DR
- The report says cyber risk for Australian businesses grew in 2025-26 mainly because AI is making familiar attacks faster and more convincing. ASD says AI hasn’t introduced new threats, so most of the fixes are the basics, done faster.
- ASD’s ACSC received over 82,000 cybercrime reports (one every 6 minutes) and responded to over 1,500 incidents, up 20%.
- The average self-reported cost per cybercrime report was $55,400 for a small business, $141,300 for a medium business (up 45%) and $148,100 for a large business.
- Phishing was the most common attack technique ASD saw (39% of the incidents it analysed), and ASD warns that the gap between a patch being released and attackers using the flaw is now days, sometimes hours.
- ASD’s five priority actions are legacy technology, event logging, supply chain, post-quantum cryptography and AI-enabled threats. Below is a one-page list that turns them into tasks for a 5 to 200 person organisation.
What is the Annual Cyber Threat Report?
The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) publishes a threat report each year covering the financial year just ended. The 2025-26 edition is the seventh. ASD’s news item announcing it is dated 27 October 2026, and the full report, three factsheets and section pages are on cyber.gov.au.
The report draws on two separate datasets, and it helps to keep them apart when you read the numbers:
- Cybercrime reports made to police through ReportCyber. These are self-reported by individuals and businesses, including the cost figures.
- Cyber security incidents that ASD’s ACSC itself responded to. Government entities report the most incidents here, partly because they have extra reporting obligations.
ASD’s own notes say the statistics are "a guide" and won’t reflect every threat, and that it’s likely most cybercrime goes unreported. So treat the cost averages as a floor and a trend, not a quote for what an incident would cost you.
Five numbers for your board
If you have five minutes at the next board or management meeting, these are the figures that carry the most meaning for an Australian business. Each is quoted exactly from the report.
| # | Number | What the report says | Why your board should care |
|---|---|---|---|
| 1 | $141,300 | Average self-reported cost of cybercrime per report for a medium business, up 45%. Small business: $55,400 (consistent with last year). Large business: $148,100 (down 27%). All businesses: $93,500, up 16%. | The jump is in the middle. A medium business now reports an average loss close to that of a large one, without a large business’s security budget. |
| 2 | 1 every 6 minutes | Over 82,000 cybercrime reports to ReportCyber in 2025-26. | It’s routine, not rare. ASD also says most cybercrime is likely unreported. |
| 3 | 1,500+ incidents, up 20% | ASD’s ACSC responded to more than 1,500 incidents, a 36% rise over five years. It also notified organisations of possible malicious activity more than 4,400 times, almost 80% more than the year before, and 362 incidents were identified after those notifications. | ASD sometimes sees a compromise before the victim does. Someone in your organisation needs to be reachable and know what to do when that call or email comes. |
| 4 | 39% | Phishing was the most prevalent attack technique in the incidents ASD analysed (39%) and the most observed way in. Next came compromising accounts (21%), user execution, such as a person opening a malicious file (17%), and use of valid accounts (15%). | Most attacks start with a person and a password, not a clever exploit. Sign-in security and staff awareness are board-level controls. |
| 5 | Days, sometimes hours | ASD has previously observed most vulnerability exploitation within two weeks, some within 48 hours of a patch or advice being released, and expects AI to compress this further. Publicly reported vulnerabilities (CVEs) rose 30%. | A patching process that runs "when we get to it" is no longer enough. Internet-facing systems need patching measured in days. |
A note on number 1: ASD publishes these as averages per report, by business size, based on what victims tell ReportCyber. They’re not the cost of a breach and they don’t include every downstream cost, such as lost work or customer churn.
Two more figures worth having in your back pocket: ASD responded to 139 ransomware incidents (consistent with last year), and 98 incidents were data breaches, up 66%.
What does the report say about AI?
AI is the headline of this year’s report. ASD’s language is direct: AI "has been the defining force" in the threat environment over the past year. The more useful line for a business owner is this one: "AI capabilities have not introduced new cyber threats, but they have amplified and sped up existing ones."
In practice the report describes three effects.
Phishing that reads properly. Attackers use AI to write emails free of spelling and grammar errors and to automate targeted spear-phishing. The report also describes AI being used to research staff from public information and to generate convincing messages, images and voice recordings. The old advice to "look for typos" no longer works.
Faster exploitation. AI reduces the skill and effort needed to find and exploit vulnerabilities, including chaining several weaknesses together. That is what drives the shrinking patch window in number 5.
New risks from your own AI tools. As organisations connect AI and large language models to their systems, the report says new exploitable risks are emerging, and it notes "the unintended actions of AI agents". ASD’s advice for businesses using AI includes least-privilege access, limiting the data AI systems can reach, checking outputs before use and keeping AI-assisted actions auditable.
The report also sees AI as a defensive tool, for finding vulnerabilities early, monitoring for unusual behaviour and speeding up incident response, used with the same controls.
What does it say about critical infrastructure?
Critical infrastructure (CI) incidents were 10% of all incidents ASD responded to: 154 in total, almost 7% fewer than the year before. The top ways in were phishing (36%), valid accounts (16%) and drive-by compromise (10%). Financial and insurance services (30%), public administration and safety (21%) and electricity, gas, water and waste services (17%) were the most affected sectors.
The critical infrastructure factsheet adds one action you won’t see elsewhere: CI entities should prepare for the capability to isolate and operate critical systems and networks for 3 months.
If you aren’t a CI operator but supply one, expect these expectations to flow down to you through contracts and security questionnaires. The report says plainly that a supplier’s cyber risks "are also your risks".
What does ASD want organisations to do?
The report repeats the five actions behind ASD’s 2026 "Cyber Action Year" and asks organisations to adopt an "assumed breach" mindset:
- Replace or mitigate legacy technology.
- Implement best-practice event logging.
- Manage supply chains, including choosing products and services that are secure by design.
- Prepare for post-quantum cryptography (ASD recommends stopping the use of traditional asymmetric cryptography by the end of 2030, or sooner).
- Prepare for AI-enabled cyber threats.
It also gives advice by size. Small businesses should choose products that are secure by design out of the box, turn on automatic updates and make someone clearly responsible for security monitoring and incident response. Medium businesses should keep an inventory of internet-facing systems, patch promptly, segment their networks and test their incident response and business continuity plans. Everyone should keep only necessary systems exposed to the internet.
Finally, the report covers ASD’s new Essentials series, released in October 2026 with chapters for enterprise IT, operational technology and cloud. ASD describes it as the evolution of the Essential Eight, and says work already done against the old maturity model carries forward. We’ve written more on our ASD Essentials readiness page.
ASD Essentials readiness check
Answer 25 questions about your organisation. Each one is based on an action in ASD Essentials for enterprise IT, written in plain English for a small organisation. Answer Yes if it is fully in place and you could show evidence, Partly if it is in place but with gaps, and No if it is not in place or you are unsure.
Indicative only. General information, not legal advice or a formal assessment. Your answers stay in your browser: nothing is sent or saved.
Your indicative results
| Area | Score | Lowest answer |
|---|
Score: Yes counts 2, Partly 1 and No 0, as a percentage of the answered questions. “Lowest answer” follows ASD’s approach, where a principle is only as effective as its weakest action.
Do these first
Ordered the way ASD recommends: boundary and identity services, governance and visibility first, then privileged environments and critical systems, then everyday business systems and devices. Within each step, No comes before Partly.
Your answers
Source: ASD, ASD Essentials (cyber.gov.au), including ASD Essentials for enterprise IT, published October 2026. ASD writes the Essentials mainly for larger organisations and says the outcomes are equally important for smaller ones. This check is not an ASD tool and does not replace ASD’s assessment process.
The one-page action list
This is the report turned into tasks for an organisation of roughly 5 to 200 people. Print it, assign an owner to each line and put a date beside it. Each item has a Check: so you know when it's done.
Accounts and sign-in (number 4 and the AI section)
- Turn on multi-factor authentication for every account that can sign in from the internet: email, Microsoft 365 or Google Workspace, VPN, accounting and payroll. Prefer phishing-resistant methods such as passkeys where your systems support them. Check: your admin portal's sign-in report shows no successful sign-ins without MFA in the last 30 days.
- Separate admin accounts from everyday accounts, and remove admin rights nobody uses. Check: you can list every admin account by name, and each one has a current owner.
- Write down how a password or MFA reset is verified, especially over the phone. The report's case study on the Scattered Spider group describes attackers calling help desks to learn and abuse the reset process. Check: your help desk or IT provider can tell you the verification steps without looking them up.
Patching and exposure (number 5)
- List everything you have that faces the internet: firewall, VPN, remote access, website, email gateway, any cloud servers. Check: the list matches what an external scan finds. If the scan finds something that isn't on the list, that's your first job.
- Agree a patch target for internet-facing systems measured in days, not months, and an emergency process for critical advisories. Check: pick the last critical advisory for a product you run and confirm the date it was patched.
- Find anything out of vendor support: old Windows Server versions, firewalls, NAS devices, routers. Check: each item has a replacement date or a documented compensating control.
Detection and response (number 3)
- Make sure logs from email, Microsoft 365, firewalls and servers are kept somewhere an attacker can't easily delete them, and that someone looks at alerts. Check: you could answer "who signed in to the finance mailbox last Tuesday, and from where?"
- Write a short incident response plan with names and phone numbers, and keep a printed copy. Check: run a 30-minute tabletop exercise: "ASD has just told us one of our accounts is compromised. What do we do?"
Suppliers and AI
- List the suppliers with access to your systems or data (IT provider, payroll, software vendors) and ask each how they would tell you about an incident. Check: every key supplier has a named security contact on file.
- Write down which AI tools staff may use and with what data. Check: staff can say which tools are approved, and AI tools connected to company data have only the access they need.
Reporting
- Save ASD's reporting details where your team can find them: cyber.gov.au/report and the Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371). Check: the details are in your incident response plan.
Not sure where you stand? Ask for a free security health check. We look at your setup and tell you, in plain English, what to fix first. Complimentary, at our discretion.
How to brief your board in ten minutes
Use the table above for the first five minutes. Then ask three questions and record the answers in the minutes:
- Which of the 11 actions above are done, and who owns the rest? This turns a threat report into a tracked plan.
- How quickly do we patch internet-facing systems today? If nobody knows, that's the answer.
- If ASD contacted us tomorrow about suspicious activity, who would take the call? The report shows ASD notified organisations more than 4,400 times last year.
If your organisation doesn't have the people to watch alerts, patch quickly and respond to notifications, that's the gap a managed security service is designed to fill. For an independent view of what an attacker can reach from the internet, see our guide to what happens in a penetration test.
Want someone watching for threats? Our managed security monitors and protects your endpoints, email and Microsoft 365, under a service level agreed with you in writing.
Key takeaways
- ASD's 2025-26 report recorded over 82,000 cybercrime reports and over 1,500 incidents, with incidents up 20%.
- Medium businesses saw the biggest change: an average self-reported cost of $141,300 per report, up 45%.
- AI has made existing attacks faster and more convincing rather than creating new ones, so the basics still work, but they need to happen faster.
- Phishing and stolen or misused accounts dominate the incidents ASD analysed, which makes MFA, admin separation and a verified reset process the first priorities.
- ASD's five actions (legacy technology, logging, supply chain, post-quantum cryptography, AI-enabled threats) apply to businesses of every size, scaled to fit.
- Use the one-page list above to give each action an owner and a Check: you can prove.
Sources
- ASD's ACSC, ASD releases seventh Annual Cyber Threat Report 2025-26 (news item, 27 October 2026)
- ASD's ACSC, Annual Cyber Threat Report 2025-26 (full report and section pages)
- ASD's ACSC, Annual Cyber Threat Report 2025-26 (PDF)
- ASD's ACSC, ACTR 2025-26 factsheet for businesses and organisations (PDF)
- ASD's ACSC, ACTR 2025-26 factsheet for critical infrastructure (PDF)
- ASD's ACSC, Report a cybercrime or cyber security incident
Want a second pair of eyes?
Catharsis Cyber Security is a Sydney cyber security company, certified to ISO/IEC 27001:2022. We help organisations protect, test and run their technology, and explain it in plain English.
