ASD’s seventh Annual Cyber Threat Report puts the average self-reported cybercrime cost for a medium business at $141,300, up 45%. Here are the five numbers worth taking to your board, what the report says about AI, and a one-page action list you can start this month.<\/p>\n\n\n\n
Related guides<\/strong><\/p>\n\n\n\n The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) publishes a threat report each year covering the financial year just ended. The 2025-26 edition is the seventh. ASD’s news item announcing it<\/a> is dated 27 October 2026, and the full report, three factsheets and section pages<\/a> are on cyber.gov.au.<\/p>\n\n\n\n The report draws on two separate datasets, and it helps to keep them apart when you read the numbers:<\/p>\n\n\n\n ASD’s own notes say the statistics are "a guide" and won’t reflect every threat, and that it’s likely most cybercrime goes unreported. So treat the cost averages as a floor and a trend, not a quote for what an incident would cost you.<\/p>\n\n\n\n If you have five minutes at the next board or management meeting, these are the figures that carry the most meaning for an Australian business. Each is quoted exactly from the report.<\/p>\n\n\n\n A note on number 1: ASD publishes these as averages per report, by business size, based on what victims tell ReportCyber. They’re not the cost of a breach and they don’t include every downstream cost, such as lost work or customer churn.<\/p>\n\n\n\n Two more figures worth having in your back pocket: ASD responded to 139 ransomware incidents (consistent with last year), and 98 incidents were data breaches, up 66%.<\/p>\n\n\n\n AI is the headline of this year’s report. ASD’s language is direct: AI "has been the defining force" in the threat environment over the past year. The more useful line for a business owner is this one: "AI capabilities have not introduced new cyber threats, but they have amplified and sped up existing ones."<\/p>\n\n\n\n In practice the report describes three effects.<\/p>\n\n\n\n Phishing that reads properly.<\/strong> Attackers use AI to write emails free of spelling and grammar errors and to automate targeted spear-phishing. The report also describes AI being used to research staff from public information and to generate convincing messages, images and voice recordings. The old advice to "look for typos" no longer works.<\/p>\n\n\n\n Faster exploitation.<\/strong> AI reduces the skill and effort needed to find and exploit vulnerabilities, including chaining several weaknesses together. That is what drives the shrinking patch window in number 5.<\/p>\n\n\n\n New risks from your own AI tools.<\/strong> As organisations connect AI and large language models to their systems, the report says new exploitable risks are emerging, and it notes "the unintended actions of AI agents". ASD’s advice for businesses using AI includes least-privilege access, limiting the data AI systems can reach, checking outputs before use and keeping AI-assisted actions auditable.<\/p>\n\n\n\n The report also sees AI as a defensive tool, for finding vulnerabilities early, monitoring for unusual behaviour and speeding up incident response, used with the same controls.<\/p>\n\n\n\n Critical infrastructure (CI) incidents were 10% of all incidents ASD responded to: 154 in total, almost 7% fewer than the year before. The top ways in were phishing (36%), valid accounts (16%) and drive-by compromise (10%). Financial and insurance services (30%), public administration and safety (21%) and electricity, gas, water and waste services (17%) were the most affected sectors.<\/p>\n\n\n\n The critical infrastructure factsheet<\/a> adds one action you won’t see elsewhere: CI entities should prepare for the capability to isolate and operate critical systems and networks for 3 months.<\/p>\n\n\n\n If you aren’t a CI operator but supply one, expect these expectations to flow down to you through contracts and security questionnaires. The report says plainly that a supplier’s cyber risks "are also your risks".<\/p>\n\n\n\n The report repeats the five actions behind ASD’s 2026 "Cyber Action Year" and asks organisations to adopt an "assumed breach" mindset:<\/p>\n\n\n\n It also gives advice by size. Small businesses should choose products that are secure by design out of the box, turn on automatic updates and make someone clearly responsible for security monitoring and incident response. Medium businesses should keep an inventory of internet-facing systems, patch promptly, segment their networks and test their incident response and business continuity plans. Everyone should keep only necessary systems exposed to the internet.<\/p>\n\n\n\n Finally, the report covers ASD’s new Essentials series, released in October 2026 with chapters for enterprise IT, operational technology and cloud. ASD describes it as the evolution of the Essential Eight, and says work already done against the old maturity model carries forward. We’ve written more on our ASD Essentials readiness<\/a> page.<\/p>\n\n\n\n\n\n
TL;DR<\/h3>\n\n\n\n
\n\n
In this post<\/h3>\n\n\n\n
\n\n
What is the Annual Cyber Threat Report?<\/h2>\n\n\n\n
\n\n
\n\n\n\nFive numbers for your board<\/h2>\n\n\n\n
\n\n
\n \n#<\/th>\n Number<\/th>\n What the report says<\/th>\n Why your board should care<\/th>\n<\/tr>\n<\/thead>\n \n 1<\/td>\n $141,300<\/strong><\/td>\n Average self-reported cost of cybercrime per report for a medium business<\/strong>, up 45%. Small business: $55,400 (consistent with last year). Large business: $148,100 (down 27%). All businesses: $93,500, up 16%.<\/td>\n The jump is in the middle. A medium business now reports an average loss close to that of a large one, without a large business’s security budget.<\/td>\n<\/tr>\n \n 2<\/td>\n 1 every 6 minutes<\/strong><\/td>\n Over 82,000 cybercrime reports to ReportCyber in 2025-26.<\/td>\n It’s routine, not rare. ASD also says most cybercrime is likely unreported.<\/td>\n<\/tr>\n \n 3<\/td>\n 1,500+ incidents, up 20%<\/strong><\/td>\n ASD’s ACSC responded to more than 1,500 incidents, a 36% rise over five years. It also notified organisations of possible malicious activity more than 4,400 times, almost 80% more than the year before, and 362 incidents were identified after those notifications.<\/td>\n ASD sometimes sees a compromise before the victim does. Someone in your organisation needs to be reachable and know what to do when that call or email comes.<\/td>\n<\/tr>\n \n 4<\/td>\n 39%<\/strong><\/td>\n Phishing was the most prevalent attack technique in the incidents ASD analysed (39%) and the most observed way in. Next came compromising accounts (21%), user execution, such as a person opening a malicious file (17%), and use of valid accounts (15%).<\/td>\n Most attacks start with a person and a password, not a clever exploit. Sign-in security and staff awareness are board-level controls.<\/td>\n<\/tr>\n \n 5<\/td>\n Days, sometimes hours<\/strong><\/td>\n ASD has previously observed most vulnerability exploitation within two weeks, some within 48 hours of a patch or advice being released, and expects AI to compress this further. Publicly reported vulnerabilities (CVEs) rose 30%.<\/td>\n A patching process that runs "when we get to it" is no longer enough. Internet-facing systems need patching measured in days.<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n
\n\n\n\nWhat does the report say about AI?<\/h2>\n\n\n\n
\n\n\n\nWhat does it say about critical infrastructure?<\/h2>\n\n\n\n
\n\n\n\nWhat does ASD want organisations to do?<\/h2>\n\n\n\n
\n\n