The Australian Signals Directorate published its seventh Annual Cyber Threat Report on 26 October 2026, covering the 2025-26 financial year. For small and medium businesses, the message is that attacks are as frequent as ever and getting more expensive, especially for businesses in the middle.
The numbers that matter
- More than 82,000 cybercrime reports were made to the ASD’s Australian Cyber Security Centre, about one every six minutes.
- The ACSC responded to more than 1,500 cyber security incidents, an increase of more than 20%.
- It notified organisations of potential malicious activity more than 4,400 times, almost 80% more than the year before.
- The average self-reported cost per business report rose 16% to $93,500.
The cost depends on your size
- Small business: $55,400 per report, consistent with last year.
- Medium business: $141,300 per report, up 45%.
- Large business: $148,100 per report, down 27%.
Medium-sized businesses now report losses close to those of large organisations, usually without a security team of their own. They have enough data and money to be worth attacking, and fewer specialist defenders than big companies.
What is driving it
The ASD describes artificial intelligence as the defining force in the threat environment over the past year: it lets attackers work faster and at greater scale. Yet the compromises themselves still mostly come from well-known weaknesses, such as unpatched systems and social engineering, and from suppliers and supply chains that turn one breach into many.
The OAIC’s figures for January to June 2026 point the same way. Of 667 data breach notifications, 414 came from malicious or criminal attacks. Health service providers lodged the most, followed by education.
Attackers are faster than they were. The basics have not changed: the time you have to get them in place has.
Five things to do this month
- Turn on multi-factor sign-in everywhere, and use phishing-resistant methods such as passkeys or security keys for admins and finance staff.
- Patch faster. Critical fixes for internet-facing systems should be measured in days, not weeks.
- Keep an offline or immutable backup, and prove it by restoring from it.
- Make sure someone is watching your systems after hours, with the authority to act.
- Agree a call-back rule for any change of bank details, and list the suppliers who can reach your systems.
Want to know where you stand? Take our free cyber health check or book a free refinement.
Sources
- 1.Annual Cyber Threat Report 2025-26: year in review, Australian Signals Directorate
- 2.Annual Cyber Threat Report 2025-26 now available, Australian Signals Directorate
- 3.Annual Cyber Threat Report 2025-26 outlines cyber threats facing Australian businesses, business.gov.au
- 4.Large scale data breaches on the rise, latest OAIC statistics reveal, OAIC
