ASD's Annual Cyber Threat Report 2025–26 outlines threats facing Australian businesses

The Australian Signals Directorate (ASD) has released its Annual Cyber Threat Report 2025–26. A news story on business.gov.au, the Australian Government’s business information site, summarises what the report means for businesses.

According to that summary, ASD’s Australian Cyber Security Centre (ACSC) in 2025–26:

• received “more than 82,000 cybercrime reports, averaging one every 6 minutes”
• responded to “more than 1,500 cyber security incidents, representing a 20% increase on the previous year”
• recorded an average self-reported cost of cybercrime of $55,400 for small businesses, $141,300 for medium businesses (up 45%) and $148,100 for large businesses

The page says malicious cyber actors continue to target Australian businesses, that artificial intelligence is increasing the scale, speed and sophistication of attacks, and that cyber security is a business risk rather than only an IT issue. It also highlights supply chain and third-party risks.

Who it affects

Australian businesses and organisations of all sizes, including critical infrastructure entities.

What the ACSC encourages businesses to do

business.gov.au says the ACSC is strongly encouraging businesses to:

• replace legacy technology or reduce its risks
• put best-practice event logging in place
• choose products and services that are secure by design
• prepare for post-quantum cryptography and for AI-enabled threats

It adds that critical infrastructure entities should be prepared to isolate systems and networks for up to 3 months. Incidents can be reported through ReportCyber or by calling 1300 CYBER1 (1300 292 371).

Our small business first steps guide, Essential Eight explained and supplier security cover these topics, and how to report scams and cybercrime explains the reporting options.