It's that time of the year again, time for The Australian Signals Directorate (ASD) to release its Annual Cyber Threat Report 2025-26! It covers the 2025-26 financial year and is the most reliable picture available of what is actually happening to Australian organisations.
This post pulls out what matters for small and medium businesses, and turns ASD's five priority actions into practical steps.
Key points
- ASD received more than 82,000 cybercrime reports in 2025-26, one every 6 minutes, and responded to more than 1,500 cyber security incidents, up more than 20%.
- The average self-reported cost of cybercrime per business report rose 16% to $93,500. Small businesses averaged $55,400 and medium businesses $141,300, up 45%.
- Health care and social assistance was the most frequently reporting sector outside government (7% of incidents), followed by professional, scientific and technical services (6%).
- Most incidents still start with well-known weaknesses: unpatched systems and social engineering.
- ASD asks every business to take five actions: replace or mitigate legacy technology, implement best-practice event logging, manage supply chains, prepare for post-quantum cryptography and prepare for AI-enabled threats.
The numbers that matter for SMEs
These figures come from ASD's Year in Review and its factsheet for businesses and organisations. Costs are self-reported by victims through ReportCyber, averaged per report.
| Measure | 2025-26 | Change on 2024-25 |
|---|---|---|
| Cybercrime reports to ASD | 82,000+ (one every 6 minutes) | Consistent |
| Cyber security incidents ASD responded to | 1,500+ | Up more than 20% |
| Notifications to organisations about potential malicious activity | 4,400+ | Up almost 80% |
| Ransomware incidents ASD responded to | 139 | Consistent |
| Average cost per business report | $93,500 | Up 16% |
| Small business | $55,400 | Consistent |
| Medium business | $141,300 | Up 45% |
| Large business | $148,100 | Down 27% |
Medium businesses now lose almost as much as large ones
The most striking change is the gap closing between medium and large businesses. A medium business now reports an average loss of $141,300 per cybercrime, against $148,100 for a large business. ASD doesn't explain the shift, but our view from the field is that medium businesses often run large-business complexity, with multiple sites, dozens of cloud applications and outside suppliers, without a dedicated security team watching it. That combination is expensive when something goes wrong.
Small business costs held steady, at a level most can't absorb
The small business average of $55,400 per report was consistent with last year. For a business with a handful of staff, that is still a serious hit, and it doesn't include the time spent rebuilding systems, dealing with clients and recovering lost work.
ASD is warning more businesses before they are hit
ASD sent more than 4,400 notifications about potential malicious activity, almost 80% more than the year before, and 362 of the incidents it responded to were found because of those warnings. If you receive a notification from ASD, or your IT provider passes one on, treat it as urgent.
The sectors reporting the most incidents
Government reported the most incidents (as it does every year) largely because of its additional reporting obligations.
Outside government, ASD's top reporting sectors were:
- Health care and social assistance: 7%, now the most frequently reporting non-government sector. This includes allied health, medical practices and aged care.
- Professional, scientific and technical services: 6%, which includes law, accounting, engineering and consulting firms.
- Financial and insurance services: 6%.
Manufacturing entered the top 10 for the first time with the largest increase of any sector, while transport dropped out.
Health care and professional services firms hold exactly what attackers want: sensitive personal information, client funds and trust relationships that make impersonation profitable. If you work in these sectors, see how we support healthcare and allied health practices, residential aged care providers and professional services firms, and make sure you have a tested cyber incident response plan.
How attackers are still getting in
ASD's summary is blunt: the threat environment "continues to be shaped by compromises from well known weaknesses such as unpatched systems and social engineering." Three details from the report stand out for SMEs:
- ASD recorded the successful exploitation of a vulnerability first identified in 2008. Old flaws in unpatched systems are still being used.
- Publicly reported vulnerabilities rose 30%, and ASD warns that AI is reducing the expertise and effort needed to find and exploit them. The window between a patch being released and attackers using the flaw is likely shrinking.
- User execution and social engineering techniques appeared across every incident category. People remain the most reliable way in.
Identity fraud remained the most reported cybercrime overall. ASD's first piece of advice for everyone is to turn on multi-factor authentication (MFA) or passkeys. If your business hasn't enforced MFA on every Microsoft 365 account, start there. Our identity and access management page explains what a properly configured setup looks like.
A warning for anyone who pays invoices by email
In December 2025, ASD identified a large business email compromise campaign impersonating Australian construction companies. It used more than 400 look-alike domains to send fraudulent emails asking for urgent payments, and ASD shared 423 confirmed malicious domains with its partners to block them (ASD, Programs chapter).
The important detail is that no email accounts were compromised. The attackers didn't need to break in. They registered domains that looked close enough to the real ones and relied on staff not noticing.
That has three practical consequences for any business:
- Verify payment changes by phone. Any request to change bank details or make an urgent payment should be confirmed using a phone number you already hold, never one in the email.
- Protect your own domain properly. SPF, DKIM and DMARC stop criminals sending email that claims to come from your exact domain. Our guides to email authentication basics and SPF, DKIM and DMARC in Microsoft 365 explain the setup, and why a DMARC policy of p=none leaves you exposed. You can check your email domain for free.
- Accept that DMARC doesn't stop look-alikes. A domain one letter different from yours passes its own authentication checks. Defending against it takes impersonation protection in your email filtering and staff who know what to look for. See our enhanced message filtering and cyber awareness training.
ASD's five actions, translated for SMEs
ASD's business factsheet lists five actions for businesses and organisations. Here is what each one means for a business without its own security team, and where to start.
1. Replace or mitigate legacy technology
Legacy technology is anything that no longer receives security updates. The 2008 vulnerability in this year's report shows how long an unpatched system stays exploitable. For many SMEs the list includes Windows 10 PCs, Office 2016 or 2019, and on-premises Exchange 2016 or 2019, all of which reached end of support on 14 October 2025. It also includes the consumer-grade router that came free with the internet service.
Where to start: list every device and application, note which are out of support, and either replace them or isolate them with a dated plan. Our posts on Microsoft end of support and free routers in business networks cover the two most common gaps.
2. Implement best-practice event logging
Event logs are the record of who signed in, from where, and what changed. Without them, you can't tell how an attacker got in or what they took. ASD's event logging guidance recommends a logging policy, central collection, protection from tampering, and active analysis. Its mitigations for network defence suggest keeping logs searchable for at least 12 months.
Two points SMEs often miss. First, many cloud services keep only a short audit history by default, and a longer history may depend on your licence. Second, operational monitoring (is the server up, is the backup running) and security logging (who did what, and is it suspicious) are different jobs. Ask your provider which one you have. Our system monitoring service covers the operational side, and central security logging is required for every strategy from Essential Eight Maturity Level Two.
3. Manage your supply chain and choose secure-by-design products
ASD notes that interconnected systems, third-party suppliers and supply chains make incidents "far more complex", because one compromise can spread to many organisations. For an SME, the supply chain is your software vendors, cloud platforms, accountants, payroll provider and, importantly, your IT provider.
ASD publishes questions to ask managed service providers: whether they implement the Essential Eight, how they secure their administration of your systems, whether they monitor activity, how often they assess for vulnerabilities, and whether they can respond to an incident. Ask them of every provider with access to your systems, including us. Our post on fake cyber security companies shows why vetting matters, and our Zero Trust and Secure by Design approach explains how we limit what any one supplier, account or device can reach.
4. Prepare for post-quantum cryptography
Future quantum computers are expected to break the encryption that protects today's email, banking and remote access. ASD's post-quantum planning guidance sets milestones: a refined transition plan by the end of 2026, the transition under way by the end of 2028, and completed by the end of 2030.
ASD's own small business handbook is clear that MFA, software updates, backups and access controls come first for most small businesses. For an SME, post-quantum readiness is mainly a purchasing question: will the products you buy over the next few years be upgraded by their vendors? ASD provides a list of post-quantum questions to ask your vendors. Build them into your technology refresh plan; a technology roadmap is the natural place to track them.
5. Prepare for AI-enabled cyber threats
ASD says AI is making attacks easier, faster and more convincing, from finding vulnerabilities in websites to writing phishing emails, fake invoices and cloned voices. Its guidance on AI-enabled attacks for small businesses recommends turning off websites you no longer need, switching on automatic updates for computers and phones, and naming the person or provider responsible for your website's security.
The other side is your own use of AI. ASD's AI guidance for small business asks businesses to set a policy on what information can be shared with AI tools, review AI vendors' data handling, and keep a person in charge of important decisions. Our posts on writing an AI staff policy and controlling AI data uploads show how to do this with tools you probably already pay for.
If you only do four things this quarter
- Enforce MFA (or better still, passkeys) on every account, starting with email and finance systems.
- Find and replace anything out of support, and turn on automatic updates everywhere else.
- Agree that all payment changes are always confirmed by phone, and tell your clients and suppliers you do this.
- Ask your IT provider ASD's five questions, and what security logs you would have if something went wrong tomorrow.
For a structured baseline, the Essential Eight is ASD's own prioritised set of controls, and SMB1001 certification gives smaller businesses a tiered way to reach it and prove it to clients and insurers. Our free SMB1001 readiness check takes a few minutes.
Report it, even if it seems small
ASD provides free incident response advice 24 hours a day. Report cybercrime and cyber security incidents at cyber.gov.au/report or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371). Reports feed the warnings ASD sends to other businesses, and this year those warnings uncovered 362 incidents.
Frequently Asked Questions
Talk to us about the report
Microsolve has been supporting Australian businesses since 1992. If you'd like to know how your business measures up against ASD's five actions, we can review your environment and give you a prioritised list of what to fix first. Explore our cyber security services, or contact our team to arrange a review.
