We use cookies to give you a better experience on our website. Learn more about how we use cookies and how you can select your preferences.
Annual Cyber Threat Report 2025-26 outlines cyber threats facing Australian businesses
The Australian Signals Directorate's Australian Cyber Security Centre’s (ASD's ACSC) recently released its 2025-26 Annual Cyber Threat Report. They received more than 82,000 cybercrime reports, averaging one every 6 minutes. They also responded to more than 1,500 cyber security incidents, representing a 20% increase on the previous year.
The average self-reported cost of cybercrime was:
- $55,400 for small businesses
- $141,300 for medium businesses (up 45%)
- $148,100 for large businesses.
Cyber security is a business risk, not simply an IT issue. As organisations become increasingly interconnected, understanding and managing supply chain and third-party risks is critical to reducing exposure and strengthening resilience.
What businesses can do
ASD's ACSC is strongly encouraging businesses to take these steps to improve their cyber resilience:
- replace or mitigate risks with legacy technologies
- implement best practice event logging
- choose secure by design products and services
- prepare for post-quantum cryptography
- prepare for AI-enabled cyber threats
- critical infrastructure entities should be prepared to isolate systems and networks for up to 3 months.
If your organisation experiences a cyber incident or suspicious activity, report it through ReportCyber or call 1300 CYBER1 (1300 292 371).
Find out more
-
Read the Annual Cyber Threat report 2025-26.
Australian Signals Directorate -
Check out the ACTR Cyber Threat Factsheets.
Australian Signals Directorate -
Get cyber security advice on the ASD ACSC small business hub.
Australian Signals Directorate -
Get cyber security advice for larger businesses and critical infrastructure.
Australian Signals Directorate