ASD Annual Cyber Threat Report 2025-26: What Australian Businesses Need to Know

The Annual Cyber Threat Report 2025-26 in one line: the Australian Signals Directorate (ASD) responded to 1,524 cyber security incidents in FY2025-26, up 20% on the previous year, while artificial intelligence (AI) shortened the time attackers need to find and exploit weaknesses. ASD’s answer is a short list of priorities, a new Essentials series that evolves the Essential Eight, and a plain instruction to patch faster.

ASD’s Australian Cyber Security Centre (ACSC) released the report on 26 October 2026, alongside factsheets for businesses, critical infrastructure (CI) operators and individuals. It covers 1 July 2025 to 30 June 2026 and draws on two datasets: cybercrime reported to law enforcement through ReportCyber, and the incidents ASD’s ACSC responded to directly.

This guide sets out the findings that matter to an Australian business, what changed from last year, and what to do about each one. For the previous edition, see our summary of the 2024-25 report.

Key Takeaways

• ASD’s ACSC responded to 1,524 incidents in FY2025-26, up 20%, and notified organisations of potential malicious activity more than 4,400 times, up almost 80%. Those notifications led to 362 incidents being identified.
• The average self-reported cybercrime cost per business report rose 16% to $93,500. Medium businesses were hit hardest, at $141,300 per report, up 45%.
• Stolen access is the main way in. Phishing appeared in 39% of incidents, compromised accounts in 21% and misuse of valid accounts in 15%.
• Ransomware incidents held steady at 139, but extensive ransomware incidents rose from 16 to 24.
• ASD expects AI to compress the window between a patch release and exploitation further, from roughly two weeks today towards days or hours.
• In October 2026 ASD released the Essentials series, which evolves the Essential Eight into a principles-based framework covering enterprise IT, operational technology (OT) and cloud.

What are the headline numbers in the 2025-26 report?

The table below collects the figures most relevant to business leaders. All are from ASD’s Annual Cyber Threat Report 2025-26 and its business and CI factsheets.

Measure	FY2025-26	Change
Cyber security incidents ASD’s ACSC responded to	1,524	Up 20%
Notifications of potential malicious activity to organisations	4,400+	Up almost 80%
Incidents identified after an ASD notification	362	n/a
Cybercrime reports to ReportCyber	82,000+	One every 6 minutes
Average cybercrime cost per business report	$93,500	Up 16%
Average cost per report, small business	$55,400	Consistent
Average cost per report, medium business	$141,300	Up 45%
Average cost per report, large business	$148,100	Down 27%
Ransomware incidents	139	Consistent
Extensive ransomware incidents	24	Up from 16
Data breach incidents	98	Up 66%
Publicly reported CVEs	n/a	Up 30%
Share of incidents reported by industry (non-government)	51%	n/a

Two figures deserve a second look. The rise in notifications reflects ASD acting earlier: more than half of its individual notifications came from declassified intelligence, and a single collective notification to 340 entities about cPanel vulnerabilities in May 2026 confirmed more than 60 incidents. If ASD’s ACSC calls your organisation, treat it as an incident in progress until proven otherwise. ASD suggests verifying the caller by ringing 1300 CYBER1 (1300 292 371) and quoting the reference number.

The second is the shape of severity. Only one Category 2 incident was recorded, yet extensive compromises rose from 26 to 40. The most severe incidents became rarer while deep compromises of individual organisations became more common.

Why does AI matter so much in this year’s report?

ASD calls AI the defining force in the threat landscape over the past year. Its assessment is that AI has not created new kinds of attack. It has made existing ones faster, cheaper and available to less skilled actors.

The report points to three effects:

• Social engineering at scale. Phishing emails without spelling errors, tailored spearphishing built from public social media, and convincing voice and video impersonation. ASIC has reported a sharp rise in scams using deepfake videos of public figures.
• Faster vulnerability discovery. AI helps attackers find, chain and exploit weaknesses with less effort. Publicly reported CVEs rose 30% over the year.
• Data mining. Attackers use AI to sift stolen and public data for credentials and to profile targets.

The practical consequence is time. ASD has previously observed that most exploitation happens within two weeks of a patch or mitigation being released, with some vulnerabilities exploited within 48 hours. The report expects AI-driven tools to compress that window further over the next 12 months. It also recorded the successful exploitation of a vulnerability first identified in 2008, so the backlog of old, unpatched systems is still being worked as well.

If your patch cycle runs monthly for internet-facing systems, it is now slower than the attackers ASD describes. Our guide to AI cyber threats and the Five Eyes statement covers the governance side of this.

How are attackers getting in?

ASD mapped the incidents it handled to the MITRE ATT&CK framework. The most common techniques were:

Technique (ATT&CK tactic)	Share of incidents
Phishing (initial access)	39%
Compromise accounts (resource development)	21%
User execution (execution)	17%
Valid accounts (initial access)	15%
Social engineering (stealth)	13%
Exploit public-facing application (initial access)	13%

ASD’s summary is direct: attackers steal access, not just data. Stolen usernames, passwords, tokens and sessions are among the most common pathways into Australian networks, and compromised accounts and credentials were one of the most frequently reported incident categories across government, industry and CI.

Two cases in the report show how this works against a help desk. The Scattered Spider group researches staff, then calls the IT help desk over several conversations to learn the password reset process before asking for a reset or a transfer of multi-factor authentication (MFA) tokens. Separately, an Australian bank reported callers impersonating a Melbourne employee, using the employee’s staff ID number, and obtained the names, job titles and phone numbers of several staff.

What to check:

• Help desk identity verification. Can someone reset a password or re-enrol MFA with information found on LinkedIn? If yes, the process is the vulnerability. Our guide to vishing covers the controls.
• Phishing-resistant MFA for email, remote access, cloud administration and privileged accounts. ASD’s report names passkeys alongside MFA as essential.
• Session and token protection, because a stolen session token lets an attacker skip the MFA prompt.
• Staff training built on current lures, including AI-generated ones. See our security awareness training service.

Is ransomware getting worse?

The count is flat and the impact is not. ASD’s ACSC responded to 139 ransomware incidents in FY2025-26, consistent with the year before, but extensive ransomware incidents rose from 16 to 24. Health care, professional, scientific and technical services, and manufacturing remained the three most affected sectors.

The report’s Akira case shows how fast a single edge device vulnerability spreads. In August 2025, several Australian organisations reported ransomware. ASD’s ACSC matched the activity to a known SonicWall vulnerability, scanned for exposure and found almost 1,000 potentially vulnerable devices across around 40 Australian organisations, many of them CI entities.

Another case shows what good preparation buys. A mid-2025 ransomware attack disrupted building systems including access control, cameras, lifts and more than 30 virtual servers. Because the organisation had comprehensive event logging, it could show how the attacker got in, what was affected and that no data was stolen. Its backups restored essential services promptly.

Without those logs, the organisation would have had no evidence that data stayed put, and a disruptive incident would have carried the added question of a notifiable data breach. Our incident response and backup and recovery services cover both halves.

What does the report say about supply chains?

ASD’s position is that your suppliers’ cyber risks are your risks. The report highlights two developments.

Code repositories. Since September 2025, ASD’s ACSC has tracked attacks on online code repositories using social engineering, stolen credentials and authentication tokens. The self-replicating Shai-Hulud worm compromised hundreds of GitHub software packages by stealing a maintainer’s credentials, publishing poisoned versions, then using each new victim’s secrets to infect the packages they maintained.

Inherited exposure. The report also records a hacktivist group claiming a compromise of Stryker, a US company that supplies surgical and pharmaceutical equipment to Australia, in response to events in the Middle East. Australia was not the target. Its supply chain still carried the exposure.

ASD’s advice is to know which software packages, and which versions, run across your environment, so a supplier compromise can be assessed in hours rather than weeks. For the third-party side, our third-party risk management service and guide to supply chain risk management set out the process.

What does it mean for critical infrastructure?

CI incidents made up 10% of all incidents. ASD’s ACSC responded to 154 incidents involving CI entities, down almost 7% on the previous year. The top initial access techniques were phishing (36%), valid accounts (16%) and drive-by compromise (10%). The most affected sectors were financial and insurance services (30%), public administration and safety (21%), and electricity, gas, water and waste services (17%). The average self-reported cost of a cybercrime for a large business was $148,100.

ASD wants CI operators to work from an assumed breach mindset. The central requirement comes from CI Fortify, released in October 2025:

• Identify the vital OT and enabling systems that support a critical service, and their isolation points.
• Be able to physically isolate those systems from the internet and other networks for three months while continuing to deliver the critical service.
• Be able to rapidly and fully rebuild them.

ASD also flagged pro-Russia hacktivists exploiting internet-facing virtual network computing (VNC) connections into OT in water, food and agriculture, and energy, causing operational disruption and, in some cases, physical damage. If an OT system is reachable from the internet, it should be the first item on the list.

For regulated entities, our SOCI Act compliance and AESCSF guide cover the obligations that sit alongside CI Fortify.

What is the Essentials series, and what happens to the Essential Eight?

In October 2026 ASD’s ACSC released the Essentials series, which it describes as the evolution of the Essential Eight into a broader, principles-based approach with prioritised, threat-informed mitigations. It launched with three chapters: Enterprise IT, Operational Technology and Cloud.

Three points for organisations that have invested in the Essential Eight:

• The work carries forward. ASD states that the Essentials for enterprise IT framework does not discard Essential Eight investment, and that it can be carried into implementing the Essentials.
• The measures have changed. ASD also states that the mitigations, and how they are measured, have evolved and in many cases apply more broadly. Expect existing maturity assessments to need re-mapping.
• Transition is still being defined. ASD will keep engaging with stakeholders on transitional arrangements into 2027.

If your contracts, tenders or insurer questionnaires reference an Essential Eight maturity level, keep reporting against it for now and plan a mapping exercise once the transitional arrangements are published. An Essential Eight assessment today gives you the baseline that mapping will start from.

What are ASD’s five priorities, and where should you start?

Cyber Action Year, ASD’s 2026 programme, focuses every organisation on five actions. The table pairs each with a practical first step.

ASD priority	What ASD says	A practical first step
Replace or mitigate legacy technology	Unsupported technology cannot receive security updates. Replace it before support ends	Build an end-of-life register. ASD’s own programme cut end-of-life products by 31.7% across its customers between February and June 2026
Implement best-practice event logging	Logs show how an attacker got in, what they touched and whether data left	Confirm central logging for identity, email, endpoints and internet-facing systems, with retention that covers a slow investigation
Manage supply chains and choose secure by design	Supplier risk is your risk	List every supplier with standing access, and require MFA on each of their accounts
Prepare for post-quantum cryptography (PQC)	Stop using traditional asymmetric cryptography by the end of 2030, or sooner	Start the LATICE process: locate, assess, triage, implement, communicate and educate. Inventory comes first
Prepare for AI-enabled threats	AI shortens the time to exploit and scales social engineering	Shorten patch timeframes for internet-facing systems and reduce what is exposed to the internet at all

For CI operators, ASD adds the three-month isolation capability described above.

What should a business of your size do first?

The report gives tailored guidance on defending against AI-enabled threats:

• Small businesses: choose products that are secure by design out of the box, turn on automatic updates, and make one named person clearly responsible for security monitoring and incident response.
• Medium-sized businesses: keep an inventory of internet-facing systems, patch promptly, segment the network, and test the incident response and business continuity plans.
• Large enterprises, CI operators and government: set executive accountability for AI-related cyber risk, adopt comprehensive monitoring and logging, and work towards layered Zero Trust and secure by design architecture with human-supervised defensive AI.

Medium businesses deserve particular attention this year. Their average reported cost per cybercrime rose 45% to $141,300, close to the large business figure, without the security teams large organisations typically have. If that describes your organisation, a virtual CISO or managed detection and response arrangement is often the realistic way to cover monitoring and response.

How should you report an incident to ASD?

ASD’s ACSC provides free incident response advice 24 hours a day. Report at cyber.gov.au/report or call 1300 CYBER1 (1300 292 371). An incident does not have to be confirmed to be reported.

ASD’s ACSC is not a regulator, and information you give it is protected by its limited use obligation. That does not replace mandatory reporting, such as notifiable data breaches to the Office of the Australian Information Commissioner (OAIC). The OAIC received 1,205 data breach notifications in 2025, the highest annual figure since its scheme began in 2018, as cited in the ASD report.

How CyberPulse helps

CyberPulse works with Australian organisations to turn reports like this into a short, prioritised plan. We start with where you stand against ASD’s priorities, then fix what matters most first.

• Assess: an Essential Eight assessment or broader cyber security audit mapped to ASD’s five priorities and the new Essentials series.
• Test: penetration testing of internet-facing systems, the attack surface ASD expects AI to target fastest.
• Detect and respond: managed detection and response and event logging that would answer the questions in ASD’s ransomware case study.
• Govern: third-party risk management for the supplier side, and vCISO services for board reporting.

Talk to an expert. Book a 30-minute strategy call to work through what the 2025-26 report means for your organisation.

Frequently Asked Questions

What is the ASD Annual Cyber Threat Report?

It is the Australian Signals Directorate’s yearly assessment of cyber threats facing Australia, produced by ASD’s Australian Cyber Security Centre with contributors including the AFP, ASIO, OAIC and APRA. The 2025-26 edition covers 1 July 2025 to 30 June 2026 and was released on 26 October 2026.

How many cyber incidents did ASD respond to in 2025-26?

ASD’s ACSC responded to 1,524 cyber security incidents in FY2025-26, an increase of 20% on the previous year and 36% over five years. It also received more than 82,000 cybercrime reports, about one every six minutes.

How much does cybercrime cost an Australian business?

The average self-reported cost per business cybercrime report was $93,500, up 16%. By size, small businesses reported $55,400, medium businesses $141,300 (up 45%) and large businesses $148,100 (down 27%).

Is the Essential Eight being replaced?

ASD released the Essentials series in October 2026 as the evolution of the Essential Eight. ASD states that existing Essential Eight investment carries forward, while the mitigations and how they are measured have evolved. Transitional arrangements will be worked through with stakeholders into 2027.

What are ASD’s priorities for 2026-27?

Replace or mitigate legacy technology, implement best-practice event logging, manage supply chains and choose secure by design products, prepare for post-quantum cryptography, and prepare for AI-enabled threats. CI operators should also be able to isolate vital systems for up to three months.

When should organisations move to post-quantum cryptography?

ASD recommends ceasing the use of traditional asymmetric cryptography and transitioning to post-quantum cryptography by the end of 2030, or sooner.

About the author

CyberPulse is an Australian-owned cyber security consultancy providing compliance, assessment, testing and managed security services to mid-market and enterprise organisations. Our practitioners work daily with the frameworks and ASD guidance discussed in this article.

Related Services

• Essential Eight Assessment
• Cyber Security Audit Services
• Managed Detection and Response
• Third Party Risk Management
• SOCI Act Compliance for Critical Infrastructure

Useful Links

• Australia’s Cyber Threat Landscape 2025: the 2024-25 ASD report
• The State of Cyber Security in Australia 2026
• AI Cyber Threats Australia: What the Five Eyes Statement Means for Leaders

External Resources

• ASD Annual Cyber Threat Report 2025-26 (cyber.gov.au)
• ACTR 2025-26 factsheet for businesses and organisations (cyber.gov.au)
• ACTR 2025-26 factsheet for critical infrastructure (cyber.gov.au)
• ASD Essentials series (cyber.gov.au)
• CI Fortify (cyber.gov.au)
• Report a cyber security incident (cyber.gov.au)