Share
Author
In this article
It’s come to that time of year where the Australian Signals Directorate (ASD) releases its Annual Cyber Threat Report 2025-26 in late October. It’s a key document that should be on every board’s desk for review.
“In the past, defenders had months to patch, now they have days, sometimes only hours.”
ASD, Annual Cyber Threat Report 2025-26
So far, we haven’t seen AI creating any significant number of novel methods for exploiting attack surfaces. Rather, it’s shrunk the time-to-response gap on existing exploits, in many cases leaving security teams scrambling to keep up.
Our security team has gone through all 68 pages of the report so you can get the expert insights and analysis on trends medium and large Australian businesses need to be concerned about and start preparing for in 2027.
Key Takeaways
- Innovative use of AI is accelerating familiar attack types. Phishing emails can now be made to look even more realistic than before. Finding and exploiting weaknesses in IT systems can now be done even more quickly.
- Activity has increased in terms of incidents and costs. ASD dealt with over 1,500 cyber security incidents during the year, an increase of 20% over the previous year. The average cost per business cybercrime report rose by 16% to $93,500.
- Stolen logins into a business are often a principal method by which an attacker gains access to a business. Compromised accounts and credentials are now one of the most commonly reported types of cyber security incidents affecting Australian businesses.
- Patch windows are down to days. Some vulnerabilities are exploited within 48 hours of a fix being released.
- The Essential Eight is evolving to ASD Essentials, and existing work in the Essential Eight will continue to be relevant.
- ASD has five priority actions which are: legacy technology, event logging, supply chain risks, post-quantum cryptography and AI-enabled threats.
The 2025-26 Report in Numbers
Here are the headline figures, with the change on 2024-25.
| Measure | 2025-26 | Change on 2024-25 |
|---|---|---|
| Cyber security incidents ASD responded to | 1,500+ | Up 20% |
| Times ASD notified organisations of potential malicious activity | 4,400+ | Up almost 80% |
| Cybercrime reports to ASD | 82,000+ | One every 6 minutes, same as last year |
| Average cost per business cybercrime report | $93,500 | Up 16% |
| Average cost per report, medium businesses | $141,300 | Up 45% |
| Average cost per report, large businesses | $148,100 | Down 27% |
| Ransomware incidents | 139 | Steady, but extensive incidents rose from 16 to 24 |
| Data breach incidents | 98 | Up 66% |
The average cost for medium businesses reported in the last two years has gone up sharply, and is now close to that reported by large businesses, after a massive 55% rise to $97,200 in 2024-25 (see our review of last year’s report).
The average cost per report for large businesses fell 27%, but read that with care. ASD noted last year that large businesses file the fewest reports, so a few big losses can swing their average.
AI Is Speeding Up Familiar Attacks
ASD notes that “AI capabilities have not introduced new cyber threats, but they have amplified and sped up existing ones”.
- Convincing social engineering: free of spelling and grammar errors, targets specific individuals with automated spearphishing, uses realistic images and voice recordings. ASIC has observed an increase in scams utilising deepfake videos featuring well-known celebrities and politicians.
- Faster vulnerability discovery. Rather than consuming large amounts of time, effort and skills to identify and analyse individual vulnerabilities, AI can rapidly identify individual vulnerabilities and associated chains of vulnerabilities.
- Faster victim profiling. These types of attacks utilise AI tools that quickly scrape through social media, amongst other public sources to create a victim profile in order to defraud and impersonate them.
We encourage businesses to think about how they can close the time-to-response gap with their own set of automated or AI-assisted security tooling, to help them both detect threats earlier and respond faster.
But those tools come with their own set of guardrails that need to be enforced to ensure safe use, such as least-privilege access, limiting the data AI systems can see, checking their output and creating an observability layer for AI-assisted actions, as the ASD recommends.
To get a better picture, see our guide on AI security risks.
💡 Expert Insight: Ashish Srivastava, Head of Cyber Security & Strategy
“This year, at least 20% of the phishing and impersonation attempts we have seen looked AI-assisted. We caught them through a combination of security layers: our email filtering, continuous SOC monitoring and staff reporting. Staff reporting has improved since we added AI-related awareness training to TechBrain’s SETA program.”
Attackers Are Logging In, Not Breaking In
It might surprise you to find that in an AI future, sophisticated attacks aren’t the driving force for breaches in 2025-26. Instead, according to ASD, it’s stolen credentials (usernames, passwords, tokens and sessions) that are opening the front door to Australian networks.
These were the techniques ASD saw most often, as a share of the incidents it mapped to the MITRE ATT&CK framework.
| Technique | Share of incidents |
|---|---|
| Phishing | 39% |
| Compromised accounts | 21% |
| User execution (someone opens or runs something malicious) | 17% |
| Valid accounts (legitimate logins misused) | 15% |
Where we’d start:
- Start by protecting executives, finance staff and IT personnel with passkeys or FIDO2 security keys for phishing-resistant MFA. Read our guide to rolling out phishing-resistant MFA.
- Check more than the password. For example, use conditional access policies to check the device and the level of risk for sign-ins.
- Always verify unusual requests. Implement verifications for payments, and unexpected changes to systems or accounts (e.g. password resets) via known methods. ASD notes attackers target the people who can approve payments or change systems.
Patch Windows Have Shrunk to Days
ASD has seen most vulnerability exploitation happen within two weeks of a fix or mitigation advice being released, and some within 48 hours. ASD expects that in the next 12 months AI tools will reduce the window for exploitation of newly announced vulnerabilities. Publicly reported vulnerabilities have increased by 30% this year.
In August 2025, the Akira ransomware was used to attack Australian organisations with a known SonicWall vulnerability. ASD scans subsequently identified around 40 organisations, including critical infrastructure, with almost 1,000 potentially vulnerable devices.
The simple advice of ASD is to ‘radically speed up patching’. This translates into three simple areas of focus for most businesses.
- Know what faces the internet. Maintain an up-to-date list of all internet-facing systems, exposing only what is required to be on the internet.
- Know your patch schedules: Track your vendors’ patch schedules and periodically scan for missing patches. Our patch management service does both.
- Stop using legacy systems. Businesses must identify legacy systems and replace them before they cease to receive security fixes from their vendors.
💡 Expert Insight: Ashish Srivastava, Head of Cyber Security & Strategy
“At TechBrain, we align with ASD’s patching guidelines and roll out critical patches to internet-facing systems within 48 hours. That’s the window I consider realistic, and it’s the one we agree with clients. When it slips, the cause is almost always a business requirement or a dependency on the system, not a technical barrier. When that happens, we put contingencies and additional monitoring in place until the maintenance window arrives.”
The Essential Eight Becomes ASD Essentials
In October 2026 ASD’s Essentials series was launched. This is the evolution of the Essential Eight into “a broader, principles-based approach”. The initial three chapters are provided for Enterprise IT, Operational Technology and Cloud environments.
What it means for your business:
- Keep going with Essential Eight work. ASD says the Essential Eight “remains effective” and that the investment can be carried forward.
- Expect the measures to change. The mitigations, and how ASD measures them, have evolved and often apply more broadly.
- The guidance for OT and cloud is particularly relevant for businesses that run operational technology such as mining and manufacturing sites.
- Until the transition is finalised, ASD will continue to work with businesses and organisations.
💡 Expert Insight: Ashish Srivastava, Head of Cyber Security & Strategy
“It’s natural for businesses to be confused when they’re midway through an Essential Eight uplift. We recommend they continue their security uplift, as it will still improve their security posture.
“Our TechSure process has always included the Essential Eight as its technical backbone, with a governance and awareness uplift that takes each business’s information security risk into account. That helps clients align with ASD Essentials once the uplift is complete, and we can then guide them through the new controls.”
Turn ASD’s Five Actions Into Your 2027 Plan
ASD calls cyber resilience “a core business risk and leadership responsibility”. And in 2026, in what ASD has labelled its Cyber Action Year, the key ask is for organisations to adopt an “assumed breach” mindset, which provides a frame for the following five critical actions:
| ASD action | Why it matters | Our suggested first step |
|---|---|---|
| Replace or mitigate legacy technology | Unsupported systems no longer get security patches | List end-of-life systems and set replacement dates |
| Implement best-practice event logging | Logs show how an attacker got in and what they did | Confirm what you log, how long you keep it and who reviews it |
| Manage supply chain risk | Your suppliers’ cyber risks are your risks | Review suppliers with privileged access to your systems |
| Prepare for post-quantum cryptography | ASD recommends moving off traditional asymmetric cryptography by the end of 2030 | Map where you rely on encryption and ask vendors for their plans |
| Prepare for AI-enabled threats | AI is shortening the time from discovery to exploitation | Make an executive accountable for AI-related cyber risk |
We’ve seen strong evidence over the year to show that event logging really pays off. In one 2025 ransomware case ASD handled, the victim’s event logs showed clear evidence of how the attacker got in, what they did, and also confirmed that no data had been stolen.
ASD also tailors its advice by size.
- Medium businesses: keep an inventory of internet-facing systems, patch promptly, segment your network, and test your incident response and business continuity plans.
- Large organisations: make an executive accountable for AI-related cyber risk, adopt comprehensive monitoring and logging, and work towards layered Zero Trust and Secure by Design architectures supported by human-supervised defensive AI.
How TechBrain Helps
Here at TechBrain, we help medium and large Australian businesses distil ASD’s guidance into a defensible security posture. Everything is delivered within our ISO 27001-certified management environment by an Australian-based team.
- Cyber risk assessment. See where you stand against ASD’s priorities and what to fix first.
- Essential Eight assessments. We’re carrying Essential Eight work across while ASD settles the transition.
- Patch management. Tracked patching for the systems attackers target first.
- Managed SOC and SIEM. Event logging and monitoring to detect and respond to incidents early.
- AI governance. Controls for how your business uses AI and the risks that come with it.
ASD has set the priorities for 2027. Book a cyber risk assessment to see where your business stands against them.
This article is general information, not legal advice, and is current as at publication. The costs reported in this article are ASD’s average self-reported costs per cybercrime report.
Sources
- Annual Cyber Threat Report 2025-26, Australian Signals Directorate (October 2026). cyber.gov.au
- Annual Cyber Threat Report 2025-26 factsheet for businesses and organisations, Australian Signals Directorate (October 2026). cyber.gov.au
- ASD Essentials, Australian Signals Directorate (October 2026). cyber.gov.au
- Annual Cyber Threat Report 2024-25, Australian Signals Directorate (October 2025). cyber.gov.au
- Cover image adapted from © Commonwealth of Australia 2026, Australian Signals Directorate’s Australian Cyber Security Centre, Annual Cyber Threat Report 2025–26, CC BY 4.0.
