Cybercrime is costing businesses more: what ASD's 2025-26 threat report means for you
The average self-reported cost of cybercrime per business report rose to $93,500, and medium businesses were hit harder still. The Australian Signals Directorate (ASD) also warns that AI is helping attackers work at greater scale, speed and sophistication.
The key numbers
ASD’s factsheet for businesses and organisations from the Annual Cyber Threat Report 2025-26 reports:
- Over 82,000 cybercrime reports, or one every 6 minutes.
- $93,500: the average self-reported cybercrime cost per business report, up 16%.
- $141,300: the average self-reported cost for medium businesses, up 45%.
- More than 1,500 cyber security incident responses, and more than 4,400 notifications sent to organisations.
- 51% of cyber incidents were reported by industry, meaning non-government organisations.
What’s changing
ASD says cybercriminals are still targeting businesses for financial gain through scams, extortion and the theft of data and login details. The new element is AI, which ASD says is enabling malicious cyber actors to operate with greater scale, speed and sophistication.
For a small business, that means more convincing phishing emails, fake invoices and impersonation attempts, sent to more businesses at once.
ASD’s advice for businesses
The report lists five actions for businesses and organisations:
- Replace or mitigate legacy technology.
- Implement best-practice event logging.
- Manage supply chains, including by choosing products and services that are secure by design.
- Prepare for post-quantum cryptography.
- Prepare for AI-enabled cyber threats.
What this means for small businesses
Some of ASD’s list is aimed at larger organisations, but the first and last points apply to every business. In practice:
- Retire old systems. Unsupported computers, routers and software that no longer get security updates are an easy way in. Replace them or isolate them.
- Check your suppliers. Ask your IT provider, website host and software vendors how they protect your data and what happens if they’re attacked.
- Expect better fakes. Confirm any change to bank details or urgent payment request by calling a number you already have, not one in the email.
- Have a plan. Know who you’d call, how you’d restore from backups and how you’d keep trading. Our guide to cyber security and backups covers the basics.
Report cybercrime at cyber.gov.au/report or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371). ASD’s help is free, 24 hours a day, 7 days a week.