The ACSC's 2025-26 Threat Report: What the Numbers Mean for Your Business
The Australian Signals Directorate's cyber centre has just published its 2025-26 Annual Cyber Threat Report, and one line in it should stop every business owner cold: the average cybercrime now costs a small business $55,400, and a new one gets reported every six minutes.
The report, released on 26 October, pulls together a full year of data from ReportCyber and the ACSC's own incident response. The headline figures are sobering. Australians lodged more than 82,000 cybercrime reports over the year, the ACSC responded to over 1,500 incidents (up 20 per cent), and it dealt with 139 ransomware cases. Known software vulnerabilities being reported jumped 30 per cent, and the centre flagged that AI is making it faster and cheaper for attackers to find and exploit those holes.
Why the mid-sized end got hit hardest
The average cost of cybercrime to businesses rose 16 per cent to $93,500 per report. Small business held steady at $55,400, but medium business climbed 45 per cent to $141,300. That jump matters, because a lot of the owners we work with across Brookvale, the Northern Beaches and Central West NSW sit right in that growing small-to-medium band. They are big enough to hold valuable client data and process real money, but rarely have a full-time security person watching the gate.
Here is the pattern we see in Australian SMB environments, and the report backs it up: breaches almost never come from some exotic, movie-style hack. They come from an unpatched device sitting in the corner and a staff member clicking the wrong link. The ACSC noted that "User Execution" and social engineering remain the most common techniques, and that it even recorded a vulnerability from 2008 being exploited this year. Boring, preventable gaps are still doing the damage.
What to do about it
You do not need a huge budget to shut down most of what is in this report. You need the basics done consistently.
- Patch on a schedule. Operating systems, firewalls, VPNs and apps. If no one owns patching in your business, that is the first gap to close.
- Turn on MFA everywhere. Especially Microsoft 365 and remote access. It is the single cheapest way to blunt stolen passwords.
- Train your people. Humans are the top target, so a short, regular phishing refresher pays for itself the first time someone pauses before clicking.
- Keep tested, offline backups. With 139 ransomware incidents on the books, a backup you have actually restored from is your fallback plan.
Annual Cyber Threat Reports, Australian Signals Directorate (ACSC)
Frequently Asked Questions
How much does a cyber attack cost an Australian small business?
The ACSC's 2025-26 report puts the average self-reported cost of cybercrime at $55,400 per report for a small business. For a medium business it is $141,300, up 45 per cent on the year before.
How often is cybercrime reported in Australia?
ReportCyber received over 82,000 cybercrime reports in 2025-26, which works out to roughly one report every six minutes. The ACSC also responded to more than 1,500 incidents, up 20 per cent.
What is the most common way small businesses get breached?
Unpatched systems and social engineering. The report notes known common vulnerabilities rose 30 per cent and that humans remain an enduring target. Most incidents we see start with an unpatched device or a staff member clicking something, not an exotic zero-day.
What should a small business do first to lower its risk?
Patch promptly, turn on multi-factor authentication everywhere, train staff to spot phishing, and keep tested offline backups. These four basics stop the bulk of the attacks the ACSC is reporting.
Not sure where your gaps are?
We will take a straight look at your patching, backups, MFA and staff training, then tell you what actually needs fixing. No jargon, no scare tactics.
Related Guide
Cybersecurity for Sydney SMBs
Explore our complete guide to protecting your business from cyber threats.
Read the Full Guide →