82,000+ cybercrime reports to ASD, about one every 6 minutes.
$93,500 average self-reported cost per business report, up 16%.
1,500+ cyber security incidents ASD responded to, up 20%.
Source: [ASD Annual Cyber Threat Report 2025–26](https://www.cyber.gov.au/sites/default/files/2026-10/Annual%20Cyber%20Threat%20Report%202025-26.pdf), pages 3 and 5.
The cost figure hides a split. Per report, small businesses averaged $55,400, about the same as last year. Medium businesses averaged $141,300, up 45%. Large businesses averaged $148,100, down 27%. These are costs the victims reported themselves, so treat them as a guide rather than an audit, but a medium business now reports losses close to a large one.
ASD also sent organisations more than 4,400 warnings about suspicious activity it had spotted on their networks, almost 80% more than the year before. 362 of the incidents it handled were found that way, so if ASD calls you, call back. ASD says you can check a call is genuine by ringing 1300 CYBER1 (1300 292 371) and quoting the reference number.
## How fast do you need to patch now?
Faster than most small organisations do. The report says ASD has seen most exploitation happen within two weeks, "with some CVEs successfully exploited within 48 hours of a patch or mitigation advice being released", and expects AI tools to shrink that window further over the next 12 months. In its words: "In the past, defenders had months to patch, now they have days, sometimes only hours."
Two examples from the report stand out for anyone who runs websites or hosting:
- **cPanel.** In May 2026 ASD warned 340 organisations about cPanel vulnerabilities. More than 60 of them turned out to have been compromised. cPanel is the control panel on a lot of shared and small-business web hosting.
- **A 2008 bug.** ASD recorded a successful attack using a vulnerability first identified in 2008. Old systems that nobody patches are still a way in.
The number of publicly reported vulnerabilities rose 30% in the year. That is more fixes to apply, on a shorter clock. The [Essential Eight](/essential-eight/patch-applications) already asks for internet-facing services to be patched within 48 hours when a flaw is critical or being exploited, and our [PHP2Shell post](/php2shell-critical-php-vulnerabilities) last week was a live example: attacks started on the day the fix came out.
## How are attackers getting in?
Mostly through people and passwords. ASD maps each incident to the techniques used, and the top of the list for 2025–26 was:
| Technique | Share of incidents |
|---|---|
| Phishing (getting in) | 39% |
| Compromising accounts (to use in attacks) | 21% |
| Tricking a user into running something | 17% |
| Using valid, stolen accounts (getting in) | 15% |
| Exploiting a public-facing application | 13% |
Source: report page 37, Figure 8. An incident can involve more than one technique, so the column adds up to more than 100%.
The report calls compromised accounts and credentials "one of the most frequently reported incident categories across government, industry and CI sectors". Its advice for everyone includes multi-factor authentication or passkeys. If your staff still sign in to email with a password alone, or with a text-message code, start there. Our [multi-factor authentication guide](/essential-eight/multi-factor-authentication) explains the options.
The report also describes a business email compromise campaign in December 2025 that used more than 400 look-alike domains to pose as Australian construction companies and ask for urgent payments. No accounts were hacked; the emails just looked right. A phone call to a number you already have still stops this.
## Does this matter more for government?
Yes, by volume. Government reported the most incidents again: federal government 32% and state and local government 16%, ahead of every industry. ASD says this is likely due to government's extra reporting obligations. Health care was the most frequently reporting non-government sector, followed by professional, scientific and technical services.
For WA agencies the rules have also moved. The [2026 WA Government Cyber Security Policy](https://www.wa.gov.au/government/publications/wa-government-cyber-security-policy) replaces the 2024 policy. Its essential controls are the Essential Eight at Maturity Level Two plus five more ACSC strategies, the "Further Five". Agencies must have all its Protect controls in place by December 2028. Legacy systems must be documented with transition plans by the end of 2027, and each agency must document its approach to post-quantum cryptography by December 2027. Local governments are outside the policy's scope but are encouraged to follow it.
Those dates line up with what ASD asks of everyone. See our [Essential Eight guide](/essential-eight) for what Level Two involves.
## What does ASD want organisations to do?
ASD made 2026 its "Cyber Action Year" and named five actions every organisation should work towards:
1. Replace or mitigate legacy technology.
2. Implement best-practice event logging.
3. Manage supply chains, including choosing products that are secure by design.
4. Prepare for post-quantum cryptography.
5. Prepare for AI-enabled cyber threats.
The first one has an obvious payoff. Between February and June, organisations in ASD's Cyber Hygiene Improvement Programs cut their end-of-life products by 31.7% after ASD's scans told them what they had. A case study shows why logging matters: an organisation hit by ransomware that disrupted its cameras, door access, lighting, lifts and more than 30 virtual servers could tell from its logs how the attackers got in and that no data had left. Backups got it running again quickly.
On supply chains, the report covers attacks on code repositories, including the Shai-Hulud worm that spread through hundreds of software packages on GitHub by stealing developers' credentials. ASD's advice is to know which packages, and which versions, you run. We wrote about a related case closer to home in [The Supply Chain Attackers Lived Down the Road](/the-supply-chain-attackers-lived-down-the-road).
The report also gives advice by size of organisation:
- **Small businesses:** choose products that are secure out of the box, turn on automatic updates, and be clear who is responsible for security monitoring and incident response.
- **Medium-sized businesses:** keep a list of internet-facing systems, patch promptly, separate your networks, and test your incident response and business continuity plans.
- **Everyone:** expose only the systems that need to be on the internet.
## Is the Essential Eight going away?
It is being replaced over time. The report confirms ASD released the Essentials series in October 2026 as "the evolution of ASD's Essential Eight", starting with chapters for enterprise IT, operational technology and cloud. ASD says work already done on the Essential Eight "can be carried forward", and it will keep talking to organisations about the transition into 2027. Current obligations, including the WA policy, still name the Essential Eight. Our [Essentials transition tracker](/essential-eight/essentials-transition) follows what has changed.
## What should you do next?
For a small or mid-sized business:
1. **Find out what you have on the internet.** Websites, hosting control panels, VPNs, remote desktop, old microsites. You cannot patch what you have forgotten.
2. **Agree a patching deadline with whoever runs it.** Days for critical fixes, not the next quarterly visit. Our [cloud maintenance service](/services/cloud-maintenance) works to these timeframes.
3. **Turn on MFA everywhere**, starting with email and whoever approves payments.
4. **Plan for the old system.** If something cannot be updated, list it and plan its replacement. [Software modernisation](/services/software-development/software-modernisation) is most of what we do.
5. **Test a backup restore and save the hotline number**: 1300 CYBER1 (1300 292 371). Report at [cyber.gov.au/report](https://www.cyber.gov.au/report).
For a WA agency, add a gap assessment against Maturity Level Two and the Further Five, with the December 2027 and December 2028 dates in the plan. We help agencies with [Essential Eight compliance](/services/cloud-security/essential-eight-compliance) and [penetration testing](/consulting/cybersecurity/penetration-testing).
## Frequently asked questions
### Does the report have figures for Western Australia?
Not that we found. The report gives national figures and breaks them down by sector and business size, not by state. For WA-specific findings, the Auditor General's reports are the best source; we summarised them in [WA Cyber Attacks: What This Year's Audits Tell Perth Businesses](/wa-cyber-attacks-lessons-for-perth-businesses).
### Is ransomware getting worse?
The count held steady: ASD responded to 139 ransomware incidents, about the same as the year before. The severity rose: ransomware incidents ASD rated as extensive went from 16 to 24. Health care, professional services and manufacturing were again the most affected.
### We are a small business. Is post-quantum cryptography our problem?
Not as a project of your own. ASD recommends moving off older encryption by the end of 2030, and says smaller organisations do not need a big budget or security team to start. They can get there through providers who manage updates to their websites, cloud services and software. Ask your providers what their plan is.
---
If you want help working out which of these apply to you, try the free [Essential Eight self-assessment](/essential-eight/self-assessment) or [talk to us](/contact).
**Photo credits.** All images used under the [Unsplash License](https://unsplash.com/license) — free for commercial use, attribution appreciated:
- Perth's city centre at night from Elizabeth Quay — [Nathan Hurst](https://unsplash.com/photos/a-city-at-night-with-lights-reflecting-off-the-water-W6C9xmjQ1A8)
## Sources
- [Annual Cyber Threat Report 2025–26](https://www.cyber.gov.au/publication/annual-cyber-threat-report-2025-26) and [full report (PDF)](https://www.cyber.gov.au/sites/default/files/2026-10/Annual%20Cyber%20Threat%20Report%202025-26.pdf) — Australian Signals Directorate, 26 October 2026. All national figures in this post: costs and report counts (p. 3), vulnerabilities (p. 4), incidents and notifications (p. 5), cPanel and the 2008 vulnerability (p. 13), reporting sectors (p. 14), time to exploit (p. 19), ransomware (p. 25), attack techniques (p. 37), Shai-Hulud (p. 39), Cyber Action Year and end-of-life products (pp. 43–44), logging case study (p. 45), Essentials series (p. 46), advice by business size (p. 47), post-quantum cryptography (p. 49), look-alike domain campaign (p. 56).
- [Annual Cyber Threat Report 2025–26: factsheet for businesses and organisations](https://www.cyber.gov.au/sites/default/files/2026-10/2025-26%20ACTR_Factsheet_Businesses%20and%20organisations.pdf) — ASD, October 2026.
- [2026 WA Government Cyber Security Policy](https://www.wa.gov.au/government/publications/wa-government-cyber-security-policy) — Office of Digital Government WA, October 2026. Scope, essential controls, and the 2027 and 2028 deadlines.