OneDot61 works with the vendors named in this article on a commercial basis.
The Australian Signals Directorate (ASD) has released its seventh Annual Cyber Threat Report. This year's message: AI is making familiar threats faster and more convincing, and getting the fundamentals right matters more now than ever. Here are the highlights.
The report covers the 2025-26 financial year and is written for a wide audience: individuals, small and medium businesses, large organisations, critical infrastructure and government. It's practical, plain-English and free.
The Year in Numbers
The ASD's Australian Cyber Security Centre (ASD's ACSC):
- Received more than 82,000 cybercrime reports, on average one every 6 minutes
- Responded to more than 1,500 cyber security incidents, up 20%
- Notified Australian organisations more than 4,400 times about potentially malicious activity, up almost 80%; 362 incidents were identified following these notifications
- Responded to 139 ransomware incidents, consistent with last year, although extensive ransomware incidents rose from 16 to 24
Publicly reported vulnerabilities (CVEs) rose 30%. For businesses, the average self-reported cost of cybercrime per report was $93,500, up 16%. For small business: $55,400 (consistent with last year). For medium businesses it was $141,300, up 45%. For large business: $148,100 (down 27%).
AI Amplifies Existing Threats
AI is the theme running through the whole report. ASD says it is helping malicious actors find vulnerabilities faster, write malicious code, and create more convincing scams, phishing, deepfakes and impersonations. But ASD is clear about what has changed:
'AI capabilities have not introduced new cyber threats, but they have amplified and sped up existing ones, meaning action is now more critical than ever.'
The report is just as clear about the opportunity for businesses to use AI to help their organisations:
'AI has the potential to be a force multiplier for defenders, enabling organisations to identify threats earlier, respond faster and use cyber security resources effectively.'
We look at how AI has changed one of the most common threats in AI Made Phishing Scalable and Personalised.
The Familiar Attack Paths Still Work
- Stolen credentials: compromised accounts and credentials were one of the most frequently reported incident categories across government, industry and critical infrastructure. The ASD recommends MFA or passkeys.
- Unpatched systems: the ASD keeps seeing incidents from unpatched vulnerabilities, including the successful exploitation of one identified in 2008. AI is likely shortening the time between a vulnerability being found and being exploited.
- People: the ASD says social engineering and user execution remain common techniques, showing that 'humans remain an enduring target'.
Five Actions for Every Organisation
The good news is that the ASD sets out exactly where to focus. The five priorities for businesses and organisations are:
- Replace or mitigate legacy technology
- Implement best-practice event logging
- Manage supply chains, including by choosing products and services that are secure by design
- Prepare for post-quantum cryptography
- Prepare for AI-enabled cyber threats
Post-quantum cryptography is the action many organisations know least about. Read more about what Q-Day is and about HNDL attacks.
The ASD urges an 'assumed breach' mindset: plan for when, not if, a compromise occurs (Learn more: Hyprfire & Labyrinth). Critical infrastructure entities should also prepare to isolate systems and networks for up to three months while continuing to maintain critical services.
To get started, see how SignPath (supply chains), American Binary (post-quantum cryptography), and Geordie and IRONSCALES (AI-enabled threats) can help.
A Leadership Responsibility
The ASD puts it plainly in its report:
'Cyber resilience cannot be treated as a purely technical issue. It is a core business risk and leadership responsibility.'
The report gives guidance by size of organisation, from choosing secure-by-design products and enabling automatic updates for small businesses, to executive accountability for AI-related cyber risks for large enterprises and government. It also notes the release of the ASD Essentials series in October 2026, which evolves the Essential Eight into a principles-based framework. Our ASD Essentials overview explains what it means for your organisation.
Read the ASD Report
This summary only scratches the surface. The report includes case studies, sector trends and practical advice for each audience. A good place to start:
- Annual Cyber Threat Report 2025-26: read online by chapter, or download the full report; the Executive summary takes a few minutes
- The factsheets for businesses and organisations, critical infrastructure and individuals, in the Downloads section of the report page: short summaries to share with your team or board
If you see suspicious cyber activity, report it at cyber.gov.au/report or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371), 24 hours a day.
The ACSC Partnership Program
Organisations can join ASD's ACSC Cyber Security Partnership Program, which has grown to more than 149,500 partners, to stay engaged and help build Australia's collective cyber resilience.
Talk to OneDot61
See our portfolio for solutions that can help with the ASD's five actions. Talk to us about which ones will help you action the ASD's guidance for your organisation or your clients.
