Each year the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) publishes a snapshot of the threats facing Australian organisations.

The Annual Cyber Threat Report 2025–26, released on 26 October, has a clear headline: artificial intelligence. ASD calls AI “the defining force in the cyber threat landscape over the past year”.

Read past the headline, though, and the message is reassuringly familiar. The attacks themselves haven’t changed. They’re just arriving faster.

The year in numbers

According to ASD’s factsheet for businesses and organisations, in 2025–26 the ACSC:

• received over 82,000 cybercrime reports, one every six minutes
• responded to more than 1,500 cyber security incidents, up more than 20%
• issued over 4,400 notifications to organisations about potential malicious activity, an increase of almost 80%.

Last year’s report recorded more than 84,700 cybercrime reports, which we covered in our ASD Cyber Threat “Year in Review”. The volume is steady. What has changed is the cost and the pace.

Mid-sized businesses are paying the most

The average self-reported cost of cybercrime per business report rose 16% to $93,500. Medium businesses felt it most, with the average jumping 45% to $141,300. Small businesses averaged $55,400.

That puts medium businesses within touching distance of large organisations, but often without the same security teams and monitoring behind them. More staff, more systems and more suppliers mean more ways in.

How attackers are getting in

Despite the AI headlines, most attacks still start in familiar places: phishing emails, stolen usernames and passwords, and systems that haven’t been patched.

What AI changes is speed. ASD has observed that most vulnerability exploitation happens within two weeks, with some flaws exploited within 48 hours of a patch or advice being released, and it expects AI-driven tools to shrink that window further over the next 12 months. As the report puts it, “In the past, defenders had months to patch, now they have days, sometimes only hours.” ASD’s patching guidance is direct: all organisations should accelerate their patching and prioritise security updates.

Old weaknesses are still being used, too. Publicly reported vulnerabilities rose 30%, and one successful attack this year exploited a flaw first identified in 2008.

Security is a habit, not a project

The good news is that the response doesn’t require a new category of technology. It requires doing the fundamentals consistently, and faster than before:

• Patch quickly. Know every system that faces the internet and update critical vulnerabilities in days, not months.
• Protect every login. ASD continues to recommend multi-factor authentication (MFA) or passkeys as essential.
• Watch and record. Best-practice event logging and monitoring help you detect an attack early and understand what happened.
• Plan for the bad day. Test your backups, incident response and business continuity plans, and be clear about who is responsible.
• Deal with legacy technology. Replace or isolate systems that no longer receive security updates.

From the Essential Eight to ASD Essentials

There’s one more change worth knowing about. In October 2026, ASD released the Essentials series, the evolution of the Essential Eight into a broader, principles-based framework with chapters for enterprise IT, operational technology and cloud.

If you’ve invested in the Essential Eight, that work isn’t wasted. ASD says it “can be carried forward” as part of implementing the Essentials. However, the mitigations and how they’re measured have evolved, so some existing controls may need strengthening. ASD’s Transitioning from the Essential Eight guidance recommends a gap analysis, and transitional arrangements continue into 2027.

“This year’s report confirms what we see every day. The businesses that come through an incident well aren’t the ones with the most tools. They’re the ones that patch quickly, protect every login and know exactly what to do when something goes wrong. Getting those basics right, consistently, is now the most valuable thing you can do.” – Robert Buck, Managing Director, Diamond IT

How Diamond IT can help

Whether you want to know where you stand today or need help keeping on top of the basics every week, we can help:

• Cyber Risk Discovery gives you a clear, prioritised view of your current risks.
• Essential Eight and ASD Essentials uplift helps you build maturity and plan your transition to the new framework.
• Managed IT services keep patching, monitoring and backups running week in, week out.
• AI Advisory helps you adopt AI safely, with the right governance, data protection and guardrails in place, so it strengthens your resilience rather than adding risk.

If you’re looking to strengthen your organisation’s cyber resilience and aren’t sure where to start, our Business Technology Consultants can help you prioritise the right steps, lift your Essential Eight maturity, plan your move to ASD Essentials and adopt AI with confidence. Get in touch on 1300 307 907, via email enquiries@diamondit.com.au or fill out the form below to take the next step with confidence.