According to the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) Annual Cyber Threat Report 2025–26, ASD’s ACSC responded to more than 1,500 cyber security incidents during the year, up 20%. Publicly reported vulnerabilities rose 30%, and artificial intelligence (AI) is helping malicious actors work faster and at greater scale.So, what does the 2025–26 Cyber Threat Report mean for Australian businesses? The clearest message in the report is that the margin for delay is shrinking. Attackers are using familiar methods, and they’re getting through each step faster, from researching a target to exploiting a vulnerability to logging in with stolen credentials. Security that kept pace last year may fall behind this year.
We’ve viewed the findings through that lens, and the question is: Is your security operating at the speed of your risk?
What are the key findings from the 2025–26 Cyber Threat Report?
According to the report’s Year in Review, during FY2025–26 ASD’s ACSC:
-
-
Responded to more than 1,500 cyber security incidents, up 20% from the previous year.
-
Notified organisations of potentially malicious cyber activity more than 4,400 times, an increase of almost 80%.
-
Received more than 82,000 cybercrime reports through ReportCyber, around one every six minutes.
-
Recorded an average self-reported cybercrime cost of $93,500 for businesses, up 16%.
-
Recorded an average self-reported cybercrime cost of $141,300 for medium businesses, up 45%.
-
Publicly reported common vulnerabilities and exposures (CVEs) increased 30%.
-
ASD notes that its figures don’t capture every cybercrime or incident in Australia, and changes in reporting behaviour can affect the numbers. Even with that caveat, the direction is clear.
Is AI creating new cyber threats?
AI is making many existing cyber threats faster and easier to scale. It can help malicious actors research targets, create convincing social engineering, identify vulnerabilities, and develop exploits with less time and effort.
ASD assesses that AI has amplified and accelerated the threats we already had, which is why we find the speed angle more useful than the AI headline. Phishing is a good example. An attacker can use AI to research a target, analyse publicly available information, and write a convincing message far faster than before, and phishing was already the most common initial access technique ASD observed. It was also the most prevalent technique in ASD’s MITRE ATT&CK analysis, at 39%.
AI also helps defenders. ASD points to security teams using it to analyse large volumes of security data, find vulnerabilities earlier, monitor for unusual behaviour, and respond to incidents faster. If it still takes your team weeks to patch a critical vulnerability or investigate suspicious activity, that gap is a better place to start than a new AI security product.
How are attackers using stolen credentials?
Compromised accounts and credentials give attackers legitimate access, and ASD says they’re now among the most frequently reported incident categories across government, industry, and critical infrastructure.
ASD’s MITRE ATT&CK analysis put valid accounts at 15%, which makes them one of the leading initial access techniques. A working login can help an attacker get around some of the barriers that would otherwise slow them down. Because the activity starts with legitimate credentials, it can also be harder to tell apart from normal behaviour.
The report includes a case study from an Australian bank, which received two calls to its internal help desk from people impersonating employees. The callers knew staff details and asked questions that showed they understood how particular teams were set up. They got names, job titles, and corporate phone numbers from help desk staff over the phone. A separate case study in the report describes the Scattered Spider threat group persuading help desk staff to reset passwords or transfer MFA tokens.
Multi-factor authentication (MFA), passkeys, sensible access privileges, and tight control of privileged accounts all make stolen information harder to turn into access. Your identity processes matter just as much. If someone calls the help desk asking for a password reset or a new MFA token, how does your team verify who they’re speaking to, particularly when the caller sounds convincing and creates a sense of urgency? AI can make those approaches more convincing and easier to scale, so your verification steps need to allow for that.
How quickly are attackers exploiting vulnerabilities?
Attackers are exploiting vulnerabilities faster, which leaves less time to patch. ASD has previously seen some vulnerabilities exploited within 48 hours of patch or mitigation advice being released, and it expects AI-driven tools to shrink that window further over the next 12 months.
The report describes the shift plainly: defenders once had months to patch, and now they have days, sometimes only hours. With publicly reported CVEs up 30%, there are more disclosed vulnerabilities for security teams to assess, while the time available to respond is shrinking. ASD also notes that although many vulnerabilities exist, only some pose significant risks, which is why it helps to know which ones matter to your business.
For us at The Missing Link, the important word in ASD’s recommendation to accelerate patching is speed. Knowing about a vulnerability doesn’t reduce your risk if your patching process can’t get a fix deployed within the window attackers are now working in. Patching everything at once isn’t realistic, so you need to know what’s exposed to the internet, which vulnerabilities matter most, and who decides what gets fixed first.
A vulnerability is a technical weakness; the risk it presents is contextual. Its significance depends on the system’s exposure, its position within the architecture and associated trust relationships, the criticality of the data and services it supports, and the effectiveness of existing controls. Most customers we work with are already aware of these, but the key question is deciding which ones matter and which ones to prioritise for remediation.
Legacy IT adds to the problem. ASD recorded the successful exploitation of a vulnerability identified in 2008 this year, which shows how long an old weakness can stay useful to an attacker.
Speed matters when the vulnerability sits in a product your business depends on, too. In August 2025, reports from Australian organisations helped ASD’s ACSC link ransomware incidents to a known SonicWall vulnerability. ASD scanned for exposure and identified almost 1,000 potentially vulnerable devices and around 40 potentially vulnerable Australian organisations, many of them critical infrastructure entities. It notified them, and after it published a public alert, it saw fewer reported incidents using similar techniques.
That case shows why it pays to know which technologies your business relies on, where they’re exposed to the internet and who’s responsible for acting when a vendor discloses a serious security issue.
Adapted from ASD’s ACSC, Annual Cyber Threat Report 2025–26. © Commonwealth of Australia 2026.
How should your business prepare to recover from a cyber attack?
Cyber resilience is your ability to keep critical operations running and recover quickly when an incident occurs. Prevention remains important, and businesses also need to know how they’ll detect, contain, respond to, and recover from an attack.
Ransomware incidents held steady at 139, but the severity went up, with extensive ransomware incidents rising from 16 to 24. ASD also recorded 40 extensive compromises across all incident types, up from 26 the year before, although it notes it updated how it categorises incidents this year. The longer it takes to work out what happened, the longer recovery can take.
ASD is encouraging Australian organisations to adopt an “assumed breach” mindset, which means planning on the basis that a compromise will eventually happen. One case study shows what that preparation looks like. After ransomware disrupted an organisation’s cameras, building access controls, lighting, lifts and more than 30 virtual servers, its event logs showed how the attacker got in, which systems were affected and what the attacker had done. The logs also showed that no data had been stolen, and because the organisation backed up its systems, it restored essential services promptly.
Has the Essential Eight been replaced?
ASD’s Essential Eight has evolved into the new Essentials series. Released in October 2026, the Essentials series takes a broader, principles-based approach, with guidance tailored to different technology environments.
The first three chapters of ASD Essentials cover Enterprise IT, Operational Technology and Cloud. The Essential Eight was introduced in 2017, and technology has changed a great deal since then.
If you’ve already invested in the Essential Eight, that work still counts. ASD says it can be carried forward, although some mitigations and the way they’re measured have changed, and many now apply more broadly. ASD will keep engaging with stakeholders on transition arrangements into 2027. If you’ve been working towards Essential Eight maturity, keep going and look at what’s changed before you map your existing controls to the new guidance.
How can Australian businesses keep up with faster cyber threats?
You don’t need to tackle everything at once. We’d suggest working through the report’s findings in three steps: assess, improve and manage.
Assess: where are the gaps that create the greatest exposure?
-
-
How quickly could you identify, prioritise and fix a critical vulnerability on an internet-facing system?
-
How would your help desk verify someone asking for a password reset or a new MFA token?
-
Could you detect an attacker quickly, and tell from your logs how they got in and what they did?
-
Improve: which changes will reduce that risk fastest?
Start with the gap that matters most to your business. That might be:
-
-
A faster patching process
-
Tighter privileged access
-
Better logging
-
A verified backup restore
-
Replacing a legacy system that’s sat on the risk register for too long
-
Manage: how will you keep those controls working as threats and your environment change?
-
-
Test your incident response plan and recovery process with the people who’d carry them out.
-
Revisit your controls regularly. ASD’s report makes the point that cyber risk assumptions can become outdated in months, so a control that worked at the last review might need adjusting.
-
Look at how your organisation uses AI, what information those tools can reach and where AI could help your security team work faster.
-
Your answers will depend on your environment. A mid-sized professional services firm has different risks, technology and obligations from a critical infrastructure operator, and a good security strategy accounts for that.
What’s the biggest lesson from the 2025–26 Cyber Threat Report?
The biggest lesson is that the time you have to act is getting shorter.
Attackers are moving faster, credentials remain a valuable way in, vulnerabilities are increasing, and AI is helping malicious actors scale up activity that already works. Most businesses already know cyber security matters, and this year’s report asks whether you can act on that quickly enough. So we’ll finish where we started: is your security operating at the speed of your risk?
If you’re not sure where your biggest gap is, we can help you find it. At The Missing Link, we assess your security environment and prioritise improvements based on your risks, technology, and business needs.
Talk to our Cyber Security team about where your next security improvement should start.
Frequently asked questions
