The Australian Signals Directorate (ASD) has released its seventh Annual Cyber Threat Report, covering July 2025 to June 2026. The short version: more incidents, faster attackers, and a government that is now spotting compromises before the victims do.
AI is the report’s defining theme. ASD says it hasn’t created new threats so much as amplified and accelerated the old ones: phishing, stolen credentials and unpatched systems. The report also makes a clear shift in tone. The question is no longer whether your organisation will face an incident, but how prepared you are when it does.
Here’s what the ASD Annual Cyber Threat Report found, and what ASD says Australian organisations should prioritise next.
What did the ASD report find?
Incidents rose 20%, the serious ones rose faster, and ASD increasingly found the compromise first. These are the numbers that matter.
1. More incidents, and more serious ones. ASD’s ACSC responded to 1,524 cyber security incidents, up 20% on the previous year and 36% over five years. Extensive compromises rose from 26 to 40.
2. ASD is spotting breaches before victims do. ASD notified organisations of malicious activity on their networks more than 4,400 times, up nearly 80%. In 362 cases, the incident was only discovered because ASD called first.
3. Cybercrime is costing mid-sized businesses far more. The ACSC received over 82,000 cybercrime reports, one every six minutes. The average self-reported cost per business report rose 16% to $93,500. Medium businesses were hit hardest: up 45% to $141,300, almost level with large businesses at $148,100.
4. Data breaches climbed. Data breach incidents handled by ASD rose 66% to 98. Separately, the OAIC received 1,205 notifiable data breaches in calendar 2025, the most since the scheme began in 2018.
5. Attackers are logging in, not breaking in. Phishing featured in 39% of incidents, compromised accounts in 21% and valid accounts in 15%. ASD now ranks stolen credentials among the most common ways into Australian networks.
6. The window to patch has collapsed. Publicly reported vulnerabilities rose 30%. Most exploitation now happens within two weeks, and some flaws are exploited within 48 hours of a patch. ASD also saw a vulnerability from 2008 successfully exploited this year.
7. Ransomware held steady, but hit harder. Ransomware incidents were flat at 139, but extensive ransomware incidents rose from 16 to 24. Health care, professional services and manufacturing remain the most targeted sectors.
What does ASD say comes next?
2026 is ASD’s inaugural Cyber Action Year, and the report sets out five priorities for every Australian organisation. The message is clear: awareness is no longer enough, it’s time to act.
- Replace or mitigate legacy technology. End-of-life systems and old edge devices remain a favourite entry point. Where ASD worked with organisations through its CHIPs program, end-of-life products fell 31.7% in four months.
- Implement best-practice event logging. In one ransomware case, an organisation lost building systems and more than 30 virtual servers. Its logs proved no data had been stolen, and it restored from backups.
- Manage your supply chain and buy Secure by Design. Organisations are being exposed through suppliers they don’t control, even when they aren’t the direct target.
- Prepare for post-quantum cryptography. ASD recommends stopping use of traditional asymmetric cryptography by the end of 2030, or sooner.
- Prepare for AI-enabled threats. Expect more convincing phishing, deepfake impersonation and vulnerability exploitation at a speed and scale defenders haven’t faced before.
The rulebook is changing too. ASD released its new Essentials series in October 2026, replacing the Essential Eight with chapters for enterprise IT, operational technology and cloud. Transitional arrangements run into 2027.
What does this mean for your organisation?
If ASD can see malicious activity on your network before you can, you have a visibility gap. Closing it means knowing what’s running, who has access, and what normal looks like.
Three questions worth asking this week:
- Would we spot a compromised account before ASD told us?
- Do we still run end-of-life systems or exposed remote access?
- If ransomware hit tomorrow, could our logs prove what was and wasn’t taken?
Northbridge helps Australian organisations act on ASD’s priorities, from retiring legacy remote access with Zero Trust to monitoring through our Security Management Centre. We bring 27 years of enterprise delivery, 31 Netskope-certified architects and engineers, and ISO 27001 certification.
Not sure where to start? Talk to an expert.
Sources
- ASD’s ACSC Annual Cyber Threat Report 2025–26: Year in Review
- Annual Cyber Threat Report 2025–26: Executive summary
- Annual Cyber Threat Report 2025–26 (full PDF)
- ASD releases seventh Annual Cyber Threat Report
