Australia’s cyber threat environment is becoming increasingly complex as artificial intelligence accelerates malicious activity, cybercrime losses rise and state-sponsored actors continue targeting government, businesses and critical infrastructure, according to the Australian Signals Directorate’s latest Annual Cyber Threat Report.
Released today, the seventh Annual Cyber Threat Report 2025–26 says the Australian Cyber Security Centre received more than 82,000 cybercrime reports during the financial year, equivalent to one report every six minutes.
The ACSC responded to more than 1,500 cyber security incidents, an increase of more than 20% on the previous year, while issuing more than 4,400 notifications to Australian organisations about potentially malicious cyber activity, representing an increase of almost 80%.
The report identifies artificial intelligence as a defining development in the cyber threat landscape, enabling malicious actors to identify vulnerabilities, conduct social engineering and launch cyberattacks with greater speed, scale and sophistication.
The average self-reported cost of cybercrime for Australian businesses increased by 16% to $93,500 per report, although losses varied considerably according to business size.
Small businesses reported average losses of $55,400, while medium-sized businesses experienced a 45% increase to $141,300. Large businesses reported average losses of $148,100, down 27% compared with the previous year.
For individuals, the average self-reported cost remained approximately $33,000 per report.
Identity fraud remained the most commonly reported cybercrime, although reports declined by 18%.
Artificial intelligence reshapes the threat environment
The report warns that AI is lowering the technical barriers to cybercrime by enabling attackers to automate reconnaissance, identify vulnerabilities and develop more convincing phishing and impersonation campaigns.
The technology is also creating new security challenges as organisations increasingly integrate AI-enabled systems and autonomous agents into business processes.
In his foreword, Deputy Prime Minister and Defence Minister Richard Marles described AI as the defining force in the cyber threat landscape over the past year.
He warned that malicious actors were exploiting AI to discover and exploit vulnerabilities at unprecedented speed and scale, while emerging threats were also arising from the unintended behaviour of AI agents and model testing.
Marles said Australia must balance the opportunities offered by AI with a clear understanding of the associated risks, including the need to protect sovereign capabilities and national security interests.
The report also highlights the growing convergence of cybercrime, espionage and potentially disruptive state-sponsored operations.
Government and critical infrastructure remain major targets
Government organisations continued to account for the largest proportion of incidents reported to the ACSC, with federal government agencies representing 32% and state and local governments a further 16%.
Healthcare and social assistance was the most frequently reporting non-government sector, accounting for 7% of incidents, followed by professional, scientific and technical services and financial and insurance services, each representing 6%.
Manufacturing entered the ten most frequently reporting sectors, recording the largest increase in incident reports across all sectors.
The ACSC also responded to 139 ransomware incidents during the reporting period, broadly consistent with the previous year.
Although denial-of-service incidents declined by more than 60%, the report found that the consequences of some attacks were becoming more severe. Extensive compromises associated with denial-of-service activity increased from one incident in 2024–25 to seven in 2025–26.
Legacy vulnerabilities and supply chains remain weaknesses
Despite the emergence of increasingly sophisticated AI-enabled attacks, the ACSC continues to identify familiar security weaknesses as significant contributors to successful compromises.
Unpatched vulnerabilities, social engineering, compromised credentials and interconnected supply chains remain persistent risks.
The report notes that attackers successfully exploited a vulnerability first identified in 2008, demonstrating that longstanding weaknesses continue to provide opportunities for intrusion.
Publicly reported common vulnerabilities and exposures increased by 30% during the financial year, adding pressure on organisations to improve vulnerability management and patching practices.
The ACSC also warned that growing dependence on third-party providers and interconnected digital infrastructure can make individual compromises more difficult to contain.
These findings reinforce the importance of maintaining visibility across enterprise networks, operational technology environments and external service providers.
ASD expands proactive cyber defence
The report also highlights the expanding role of proactive threat detection and intelligence sharing.
Of the incidents handled by the ACSC, 362 were identified following proactive notifications to affected organisations.
More than half of individual notifications originated from declassified intelligence, providing organisations with actionable information about suspicious activity affecting their networks.
The Australian Protective Domain Name System processed more than 220 billion queries and blocked access to more than 564 million malicious domains.
Meanwhile, the ACSC’s Cyber Threat Intelligence Sharing platform expanded to more than 550 partners, distributing over one million indicators of compromise.
The agency’s Cyber Security Partnership Program also grew to more than 149,500 participants, reflecting broader engagement between government, industry and the Australian cyber security community.
Cyber resilience becomes a national security priority
The report places Australia’s cyber threat environment within a broader strategic context of geopolitical competition, espionage and threats to critical infrastructure.
Marles warned that cyber operations were increasingly being used by state-sponsored actors to advance strategic objectives below the threshold of conventional military conflict.
The report also identifies a growing overlap between espionage, sabotage and financially motivated cybercrime, complicating the task of distinguishing criminal activity from state-directed operations.
For Australian organisations, the findings underline the need to move beyond basic compliance towards demonstrable operational resilience, including incident preparedness, network visibility, vulnerability management and recovery capabilities.
The ACSC recommends stronger cyber hygiene, including multifactor authentication or passkeys, improved account security and timely reporting of suspicious activity.
While the annual figures reflect both malicious activity and changes in reporting and detection, the report presents an outline of increasing demands on Australia’s cyber defence capabilities.
The central challenge for Australian government agencies, businesses and critical infrastructure operators is maintaining security as AI-enabled threats accelerate and digital systems become more interconnected.
The Annual Cyber Threat Report 2025–26 is available through the Australian Cyber Security Centre.
