Medium Businesses Now Lose Almost as Much to Cybercrime as Large Ones: What ASD’s 2025-26 Threat Report Shows

ASD’s Australian Cyber Security Centre published its Annual Cyber Threat Report 2025-26 on 26 October 2026. Most of the coverage has led with AI, which ASD calls the defining force in the threat landscape over the past year. For the businesses I work with, a different number matters more: medium businesses now report losing A$141,300 per cybercrime report on average, up 45%, almost level with large businesses at A$148,100.

A year ago the gap between medium and large businesses was wide. It has nearly closed, and not because large businesses got worse. This article sets out what the report found, why I think medium businesses are now carrying large-business losses with small-business controls, and what to check first.

Short answer

• The cost gap has closed. Average self-reported losses per report: small businesses A$55,400 (steady), medium A$141,300 (up 45%), large A$148,100 (down 27%).
• Identity is the front door. Phishing (39%), compromised accounts (21%) and valid accounts (15%) were among the most common techniques in the incidents ASD analysed.
• Incidents and warnings are both up. ASD responded to 1,524 incidents (up 20%) and sent more than 4,400 notifications of potential malicious activity (up almost 80%).
• What to check: multi-factor authentication or passkeys on every account that matters, how access is granted and removed, how fast internet-facing systems are patched, and whether staff can spot a convincing fake.

The numbers that matter

Source: ASD’s ACSC, Annual Cyber Threat Report 2025-26, Year in Review, published 26 October 2026. Costs are averages self-reported to ReportCyber.

The rest of the report fills in the picture:

• More than 82,000 cybercrime reports to ReportCyber, about one every six minutes, consistent with last year.
• 1,524 incidents responded to, up 20% on last year and 36% over five years. 362 were found because ASD warned the organisation first.
• 98 data breaches, up 66% and just over 6% of all incidents.
• 139 ransomware incidents, consistent with last year.
• Publicly reported vulnerabilities (CVEs) up 30%, and one successful attack exploited a vulnerability first identified in 2008.
• Manufacturing entered the top ten reporting sectors with the largest increase of any sector. Health care and social assistance was the most frequently reporting sector outside government.

Why medium businesses are being hit harder

ASD reports the numbers rather than the reasons, so this part is my reading as an auditor. Medium businesses, roughly 20 to 200 people, sit in an uncomfortable middle. They hold the data, the money flows and the supplier connections that make an attack worth the effort. Many are now suppliers to government and large companies, which makes them a way in to bigger targets. ASD notes that interconnected systems and supply chains make a single compromise far more complex.

Their controls, though, often look like a small business’s: an IT provider who handles “the computers”, multi-factor authentication on some accounts but not all, nobody whose job is to review who has access to what, and an incident plan that has never been tested. Large organisations have spent the last few years closing exactly those gaps, and the 27% fall in their average loss is consistent with that. Attackers follow the easier return.

Identity is the front door

The attack techniques ASD saw most often are almost all about people and logins, not clever exploits:

Source: ASD’s ACSC, Annual Cyber Threat Report 2025-26, Methods and tools (top six of the ten techniques shown in Figure 8).

ASD’s executive summary says compromised accounts and credentials emerged as one of the most frequently reported incident categories across government, industry and critical infrastructure, and that AI has made social engineering more convincing. Its first practical advice is passwordless or multi-factor authentication, such as passkeys. It is also urging an “assumed breach” mindset: plan on the basis that someone will get in, and limit what they can reach when they do.

AI, patching and the Essentials series

Two other threads in the report connect to recent changes. ASD says AI is reducing the expertise and effort needed to find and exploit vulnerabilities, which is likely shortening the time to exploit. Our article on AI in cyber security covers what that means for patching and where AI helps defenders. The report also confirms that ASD released its Essentials series in October 2026, evolving the Essential Eight into a principles-based framework. Our guide to ASD Essentials replacing the Essential Eight explains the change.

What an auditor checks in a 50 to 200 person business

If I were auditing a medium business against this report, these are the ISO 27001 controls I would test first, in this order:

1. Authentication (Annex A 8.5) and authentication information (5.17). Is multi-factor authentication or a passkey enforced on email, Microsoft 365 or Google Workspace, remote access, finance systems and every administrator account? “Most staff have it” is the answer that usually precedes an incident.
2. Access control and access rights (5.15, 5.16, 5.18). When someone leaves or changes role, how quickly is their access removed, and is there evidence? When were access rights last reviewed?
3. Awareness (6.3). Do staff know what an AI-written fake invoice or a voice clone of a director sounds like, and what to do? Is there a simple rule for verifying payment changes by phone?
4. Technical vulnerabilities (8.8). How fast are internet-facing systems patched, and what is still running that the vendor no longer supports? Our vulnerability management article shows why the dates matter.
5. Suppliers (5.19 to 5.22). Which suppliers hold your data or connect to your systems, and what do your contracts say about their security? Our article on supplier data breaches covers this.
6. Logging, monitoring and incident response (8.15, 8.16, 5.24 to 5.26). Would you know an account had been taken over, and has the incident plan been tested?

Our article on turning ASD alerts into audit evidence covers how to use reports like this one under Annex A 5.7.

Five questions for this week

1. Is multi-factor authentication or a passkey enforced on every email, cloud, finance and admin account, with no exceptions?
2. Who left the business in the last six months, and is their access gone everywhere, including shared accounts?
3. How would a staff member check that a request to change bank details is genuine?
4. Which of our systems face the internet, and when were they last patched?
5. If an account were taken over tonight, who would notice, and how quickly?

ASD Annual Cyber Threat Report 2025-26: FAQs

What is ASD’s Annual Cyber Threat Report?

It is the Australian Signals Directorate’s yearly assessment of the cyber threats facing Australia, published by its Australian Cyber Security Centre. The 2025-26 edition, published on 26 October 2026, covers the financial year to 30 June 2026.

How much does cybercrime cost an Australian business?

According to the 2025-26 report, the average self-reported cost per cybercrime report was A$93,500 for businesses overall: A$55,400 for small businesses, A$141,300 for medium businesses and A$148,100 for large businesses.

What is the most common cyber attack technique in Australia?

Phishing was the most common technique in the incidents ASD analysed in 2025-26, seen in 39% of them, followed by compromised accounts at 21%. Compromised accounts and credentials were among the most frequently reported incident categories.

Does ISO 27001 address the threats in the report?

Yes. The most common techniques map to ISO 27001 Annex A controls on authentication (8.5), access control (5.15 to 5.18), awareness (6.3), vulnerability management (8.8), suppliers (5.19 to 5.22) and incident management (5.24 to 5.26).

How Streamline can help

Streamline helps medium businesses build ISO 27001 information security management systems that put these controls in place and keep the evidence that they work. A gap analysis shows where you stand against the controls above, and our ISO mentoring service guides your own people through closing the gaps. For businesses working to the Essential Eight and ASD Essentials, we map the two together. Get in touch to talk it through.

Sources: ASD’s ACSC, Annual Cyber Threat Report 2025-26 (26 October 2026): Executive summary, Year in Review, Methods and tools, Cybercriminals and What you can do.