No, cyber attacks didn't rise 80%. ASD's notifications did. Incidents rose 20% to more than 1,500, and cybercrime reports were flat. The real story in the 2025–26 Annual Cyber Threat Report is speed: AI is shrinking the time between a flaw going public and someone using it. Here's AI Lab Australia's read, and the boring, effective things a Sydney SME should do this month.
No, cyber attacks didn't rise 80%. ASD's notifications did. Incidents rose 20% to more than 1,500, and cybercrime reports were flat. The real story in the 2025–26 Annual Cyber Threat Report is speed: AI is shrinking the time between a flaw going public and someone using it. Here's AI Lab Australia's read, and the boring, effective things a Sydney SME should do this month.
On 26 October the Australian Signals Directorate published its seventh Annual Cyber Threat Report, covering the 2025–26 financial year. Within hours, headlines called it an "80 per cent surge in attacks", with your super next in line.
We read the report. It's more useful than the headlines, and less dramatic. Here's what it says, what it doesn't, and what we'd do if we ran a 20-person business in Brookvale or Parramatta.
The 80% figure is real. It just measures something else.
According to the report's foreword and executive summary, ASD's ACSC notified organisations of potentially malicious activity more than 4,400 times, almost 80% more than the year before. That's ASD tapping you on the shoulder to say "we've seen something that might be bad". It includes more than 2,200 individual notifications (up 33%) and collective notices sent to more than 2,100 entities at once.
Actual incidents ASD responded to rose 20%, to more than 1,500 (1,524 in the report's Figure 1). That's also up 36% over five years. Not nothing. Not 80%.
And the "one every six minutes" line? That's the 82,000-plus cybercrime reports made through ReportCyber. The Year in Review section calls that "consistent with last year". Calls to the Cyber Security Hotline actually fell 12%.
Why does it matter? Notifications partly measure ASD's own capability. The report says more than 51% of individual notifications came from declassified intelligence. One mass notice in May 2026, about cPanel vulnerabilities, went to 340 entities and turned up more than 60 confirmed incidents. More capacity means more notifications, whether or not the threat has grown.
None of that makes this good news. It makes it a different story, and that story is speed.
ASD's position is admirably un-hyped. From the executive summary: "AI capabilities have not introduced new cyber threats, but they have amplified and sped up existing ones."
That should calm you and worry you at once. The attacks are the ones you've heard about for years. They just arrive faster. The "Malicious use of AI" section puts it bluntly: "In the past, defenders had months to patch, now they have days, sometimes only hours." ASD had already observed that most exploitation happens within two weeks, with some flaws exploited within 48 hours of a patch being released. Its forecast is that AI tools will compress that window further over the next 12 months.
Two more numbers from the Year in Review. Publicly reported vulnerabilities (CVEs) rose 30%. And ASD recorded the successful exploitation of a vulnerability first identified in 2008. So the problem isn't only new flaws found by clever models. It's old ones nobody got around to fixing.
On social engineering, the report is equally measured: "AI lowers the skill barrier and increases scale, but does not fundamentally change the nature of social engineering attacks." Phishing emails without typos. Spearphishing at volume. Same con, better grammar.
For outside context, a UK AI Security Institute study tested frontier models on a simulated 32-step corporate network attack with no active defenders. The best run got through 22 steps. None finished. The robot that hacks your business by itself isn't here yet. The human using AI to go faster already is.
If you read one chart in the report, make it Figure 8 in the "Methods and tools" section. It maps incidents against MITRE ATT&CK techniques:
Most of that is people and logins. ASD says stolen usernames, passwords, tokens and sessions "are now among the most common pathways into Australian networks."
The case studies make it concrete. Scattered Spider rings IT help desks posing as employees to get passwords reset and MFA tokens transferred, then takes over single sign-on accounts. In August 2025 an Australian bank reported callers impersonating a Melbourne staff member, using details such as the employee's ID number and a story about not being able to connect on Microsoft Teams. The calls were traced to Hong Kong.
Picture your version. A Mona Vale builder on Microsoft 365. Someone rings the office manager: "It's Dave from site, I'm locked out of Outlook, can you reset me?" If the answer is "sure", your MFA just became decoration.
There's a developer angle too. ASD has tracked attacks on code repositories since September 2025, including a self-replicating worm, Shai-Hulud, that compromised hundreds of GitHub packages. If someone built you a small app or Xero integration, you have a software supply chain.
These figures come from the Year in Review section and are averages per self-reported case, so treat them as signals, not invoices.
The medium-business number is the one we'd underline. Our read, not ASD's: these firms are big enough to be worth the effort but often haven't grown their security to match. Three offices, a shared Google Workspace, finance on MYOB, and one person who "does the IT" on Fridays.
Severity is rising where volume isn't. Ransomware incidents were flat at 139, but extensive ransomware incidents rose from 16 to 24. Extensive compromises overall rose from 26 to 40. Data-breach incidents rose 66% to 98. And the OAIC recorded 1,205 notifiable data breaches in calendar 2025, the highest since the scheme started in 2018.
Health Care and Social Assistance is now the top reporting non-government sector, with Professional, Scientific and Technical Services second. Those two, plus Manufacturing, are hit hardest by ransomware. If you run a Dee Why physio clinic, a North Sydney accounting practice or a Wetherill Park fabrication shop, you're in the target demographic.
The super headline needs a correction. The report does not warn about superannuation. That warning came from APRA Deputy Chair David Bradbury, speaking at the AFR Super and Wealth Summit, as reported by the SMH. His words were conditional: an AI-amplified attack by foreign actors "could actually start to clean out people's accounts." A regulator worrying out loud, not a finding.
Fair worry, though. APRA's statistics put total super assets at $4.77 trillion at 30 June 2026.
What the report does say is in its critical infrastructure section. Financial and Insurance Services made up 30% of incidents affecting critical infrastructure, the largest share. The report also describes CART, the protocol that brings APRA, ASIC, the Reserve Bank and Treasury together during significant financial-sector incidents.
If you're APRA-regulated, none of this is new to your CPS 234 work. If you're a financial planner or mortgage broker in Chatswood who simply sits near that money, the help-desk and account-takeover lessons above apply to you directly.
The report's "What you can do" section tiers advice by size:
ASD also runs 2026 as its "Cyber Action Year", with five actions for every organisation: replace or mitigate legacy technology, implement best-practice event logging, manage your supply chain (including choosing Secure by Design), prepare for post-quantum cryptography, and prepare for AI-enabled threats.
And there's a framework change worth knowing. In October 2026 ASD released the Essentials series, which evolves the Essential Eight into a principles-based framework with chapters for Enterprise IT, Operational Technology and Cloud. ASD says the Essential Eight "remains effective" and that existing work carries forward, with transition arrangements running into 2027. Don't throw out your maturity assessment. Plan the move.
Ministers went further in their release on 26 October, asking organisations to "prioritise security over service availability" and to lower their thresholds for reporting to ASD.
Here's what we'd do in the next four weeks if we were a typical Sydney SME:
Post-quantum cryptography sounds remote, but ASD wants traditional asymmetric cryptography gone by the end of 2030, and suggests smaller firms lean on vendor-managed updates. This month's action: one email to your key software vendors asking about their plans.
The report doesn't tell you to avoid AI. It says Australian organisations "must embrace AI to improve resilience". Then it adds the part the TikTok version dropped. Businesses should use AI with controls, specifically "enforcing least privilege access, restricting data exposure to AI systems, validating outputs before use and maintaining auditability of AI-assisted actions."
That's four rules, and they map straight onto the AI projects we see in Sydney businesses:
ASD's own Careful Adoption of Agentic AI Services (May 2026) is worth reading before you give an agent your inbox. Our roundup of open-source AI security tools for AI agents covers practical ways to test and constrain them. And if you're not sure where your business stands, our AI readiness framework is a sensible first pass.
None of that changes the advice. It changes how loudly you repeat the numbers.
Did cyber attacks on Australia rise 80% in 2025–26? No. ASD's notifications to organisations rose almost 80%, to more than 4,400. Incidents rose 20%, to more than 1,500. Cybercrime reports were flat.
What does the ASD report say about AI? That AI hasn't created new threats but has amplified and sped up existing ones, shrinking the patch window to "days, sometimes only hours".
Does the report say super funds are being targeted by AI attacks? No. The superannuation warning came from APRA Deputy Chair David Bradbury in a speech at the AFR Super and Wealth Summit. The report does say Financial and Insurance Services made up 30% of incidents affecting critical infrastructure.
How much does cybercrime cost an Australian small business? The self-reported average was $55,400 per report for small businesses, unchanged on last year. Medium businesses averaged $141,300, up 45%. The overall business average was $93,500.
Is the Essential Eight being replaced? Evolved, not scrapped. ASD's new Essentials series (October 2026) has Enterprise IT, OT and Cloud chapters. Existing Essential Eight work carries forward, with transition arrangements into 2027.
What's the first thing a Sydney SME should do? Turn on MFA or passkeys across Microsoft 365 or Google Workspace, Xero or MYOB and banking. Then ban password or MFA resets over the phone without a call-back.
The report's real message is quieter than the headlines: the attacks are the same ones, they just arrive faster. That means the fixes are the same ones too, done sooner. Strong sign-in, a help desk that can't be talked round, fewer old systems on the internet, logs and backups you've tested, and AI used with guardrails rather than enthusiasm.
If you're a business in Sydney or anywhere in Australia working out how to adopt AI without widening your attack surface, our AI consulting team can help you scope it properly. Email us at info@ailabaustralia.com or get in touch, and we'll tell you straight what's worth doing first.
Source: © Commonwealth of Australia 2026, Australian Signals Directorate's Australian Cyber Security Centre, Annual Cyber Threat Report 2025–26, used under CC BY 4.0.
Get expert guidance on implementing ai security solutions for your Australian business
