This is general educational guidance, not an assessment of your business or a guarantee of security. Check the original sources and your specific requirements before acting.
What the report actually records
The ACSC reports receiving more than 82,000 cybercrime reports during the 2025–26 financial year. That figure counts reports received, not all crimes committed or a probability that a particular business will be attacked. The report also discusses incidents ASD responded to and notifications of suspicious activity.
Why small businesses should care
The report identifies stolen credentials and social engineering as significant ways attackers gain access. Its discussion of AI focuses on how both defenders and criminals can use more capable tools.
What to do first
Translate the report into basic controls rather than reacting to frightening headlines.
- Secure important accounts with MFA or passkeys.
- Keep devices, websites and applications patched.
- Confirm unusual invoices and payment changes independently.
- Test backups and maintain an incident response plan.
- Review the permissions of AI tools used in the business.
About this explainer
This is TASII’s plain-English interpretation for general education. Refer to the original report for methodology, detailed statistics and official recommendations. It is not an independent incident forecast or a technical assessment of any particular business.
Read the original guidance
The links below are from the original publishers. This article is independently written by TASII and does not imply endorsement.
- Annual Cyber Threat Report 2025–26Australian Signals Directorate · 26 October 2026
- Cybercriminals: 2025–26 threat landscapeAustralian Signals Directorate · 26 October 2026
- Small business cyber security handbookASD’s Australian Cyber Security Centre · 7 October 2026
- Defending against AI-enabled cyber attacks: Guidance for small businessesASD’s Australian Cyber Security Centre · July 2026
