Introduction
The Australian Signals Directorate (ASD) has released its Annual Cyber Threat Report 2025–26, and one figure stands out for growing businesses. The average reported cost of a cybercrime for a medium-sized business has risen 45% in a year, to $141,300.
For most businesses with 20 to 150 staff, that is the cost of a new hire, a fit-out or a year of growth. Below, we break down what the report found, why businesses in the middle are being hit hardest, and the practical steps that reduce your risk.
Key takeaways
- Medium businesses now lose an average of $141,300 per reported cybercrime, up 45%.
- A cybercrime is reported in Australia roughly every 6 minutes, and Victoria accounts for 27% of all reports, the highest of any state.
- Phishing featured in 39% of incidents ASD analysed. Most attacks still start with an email, a stolen password or an unpatched system.
The numbers at a glance
The average cost of a reported cybercrime across all businesses rose 16% to $93,500. The rise was driven mostly by medium businesses.
| Business size | Average cost per report | Change on 2024–25 |
| Small business | $55,400 | Steady |
| Medium business | $141,300 | Up 45% |
| Large business | $148,100 | Down 27% |
| All businesses | $93,500 | Up 16% |
The wider picture from the year:
- 82,000+ cybercrime reports made to ASD’s ReportCyber, about one every 6 minutes
- 1,524 cyber security incidents responded to by ASD, up 20%
- 98 data breach incidents, up 66%
- 139 ransomware incidents, with health care, professional services and manufacturing among the most affected sectors
Costs are self-reported averages per cybercrime report. Source: ASD Annual Cyber Threat Report 2025–26.
Why medium businesses are being hit hardest
The report doesn’t give a single reason for the jump. In our experience working with businesses of 5 to 150 staff, medium-sized organisations often sit in a difficult middle ground.
- More to lose. They hold more client data, process larger payments and connect to more suppliers than a small business. That makes them a more valuable target.
- Small-business controls. Their security is often what was set up when the business had 10 staff. Typical gaps are multi-factor authentication (MFA) on some accounts but not all, shared admin passwords and no regular review of who has access to what.
- More people, more entry points. Every new staff member, laptop, app and remote login is another door. Without central management, those doors are hard to keep track of.
- No tested plan. Many medium businesses have backups but have never tested a restore or run through what happens if email or files are locked.
Large organisations tend to have dedicated security teams. Medium businesses usually don’t, but attackers now treat them the same way.
How most attacks start
The techniques ASD saw most often are not sophisticated. They rely on people, passwords and patching.
| Technique | Share of incidents analysed | What it looks like |
| Phishing | 39% | A convincing email asking someone to log in, open a file or approve a payment |
| Compromised accounts | 21% | A staff login stolen or reused from another breach |
| User execution | 17% | Someone opens a malicious attachment or link |
| Valid accounts | 15% | Attackers log in with real credentials, so nothing looks unusual |
| Social engineering | 13% | A phone call or message posing as a supplier, bank or IT support |
| Exploited public-facing systems | 13% | An unpatched firewall, VPN or website |
Two trends make these harder to spot:
- AI is making scams more convincing. ASD notes that AI is speeding up phishing, impersonation and the search for weak points.
Patching windows are shrinking. Reported vulnerabilities rose 30%, and ASD says most are exploited within two weeks. Some are exploited within 48 hours of a fix being released.
Six practical steps to take now
You don’t need an enterprise budget to reduce your risk. These steps line up with ASD’s own recommendations and the Essential Eight, and they address the attack techniques above.
- Turn on MFA everywhere. Cover email, Microsoft 365, remote access, banking and admin accounts, with no exceptions. Use phishing-resistant options such as passkeys or authenticator apps where you can.
- Patch quickly and confirm it worked. Apply security updates to computers, firewalls and business apps within days, not months, then check they actually installed.
- Tighten email security. Advanced email filtering stops most phishing before it reaches staff. Pair it with a verbal check for any change to bank details or payment requests.
- Train your people. Short, regular awareness training and phishing simulations help staff recognise a scam, including AI-written ones.
- Review who has access. Remove old accounts, limit admin rights and know which suppliers can reach your systems.
- Back up and test the restore. Keep secure, separate backups and test a restore at least quarterly. Write down who does what if systems go down.
Quick check: If you can’t answer “yes” to all six, your business is likely carrying more risk than it needs to.
How Managed Services Australia can help
Managed Services Australia is a Melbourne-based managed IT and cyber security provider. For 10 years we have helped Australian businesses with 5 to 150 staff build security that fits how they work. We cover:
- Essential Eight baseline. We set up and maintain Essential Eight Maturity Level 1 controls across Microsoft 365 and your devices.
- Advanced email security. In our pilot program it cut the junk, spam and phishing reaching client inboxes by about 70%. It also includes staff awareness training and phishing simulations.
- 24/7 threat detection and response. We monitor for suspicious logins and behaviour so issues are caught early.
- Proactive managed IT. Patching, backups, access reviews and support are handled for you, not left until something breaks.
Not sure where your business stands?
Book a free cyber security review. We’ll check your setup against the six steps above and give you clear, practical recommendations.
Book a cyber review · Call 1300 024 748 · [email protected]
Frequently asked questions
What is the ASD Annual Cyber Threat Report? It is the Australian Signals Directorate’s yearly summary of cyber threats facing Australia, based on cybercrime reports and the incidents ASD responds to. The 2025–26 edition covers 1 July 2025 to 30 June 2026.
How much does a cyber attack cost an Australian business? The average self-reported cost per cybercrime report was $55,400 for small businesses, $141,300 for medium businesses and $148,100 for large businesses in 2025–26.
What is the most common way businesses are attacked? Phishing. It featured in 39% of the incidents ASD analysed, followed by compromised accounts at 21%.
Is my business too small to be targeted? No. Attackers mostly use automated tools and mass phishing, so businesses of every size are hit. Small businesses averaged $55,400 per reported cybercrime.
What is the Essential Eight? It is a set of eight baseline security controls recommended by the ASD. They include MFA, patching, backups and limiting admin rights. Maturity Level 1 is a practical starting point for most small and medium businesses.
Where do I report a cybercrime? Report it to ASD through ReportCyber at cyber.gov.au, or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).
Sources
- gov.au: Annual Cyber Threat Report 2025–26 outlines cyber threats facing Australian businesses (published 28 October 2026)
- ASD: Annual Cyber Threat Report 2025–26
- SOCRadar: Australia’s Annual Cyber Threat Report 2025–26 analysis
- Streamline: ASD Cyber Threat Report 2025–26, what medium businesses face
Editor’s note: the incident, attack-technique and Victoria figures were taken from two independent summaries, which agree with each other. Check them against the full ASD report before publishing. The cyber.gov.au page blocked automated access.
🌐 Explore our services at Managed Services Australia.
📧 Dial 1300 024 748, shoot us an email at [email protected], or schedule a session with one of our IT specialists.
