The $141,300 problem: what ASD's new threat report means for mid-sized organisations

Australians reported a cybercrime about every six minutes last year, more than 82,000 reports from individuals and businesses. ASD believes most cybercrime is never reported at all.

In the same year, the average cost for a medium-sized business rose 45%. For large companies it fell 27%. Small businesses held steady at $55,400.

Large companies can afford their own security teams. Most medium-sized businesses rely on a small IT team that is also keeping everything else running. ASD links the rise in costs to senior IT roles being out of reach for smaller organisations.

For an attacker, a medium-sized business holds enough money and data to be worth the effort, and has fewer people defending it.

ASD calls AI "the defining force in the cyber threat landscape over the past year". It is "reducing the expertise and effort required to identify and exploit vulnerabilities", so more people can launch attacks, and they can do it faster.

ASD says AI hasn't created new kinds of attack, but it has made existing ones faster and easier to run. Its Director-General, Abigail Bradshaw, expects more of the same: "with each capability increase, we are likely to see more disruption".

The time businesses have to react has shrunk. "In the past, defenders had months to patch, now they have days, sometimes only hours," the report says. Some flaws are exploited within 48 hours of a fix being released, and ASD expects AI tools to shorten that window further over the next 12 months.

There are also more flaws to fix. Publicly reported vulnerabilities rose 30% in the year.

In October, researchers used AI to find two critical flaws in PHP, the software behind most websites. The flaws had sat in the code for more than a decade. Within days of the fix being released, attackers were using them.

Many businesses still install security updates once a month. When attackers can act within days of a fix, a monthly routine leaves systems open for weeks. Critical fixes, especially on systems the internet can reach, now need to be implemented within hours, or at the very latest within 48 hours.

This year, ASD recorded an attacker successfully exploiting a vulnerability first identified in 2008. That flaw is 18 years old, and it still worked.

Old flaws stay open on technology that no longer gets updates: an ageing server, an old firewall, or software the supplier has stopped supporting. Microsoft ended standard support for Windows 10 in October 2025, so it no longer gets security updates unless you pay for an extension. Windows Server 2016 reaches the end of its support on 12 January 2027.

ASD's advice is to reduce old technology, starting with anything the internet can reach. The less of it you expose, the fewer ways in an attacker has.

AI makes scams harder to spot. Attackers use it to write phishing emails without the spelling and grammar mistakes that used to give them away.

AI can also produce convincing voice recordings and video of real people. ASD warns that these messages are often made to look as if they come from someone the victim knows, such as a colleague or senior manager. A voice message that sounds like your managing director asking for an urgent payment may not be your managing director.

Phishing appeared in 39% of the incidents ASD analysed, more than any other way in. In 21%, attackers used accounts they had already taken over, such as a staff member's email or login. Stolen usernames, passwords and sessions are now among the most common ways into Australian networks.

Some attackers simply phone the IT helpdesk. One group ASD describes researches staff online, then calls the helpdesk pretending to be an employee and asks for their password and multi-factor authentication to be reset. Once the helpdesk agrees, the attacker has the account.

ASD responded to 1,524 incidents in 2025-26, up more than 20%. In 362 of them, about one in four, the organisation under attack only found out because ASD told it. ASD sent more than 4,400 of these warnings during the year, up almost 80%.

For those organisations, the attacker was already inside and nobody in the organisation knew about it.

The first four come from ASD's advice to medium-sized businesses on defending against AI-enabled attacks. The fifth comes from its warnings about calls to helpdesks.

1. List everything you have on the internet. You can't protect a website, server or remote access tool you don't know about.
2. Fix critical flaws in days, not weeks. Start with the systems the internet can reach, and replace anything that no longer gets security updates.
3. Separate your networks, so one compromised device can't reach everything.
4. Test your incident and recovery plan. Know who makes which decision, and how quickly you can be running again.
5. Agree how your helpdesk checks who is calling before it resets a password or multi-factor authentication.

ASD also warns that "cyber risk assumptions can become outdated in months, not years".

Three questions to ask at your next board or leadership meeting:

• How quickly do we fix a critical flaw on a system the internet can reach?
• Would we know if someone was inside our network today?
• When did we last test our recovery plan, and what did we learn?

Most medium-sized organisations can't justify a full in-house security team. We work alongside your IT team to find the gaps, fix them in order of risk, and watch for attacks.

Our security operations centre monitors your systems 24 hours a day, seven days a week, including the nights and weekends when your own team is offline.

ASD Annual Cyber Threat Report 2025-26 · ABC, 27 October 2026 · Wiz Research: PHP2Shell · efex Cyber Brief: PHP2Shell · Windows 10 end of support · Windows Server 2016 end of support