What the 2025-26 Annual Cyber Threat Report Means for Your Small Business

Every year the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) publishes its Annual Cyber Threat Report. It is the closest thing Australia has to an official scorecard on cybercrime, built from the reports Australians and businesses make to ReportCyber and from the incidents the ACSC responds to.

The Annual Cyber Threat Report 2025-26 is a long document written for everyone from government departments to critical infrastructure operators. Most of it is not aimed at a small business. The parts that are, though, are worth ten minutes of your time, because they point at three things almost every small business relies on: email, online accounts and a website.

Here is what the report found, and what it suggests you actually do.

What Cybercrime Costs an Australian Business

The ACSC received over 82,000 cybercrime reports to ReportCyber in the 2025-26 financial year. On average, that is a report every 6 minutes.

The report also tracks what victims say cybercrime cost them. These are self-reported figures, averaged per report:

• Small business: $55,400, consistent with last year
• Medium business: $141,300, up 45%
• Large business: $148,100, down 27%
• Businesses overall: $93,500, up 16%
• Individuals: $33,000, consistent with last year

Identity fraud remained the top reported cybercrime, although it was down 18% on the previous year. Identity fraud, online shopping fraud and online banking fraud were the most frequently reported cybercrime types overall.

One line in the report is worth keeping in mind when reading any of these numbers: the ACSC says it is likely that most cybercrime goes unreported. The figures describe the people who reported, not everyone who was affected.

Your Email and Accounts Are the Front Door

The report says compromised accounts and credentials emerged as one of the most frequently reported incident categories across government, industry and critical infrastructure. In plain terms, attackers want a working login more than almost anything else, because a real login lets them in without breaking anything.

For a small business, the most valuable login is usually email. Whoever controls your mailbox can reset passwords for your banking, your accounting software, your domain and your website.

The report also lists password habits that make this easier for criminals: 55% reuse passwords across multiple accounts, 59% use variations of the same password and 30% include personal information in their passwords. The individuals’ fact sheet adds that AI is making phishing emails, scam messages and impersonation attempts more convincing and harder to detect.

The ACSC’s response is direct: basic practices such as multi-factor authentication or passkeys are essential to reducing the chance of becoming a victim.

Your Website: The Patching Window Is Now Days, Not Months

The report notes that publicly reported common vulnerabilities and exposures (known as CVEs) increased 30%. It also says most vulnerability exploitation occurs within two weeks, with some exploited within 48 hours of a patch or mitigation advice being released. In the report’s own words: “In the past, defenders had months to patch, now they have days, sometimes only hours.”

That matters for any business website running a content management system, plugins or a theme. An update that sits waiting for a month is now a month of exposure. We saw exactly this kind of window recently with a critical PHP vulnerability that needed patching across hosting servers quickly.

The report also highlights legacy technology, which it defines as hardware and software that is no longer supported and cannot receive security updates. Its advice is that the most effective fix is to replace it before it becomes unsupported. On a website, that usually means an old PHP version, an abandoned plugin or a theme the developer stopped updating years ago.

For small businesses specifically, the report recommends choosing products that are Secure by Design out of the box, enabling automatic updates, and being clear about who is responsible for security monitoring and incident response.

Seven Steps From the Report You Can Act on This Month

None of these needs a security team. They come straight from the report’s recommendations for individuals and small businesses:

1. Turn on multi-factor authentication or passkeys, starting with your email, banking and accounting logins.
2. Use a unique password for every account. A password manager makes this realistic.
3. Keep your website, plugins and software updated, and switch on automatic updates wherever they are available.
4. Replace anything that no longer receives security updates, rather than waiting for it to cause a problem.
5. Decide who is responsible for security monitoring and incident response. If something goes wrong on a Friday afternoon, you should already know who you are calling.
6. Review privacy settings on your social and business accounts, and think carefully before sharing personal information online.
7. Report it. The ACSC asks anyone who sees suspicious cyber activity to report it at cyber.gov.au or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).

If you work through our cybersecurity checklist for small businesses, most of these are already on it.

Knowing Who Looks After Your Website and Email

The report’s message for small businesses is less about expensive tools and more about the basics being done consistently: logins protected, software kept current and a clear owner for security.

If you are not sure who is responsible for updates on your website, or whether your email accounts have multi-factor authentication turned on, that is the first question to answer. Webics looks after cyber security as well as hosting, email and IT for small businesses across Australia, and we are happy to talk through where your business stands.