The warnings grew faster than the incidents
Start with the two growth rates, because they measure different things. Incidents responded to rose by more than a fifth. Notifications rose by almost four fifths. A notification is something the agency sends, in some cases to more than 2,100 entities at once. Of the incidents handled, 362 were identified after a proactive notification. Part of the 80% is therefore a detection and disclosure story. ASD found more, and told more organisations about it, than a year earlier.
The input side points the other way. Cybercrime reports, the public's own count, fell slightly, to more than 82,000 from 84,700. That does not mean attacks fell. It means the loudest number measures the agency's reach, and should not be quoted as the threat's growth rate without the incident figure, up a fifth, beside it.
Severity concentrated at the top
The distribution moved more than the total. Extensive compromises, the serious end of the centre's caseload, rose from 26 to 40. Extensive ransomware incidents rose from 16 to 24. Extensive compromises arising from denial-of-service activity rose from one to seven, in a year when denial-of-service incidents overall fell by more than 60%. Total ransomware incidents held at 139.
Government remained the largest target: federal agencies accounted for 32% of incidents, state and local government 16%, healthcare 7%. Manufacturing entered the ten most affected sectors with the largest increase of any sector. The pattern is not a broad rise in nuisance attacks. It is fewer, heavier incidents landing on organisations that run essential services.
The bill split by company size
The cost figures are self-reported averages per report, in Australian dollars, and they are not audited losses. Read with that limit, the split by size is the report's most useful table. The business average rose 16% to A$93,500. Medium businesses rose 45% to A$141,300. Small businesses were roughly flat at A$55,400. Large businesses fell 27% to A$148,100.
One possible explanation is that larger organisations have more resources to absorb and respond to incidents. The figures do not establish that security spending caused their reported costs to fall, or that medium-sized businesses faced the same attacks without the same defences. What the report does show is a sharp divergence in self-reported average costs: up 45% for medium businesses and down 27% for large ones. Without the underlying distributions and incident mix, the reasons remain uncertain.
Old holes, faster hands
For an AI headline, the mechanics in the report are familiar ones, done faster. The report's AI warning sits alongside a familiar set of operational problems: exploited vulnerabilities, patching delays and the need for tested incident response. It does not attribute the headline increases in incidents or costs to AI alone. Attackers exploited a vulnerability first identified in 2008. Publicly reported vulnerabilities rose 30%, and ASD observed some being exploited within 48 hours of a patch being released. The centre's advice is unchanged: multifactor authentication or passkeys, patching speed, a tested response plan. Its longer dated item is migration to post-quantum cryptography by the end of 2030.
The foreword, signed by Defence Minister Richard Marles, calls AI the defining force in the past year's threats and notes new threats emerging from the unintended actions of AI agents and model testing. Director-General Abigail Bradshaw told the ABC that with each jump in AI capability, "we are likely to see more disruption", including websites pulled offline for urgent patching. She singled out Anthropic's Mythos, a model held back from general release for its flaw-finding ability, and said ASD has set up early-warning arrangements with AI labs including OpenAI, shared with Five Eyes partners.
ASD also described its own offensive work: it said it got inside Amadey, information-stealing malware, and cut its operators off from about 180,000 infected computers worldwide, and in a separate operation destroyed about 4.8 million files stolen from Australians before they could be sold. Those are the agency's own claims. The same report urges organisations to take services offline when security requires it rather than leave them exposed. The operational lesson is straightforward: a controlled outage can be preferable to allowing a compromise to continue. The report does not quantify that trade-off.
Sources
- [1] Australian Signals Directorate, Annual Cyber Threat Report 2025–26, Australian Cyber Security Centre, October 27, 2026Read source
- [2] Australian Department of Defence, “Albanese Government works with public and private sector organisations to strengthen cyber resilience”, media release, October 26, 2026Read source
- [3] Australian Cyber Security Magazine, “ASD report flags AI-enabled cyber threats as incidents and business losses rise”, October 27, 2026Read source
- [4] Insurance Business, “AI will make cyber outages inevitable, Australia's top cyber official warns as business losses climb”, October 27, 2026Read source
- [5] The Oceania Cables, “Report: AI Is Making Cyber Attacks Faster and Cheaper to Run”, October 27, 2026Read source