Australia’s latest cyber threat report: What small businesses need to know 

Australian small businesses are feeling the financial impact of cyberattacks. 

According to the Australian Signals Directorate’s (ASD) latest Annual Cyber Threat Report 2025–26, the average self-reported cost of cybercrime for small businesses was $55,400 per report. That’s a slight decrease from $56,600 in 2024–25, but still higher than the $49,600 recorded in 2023–24. 

However, the cost of cybercrime is only part of the story. 

The latest report reveals how artificial intelligence, stolen login credentials and increasingly sophisticated attacks are changing Australia’s cyber threat landscape. It also highlights the potential consequences for businesses, from financial losses and compromised customer data to disruptions that can bring everyday operations to a standstill. 

BizCover’s Chief Information Security Officer, Akshaye Kalkura, provides his professional insights on the latest report, what’s changed since last year, and what Australian SMEs need to know. 

The cybersecurity landscape is changing. Is your business keeping up? 

“The latest report shows that cybercrime remains a serious financial risk for Australian small businesses,” says Kalkura. “While the average reported cost has dipped slightly, more sophisticated attacks mean business owners can’t afford to become complacent. This is as much about protecting customer data, as well as a business’s ability to keep operating.” 

Volume and severity of attacks 

Cyber threats continue to put pressure on Australian businesses, with the latest figures showing an increase in cyber security incidents requiring assistance from the Australian Cyber Security Centre. 

In 2025–26, the ACSC received more than 82,000 cybercrime reports, equivalent to one every six minutes. It also answered over 37,500 calls to the Australian Cyber Security Hotline, averaging around 102 calls a day. 

The ACSC also took preventative measures and issued more than 4,400 notifications about potentially malicious cyber activity, an increase of almost 80% on the previous year. 

For SMEs, these figures are a reminder that cyber threats aren’t just a concern for large corporations. A successful attack could leave a small business unable to access essential systems, process customer payments or continue trading as usual.  

Cyberattacks are becoming more disruptive 

The number of extensive cyber security incidents increased from 26 in 2024–25 to 40 in 2025–26, according to the ACSC. 

“When the ACSC is talking about extensive cyberattacks, they are referring to incidents that are widespread or seriously disruptive,” explains Kalkura. “For example: an extensive cyberattack incident could mean losing access to essential systems, being unable to serve customers or facing costly interruptions to everyday operations.” 

Ransomware remains a particularly disruptive threat, with the ACSC responding to 139 ransomware incidents during the reporting period. Of these, 24 were classified as extensive incidents, up from 16 the previous year. 

The financial impact remains steady, but still significant 

In the year from 2023-24, the average self-reported cost of a cyber incident for small businesses was $49,600. It then jumped 14% in 2024-25 to $56,600. In the most recently published Annual Cyber Threat Report, that cost dropped marginally to $55,400. 

But while the cost may have dropped just slightly, this is still a substantial chunk of money for a small business to lose. And with cybercriminals using artificial intelligence and increasingly convincing scams to target businesses, both owners and their staff need to be on high alert for anything that looks even a little suspicious. 

What changes do SMES need to be aware of? 

From stolen login credentials to AI-powered scams and global cyberwarfare, here are some of the key threats Australian SMEs should be paying attention. 

Cybercriminals want access, not just data 

For SMEs, a compromised email or business account can spell big trouble. Cybercriminals can potentially use this level of access to impersonate staff, send fraudulent invoices to customers, redirect payments or steal confidential business information.  

“The issue here is that because attackers may be using legitimate login credentials, suspicious activity isn’t always immediately obvious,” says Kalkura.  

Phishing remains a major threat, appearing in 39% of cyber security incidents analysed (using the MITRE ATT&CK framework) in 2025–26. These attacks often involve fraudulent emails or messages designed to trick employees into revealing login details or clicking malicious links. 

Here’s one example of a successful cyberattack involving stolen credentials: 

The owner of a real estate agency fell victim to a cyberattack that left them locked out of their website and WordPress administration account. 

Cybercriminals deleted approximately 200 customer listings and uploaded numerous outdated listings. Existing customers could no longer log in, while new customers were unable to create listings, disrupting business operations. 

The agency’s software provider advised that the attackers had gained access using stolen login credentials and that its legacy software could no longer be supported. The provider subsequently terminated its service, forcing the business to rebuild its website at an estimated cost of $40,000. 

Fortunately, the business’s insurance claim was covered under the data restoration provision of its policy, and the insurance provider paid $51,000 for restoration costs and forensics.   

The growing threat of malicious AI use 

Artificial intelligence is making existing cyber threats faster, more scalable and harder to detect. 

The 2025-26 report highlights how cybercriminals are using AI to create convincing phishing emails, impersonate trusted individuals and identify vulnerabilities in business systems.  

AI is also helping malicious actors identify and exploit software weaknesses more quickly, potentially leaving businesses with less time to respond. 

For SMEs, this makes employee awareness, secure login practices and timely software updates increasingly important. 

“AI-generated messages can be tailored to seem convincingly legitimate. Deepfake audio and video can also make fraudulent requests appear to come from colleagues, suppliers or senior managers,” says Kalkura. “The advice I have for business owners and their staff is to always take a moment to think before they click on anything.” 

How cyberwarfare impacts Australians 

Cyberwarfare isn’t limited to governments or military operations. It can also affect Australian businesses through disruptions to essential services, technology systems and international supply chains. 

Ongoing geopolitical tensions are actively contributing to a complex cyber threat environment. State-sponsored cyber actors can target government agencies, critical infrastructure and private businesses to steal sensitive information, conduct espionage or gain access to systems for potential future disruption. 

For Australian SMEs, the impact can extend beyond being directly targeted. A cyberattack affecting an overseas supplier, software provider or critical service could disrupt business operations, even if the business itself hasn’t been attacked. 

The case for strong cybersecurity 

The ACSC report states that 64% of respondents said they had experienced cybercrime at some point in their life. Most alarmingly though, 45% were victims in the previous 12 months. 

This government data is backed up by a recent survey commissioned by BizCover. We found that 34% of survey respondents believed their business was too small to be likely to attract cybercriminals, while 25% thought they did not hold enough valuable data to be an attractive target. However, 43% of respondents reported at least one suspicious cyber incident or scam attempt in the previous 12 months. 

Practical cybersecurity measures for small businesses 

Having strong cybersecurity measures in place doesn’t necessarily require a massive budget. Small businesses can take simple but effective steps to better manage cybersecurity. These are some of CISO Akshaye Kalkura’s top tips: 

1. Keeping systems and software updated. 

2. Enabling multi-factor authentication (MFA). 

3. Deleting log in details for staff that are no longer with the company.  

4. Limiting access to sensitive information. 

5. Arranging regular cybersecurity training for staff.  

6. Using strong, unique passwords. 

7. Backing up important business data. 

8. Verifying unexpected requests (such as a request to change bank details). 

9. Creating a cyber incident response plan. 

10. Reviewing Cyber Liability insurance options. 

Cyber Liability insurance can help you manage many types of cybercrime (like cyberattacks, ransomware, and data breaches) by covering legal costs, data recovery, fines and penalties, and other expenses related to the cyber event. 

Get Cyber Liability insurance quotes from selected leading Australian insurers in minutes. For on the go cover, go BizCover. 

The claims examples are illustrative only and should not be taken as an indication of how any potential claim will be assessed or accepted. BizCover does not assess, manage, decide or settle claims, whether on your behalf or on behalf of any insurer. These, and whether a claim is covered, are determined solely by the insurer.