The Australian Signals Directorate’s annual cyber threat report came out in late October, and the number most likely to reach your inbox is $55,400. That’s the average cost of cybercrime reported by a small business last financial year. Medium businesses reported $141,300, up 45%.
If you run 30 people, the fair question is whether that number is about you. Partly. Here’s how I’d read it.
What the number is, and what it isn’t
These are losses people chose to report through ReportCyber and estimated themselves. ASD says its self-reported figures “serve as a guide”, and that most cybercrime probably goes unreported. The report’s summary doesn’t spell out where small ends and medium begins, either.
It’s also an average, so a few big losses can pull it well above what a typical incident costs. Medium businesses jumped 45% while large businesses fell 27% to $148,100, which leaves those two sizes almost level. I wouldn’t read a trend into one year of that.
So $55,400 won’t tell you what an incident would cost you. It does tell you that businesses your size report losses big enough to hurt.
Work out your own number
This takes ten minutes and it’s more use than the headline:
- A week without your systems. What you couldn’t invoice, plus wages for people who can’t work.
- One redirected payment. Your largest regular supplier payment, gone to the wrong account.
- The clean-up. Outside help, and telling customers if their data was involved.
Now you have a figure you can weigh a fix against. A $5,000 piece of work reads differently once you know what it’s protecting.
What ASD says to do at your size
This part of the report is easy to miss, and it splits its advice by size.
Small businesses, it says, should choose products that are secure out of the box, turn on automatic updates, and be clear about who is responsible for security monitoring and for responding to an incident.
Medium businesses should keep a list of what they have facing the internet, patch quickly, separate their networks, and test their incident response and business continuity plans.
Everyone should keep only the necessary systems exposed to the internet. The reason it gives is that AI is shrinking the time between a flaw being found and someone using it.
ASD’s wider list also includes event logging and preparing for post-quantum cryptography. If you’re a 30-person business on standard cloud tools, I wouldn’t start there.
Where I’d start
Logins. Compromised accounts were among the most frequently reported incident types across government and industry. Multi-factor login or passkeys on email and anything holding money comes first. If you want to see how a mailbox gets used once someone is inside, I’ve written about what a compromised email account does.
Payment changes. In December 2025, ASD found more than 400 look-alike domains impersonating Australian construction companies and asking for urgent payments. No account had been broken into. Better email security doesn’t help much with that, but a rule does: nobody changes a supplier’s bank details without phoning a number you already had.
Old equipment. Replacing or managing technology that no longer gets security updates is the first item on ASD’s list. The piece that most often has no owner is the box connecting you to the internet, so I’ve written that up separately: who is patching your firewall?
You may also hear about ASD Essentials
ASD released a new framework in October that will replace the Essential Eight over time. The Essential Eight stays on ASD’s site alongside it, and no date has been set for the changeover. The reporting so far says Essentials is aimed mainly at government, critical infrastructure and big business. If someone offers you an urgent Essentials project for a small business, ask what it would fix that the steps above wouldn’t.
The report in short
Australians made more than 82,000 cybercrime reports to ReportCyber in 2025-26, about one every six minutes, according to the Australian Signals Directorate’s Annual Cyber Threat Report. Across all businesses, the average self-reported cost per report rose 16% to $93,500. By size, it was $55,400 for small businesses, unchanged from the year before, $141,300 for medium businesses, up 45%, and $148,100 for large ones, down 27%. Those are self-reported averages, and ASD treats them as a guide. Its advice for small businesses is to pick products that are secure by default, turn on automatic updates, and name who handles monitoring and incidents. Medium businesses are told to list their internet-facing systems, patch them promptly, segment their networks and test their response plans. Identity fraud remained the most reported cybercrime overall, and compromised accounts were among the most common incidents ASD responded to.
If something does happen
Report it at cyber.gov.au or call the Australian Cyber Security Hotline on 1300 292 371. If you want to think through what the first few days look like, I’ve written an honest walkthrough of a ransomware incident.
Next step
If you’d like a second opinion on your own number and what’s worth doing about it, get in touch. For the rest of your setup, see the cybersecurity assessment. The full report is free to read.