82,000 Reports: What ASD’s 2025–26 Threat Report Means for Your Board

The Australian Signals Directorate has released its seventh Annual Cyber Threat Report, covering the 2025–26 financial year.¹

The numbers

• More than 82,000 cybercrime reports, an average of one every six minutes.
• More than 1,500 cyber security incidents responded to.
• Over 4,400 notifications to Australian entities about potentially malicious activity, almost an 80% increase on the year before.¹

The report’s central theme is artificial intelligence. ASD says AI lets malicious actors operate with greater scale, speed and sophistication, making cyber-attacks, scams and phishing more efficient, effective and convincing.¹

Why it matters to the board

Read the notification figure carefully. Every one of those 4,400 notifications is ASD telling an organisation about suspicious activity it may not have spotted itself. A sharp rise means ASD is seeing more, and it suggests many organisations are still relying on someone else to raise the alarm.

The AI finding changes how to read your own controls. Phishing training built around clumsy grammar, and payment checks that trust a familiar voice, were designed for slower and less convincing attackers. If attacks are getting cheaper to run at scale, the question for boards is not whether they will be targeted, but whether detection and response are fast enough to matter.

Three questions for your next board meeting

1. In the last year, did we detect our own incidents, or were we told by ASD, a supplier or a customer?
2. Which of our controls assume an attacker who is slow, clumsy or easy to spot?
3. How quickly could we contain an incident outside business hours, and who decides?

How we help

We turn reports like this into a board-ready threat horizon brief for your organisation, and test detection and response against the techniques ASD is seeing. See the engagement, or brief a CISO.

• Threat Intelligence
• AI
• Board