ASD's 2025–26 Cyber Threat Report: the attackers got faster, the fix is still the basics

ASD’s Australian Cyber Security Centre (ASD’s ACSC) has released its Annual Cyber Threat Report 2025–26. It’s built on what ASD actually saw and responded to. This year’s message: the threats aren’t new, but they’re moving faster.

In ASD’s words, “AI capabilities have not introduced new cyber threats, but they have amplified and sped up existing ones.”

The report also lands alongside a big change to ASD’s own guidance. On 15 October 2026, ASD launched the ASD Essentials series, which evolves the Essential Eight into separate chapters for enterprise IT, operational technology (OT) and cloud. It’s pitched at larger organisations and critical infrastructure, but ASD says smaller organisations can use it where relevant. Some of you have already adopted it. Others are midway through Essential Eight work, which ASD is still maintaining during the transition. The 90-day list below works for both.

The findings that matter most

Incident numbers keep climbing. ASD’s ACSC responded to more than 1,500 cyber security incidents in FY2025–26. That’s up 20% on last year and 36% over five years.

The patching window is closing. ASD has observed most vulnerability exploitation happens within two weeks, and some CVEs get exploited within 48 hours of a patch or mitigation advice coming out. Publicly reported CVEs were up 30%. The report puts it bluntly: “In the past, defenders had months to patch, now they have days, sometimes only hours.” ASD even recorded a successful exploit of a vulnerability identified in 2008.

Attackers want your logins. In ASD’s analysis of incidents against the MITRE ATT&CK framework, phishing was the most prevalent technique (39%), followed by compromised accounts (21%). Valid accounts (15%) and exploiting public-facing applications (13%) were also in the top 10.

Helpdesks are a target. The report describes threat actors ringing IT helpdesks to get passwords reset and MFA tokens moved, then taking over accounts in single sign-on environments.

Ransomware isn’t more common, but it’s hitting harder. ASD responded to 139 ransomware incidents, about the same as last year. But extensive ransomware incidents rose from 16 to 24, and extensive compromises overall went from 26 to 40.

Mid-sized businesses are paying more. The average self-reported cybercrime cost per business report was $93,500, up 16%. For medium businesses it was $141,300, up 45%.

What this means if you’re running IT for a mid-sized organisation

The report doesn’t ask you to buy anything exotic. Unpatched systems, phishing, stolen credentials and social engineering are well-known weaknesses. What’s changed is how long you get to fix them.

• Monthly patching isn’t fast enough for internet-facing systems any more. If exploitation can happen within 48 hours, your VPN, firewall, remote access and web apps need a faster track than the rest of the fleet.
• Identity is now your perimeter. Phishing, compromised accounts and valid accounts all sit near the top of ASD’s list. For most organisations that means Microsoft 365 / Entra ID is where the attacker will turn up.
• Your people and processes are part of the attack surface. If someone on the phone can talk your helpdesk into resetting a password or re-registering MFA, your technical controls don’t count for much.
• Visibility decides how bad an incident gets. In one ASD case study, a ransomware victim’s event logs showed how the attacker got in, what they touched, and that no data was stolen, and backups got essential services back promptly.

Your next 90 days, in priority order

The order follows the report’s findings, and lines up with the Essentials enterprise IT chapter, which puts Boundary services and Identity services in priority phase 1 because they’re “common pathways for adversaries seeking initial access”. Two capability domains, Governance and culture and Visibility and response, run across every phase.

1. Know what’s exposed to the internet. Build or refresh an inventory of your internet-facing systems and switch off anything that doesn’t need to be there. ASD says “only necessary systems and services” should be exposed. (Essentials: Boundary services; Asset identification.)
2. Put internet-facing systems on a fast patching track. Aim for days, not weeks, for critical vulnerabilities on edge devices and public apps. Replace end-of-life kit or wall it off. (Essentials: Vulnerability management; Legacy system management.)
3. Lock down identity and Microsoft 365. Use phishing-resistant MFA or passkeys where you can. Review conditional access, strip back admin accounts, and check for legacy authentication and risky app consents. (Essentials: Identity services. The relevant actions call out phishing-resistant MFA and disabling legacy authentication.)
4. Fix the helpdesk reset process. Require strong identity verification before any password reset or MFA change, especially for privileged users. (Essentials: Identity services.)
5. Get logging right. Collect identity, endpoint, firewall/VPN and cloud logs centrally, and make sure someone actually watches the alerts. “Implement best practice event logging” is one of ASD’s five priority actions for this year. (Essentials: Visibility and response; Centralised event logging.)
6. Test your incident response plan and your backups. Run a tabletop exercise built around a ransomware or account takeover scenario, and prove you can restore. (Essentials: Cyber security incident response; Regular and proven backups.)
7. Get your framework position straight.
   • Still on the Essential Eight? ASD says the investment carries forward, and every Essential Eight strategy maps to at least one Essentials principle. Its Transitioning from the Essential Eight guide says to record your current position, scope the phase 1 domains, then do a gap analysis. Maturity levels don’t convert automatically into Essentials ratings, and some actions (supply chain security, content filtering, awareness training) have no Essential Eight equivalent. Keep meeting any regulatory or contractual Essential Eight obligations in the meantime.
   • Already on the Essentials? Use this report to check your sequencing. Phishing, valid accounts and exploited public-facing apps all point back to phase 1, so make sure Boundary services and Identity services are genuinely effective, not just deployed. ASD lets you change the order where threat intelligence shows a domain is being actively targeted, as long as you document why. If you’re predominantly SaaS, ASD’s Which chapter should I start with? guide points to the cloud chapter. If you run OT, add the OT chapter.

A note on OT and critical infrastructure

If you run operational technology, ASD describes threat actors getting into OT systems through insecure, internet-facing VNC connections, causing operational disruption including physical damage. Targeted sectors included water, food and agriculture, and energy. Critical infrastructure accounted for 10% of incidents (154), with phishing (36%) and valid accounts (16%) the top ways in. The Essentials for OT chapter orders things differently to enterprise IT for safety reasons, putting Boundary services and Critical processes and services in phase 1.

The common thread is visibility. You can’t defend OT you can’t see, and you can’t investigate an incident without good telemetry. A well-designed log pipeline can get the right data from IT and OT to the people who need it without blowing out storage costs.

Let’s talk

If you’d like a second opinion on where you sit against these findings, or which of the above to tackle first, book a 30-minute chat with me. No pitch deck, just a straight conversation.

And if something does happen, report it. ASD’s ACSC offers free incident response advice 24/7 at cyber.gov.au/report or 1300 CYBER1 (1300 292 371).

---

Source: Australian Signals Directorate’s Australian Cyber Security Centre, Annual Cyber Threat Report 2025–26 (published 26 October 2026); and ASD’s ASD Essentials series (published 15 October 2026), including Essentials for enterprise IT, Essentials for OT, Essentials for cloud, Transitioning from the Essential Eight and Which chapter should I start with?. © Commonwealth of Australia 2026, licensed under CC BY 4.0.