Knowledge hub · Reports

Aegentra Reports

Research written to be quoted. Each report takes a primary source, usually a government or regulator publication, and does the work a busy reader cannot: reads the whole document, pulls every figure into one place, charts it, compares it with the rest of the world and says what it means for an Australian organisation. Every number is as its authority published it, every chart and every opinion is marked as ours, and the whole report is published on the page, every chapter open to read, with no form in front of it.

Published reports

Annual report · Edition 01 · Published 27 October 2026

Aegentra Australian Cyber Risk Report 2026

Aegentra’s Australian Cyber Risk Report 2026: cyber security statistics built on ASD’s 2025–26 threat report. Cost by business size, attack techniques, sectors.

Built on the ASD Annual Cyber Threat Report 2025–26, 1 July 2025 to 30 June 2026.

Cybercrime reports received through ReportCyber: 82,000+
Cyber security incidents ASD’s ACSC responded to: 1,524
Notifications of potential malicious activity sent to organisations: 4,400+
Average self-reported cost of cybercrime per business report: A$93,500

Inside the report

The year in one paragraph and the four numbers that define it
Cost of cybercrime by business size, and why the middle moved
The ten attack techniques ASD saw most, mapped to MITRE ATT&CK
Sectors and critical infrastructure: who reported what
Around the world: most targeted countries, breach costs and reported losses with flags
What ASD recommends for an organisation your size
What it means for an Australian SME, and the Aegentra view
Method, sources and how to read the figures

Read the report How Australia compares

Method

How an Aegentra report is built

Primary sources only

A figure enters a report from the document that published it: the ASD Annual Cyber Threat Report, the FBI’s Internet Crime Report, UK Finance, Japan’s National Police Agency, IBM’s Cost of a Data Breach study, and so on. Press coverage, vendor blogs and secondary round-ups are not sources. Where we could not open the primary document, the figure is left out.

Their numbers, our charts

Every statistic is reproduced as the authority published it, with the period it covers. The charts, the grouping, the country comparison and the commentary are Aegentra’s, and the report says so where they appear. A currency conversion is labelled as ours, with the exchange-rate date, and is never presented as a published figure.

Written for a decision

Each report ends with what the numbers mean for an Australian organisation of a given size, and with the controls that address the most common attack techniques. That section is opinion, it is marked as opinion, and it is written by the consultant who signs the report.

Published in full, on the page

Each report lives on one web page with every chapter expandable, so there is one copy and it cannot drift. There is no download, no form and no email required. The page carries its publication date, and a change to a figure after publication is dated in the method notes rather than made silently.

Free to cite

Quote any figure or chart with attribution to Aegentra and to the primary source the report names for it. Journalists, students, boards and competitors are all welcome; a link back is appreciated and not required.

Reports are written by Harry Sidhu — Director and Principal Consultant, Aegentra

How to cite

Aegentra (2026). The Aegentra Australian Cyber Risk Report 2026: cyber security statistics for Australia, in numbers. Melbourne: Aegentra. https://aegentra.com.au/reports/australian-cyber-risk-report

Questions

Questions about the reports

Are Aegentra’s reports free?

Yes. Every report is published in full on this site with no form, registration or email address in front of it. There is no PDF to download: the page is the report, every chapter can be opened on the page, and the browser’s print function produces a paper copy.

Where do the figures come from?

From primary documents only: government and regulator publications such as the ASD Annual Cyber Threat Report, national police and anti-fraud centre statistics, and named industry studies such as IBM’s Cost of a Data Breach report. Each figure is cited to its source and period where it appears.

How is the Australian Cyber Risk Report different from ASD’s own report?

ASD publishes the data; Aegentra’s report puts every figure in one place, charts it, adds a world comparison from other countries’ authorities, and says what the numbers mean for an Australian SME and which controls address them. ASD’s figures are reproduced as published; the analysis and the recommendations are Aegentra’s and are labelled as such.

Can I reuse the charts and figures?

Yes, with attribution to Aegentra and to the primary source named for the figure. Charts may be reproduced unaltered in articles, slides, board papers and coursework. Ask before redrawing a chart with Aegentra’s name on it.

How often are the reports updated?

The Australian Cyber Risk Report is annual and follows the ASD Annual Cyber Threat Report, which ASD publishes each year for the financial year just ended. Within an edition, a correction to a figure is recorded with its date in the report’s method notes.

Who writes them?

Harry Sidhu, Aegentra’s Director and Principal Consultant, with the firm’s consultants. The author is named on each report, which is what makes it checkable.