The Aegentra Australian Cyber Risk Report 2026

A$33,000

Average self-reported cost per cybercrime report for an individual, consistent with last year.

42%

Share of all scam reports to ReportCyber made by people aged 25–34 and 35–44.

+15%

Change in reports from victims aged 17 and under; 48% of those reports related to cyber abuse.

−17%

Change in reports from Australians aged 65 and over; 51% of their reports were online fraud.

64%

Australians who have experienced cybercrime at some point in their life (Australian Cybercrime Survey 2025); 45% were victims in the previous 12 months.

21% · 21% · 11%

Most common cybercrimes in that survey: malware, identity crime and misuse, and fraud and scams.

55%

Reuse passwords across multiple accounts; 59% use variations of the same password; 30% include personal information in passwords (Act Now. Stay Secure. research).

57%

Do not review privacy or location settings; 64% have personally identifiable information visible on social media.

Replace or mitigate legacy technology

Hardware and software that no longer receives security updates. ASD’s Cyber Hygiene Improvement Program found a 31.7% reduction in end-of-life products across its customers between February and June 2026 once they were pointed out.

Implement best-practice event logging

So abnormal or malicious activity can be seen and investigated. The report’s ransomware case study credits logging with keeping a building-systems ransomware incident limited in scope.

Manage supply chains, including choosing secure-by-design products

Interconnected suppliers mean one compromise makes an incident far more complex to contain.

Prepare for post-quantum cryptography

ASD’s position is to cease using traditional asymmetric cryptography by the end of 2030, or sooner.

Prepare for AI-enabled cyber threats

The first four priorities are how: less exposed legacy IT, more visibility, secure-by-design products and modern cryptography all reduce what a faster adversary can reach.

The medium-business number is the one to put in front of a board

A 45% rise in average loss per report for medium-sized businesses, against a fall for large ones, matches what we see in scoping conversations: organisations of 50 to 200 people have outgrown the “too small to target” assumption but have not yet bought the controls, logging and incident playbooks that large enterprises take for granted. They carry enterprise-grade data on small-business-grade defences. That gap, not sophistication, is what the figure describes.

Four of the top five techniques are a people-and-identity problem, which is good news

Phishing, compromised accounts, user execution and valid accounts are not solved by buying a product; they are solved by configuration most organisations already own. In Microsoft 365 that is phishing-resistant MFA or passkeys, conditional access, blocking legacy authentication and a tested offboarding step. In our internal audits, access reviews and leaver processes are where the first nonconformities usually appear, and they are also the cheapest to close.

The patch window is now the honest measure of an IT provider

ASD recorded a flaw from 2008 being exploited and some new flaws exploited within 48 hours of a fix. If an organisation outsources IT, the question to put to the provider is not “do you patch” but “what is the median days from a critical patch release to deployment on our estate, and show me the report”. A provider who cannot answer with a number is reporting an aspiration.

Frameworks are converging on the same evidence; buy once

The report’s advice for medium businesses (asset inventory, prompt patching, segmentation, tested continuity plans) is the same evidence an ISO 27001 internal audit samples, a SOC 2 examination tests and an Essentials assessment will ask for. Building one evidence base, scoped to the organisation, and pointing each request at it is cheaper than answering each questionnaire from scratch. With ASD moving the Essential Eight into the Essentials series in October 2026, that is also the moment to review the mapping rather than rebuild it.

Identity is the control that pays first

Phishing, compromised accounts and valid accounts account for the top four techniques. Phishing-resistant MFA or passkeys, blocking legacy authentication and conditional access are the Microsoft 365 settings that address them directly; the report names MFA and passkeys as the essential basics. Microsoft 365 security hardening checklist.

Patch cadence is now a board metric

With CVEs up 30%, a 2008 flaw still being exploited and some flaws exploited within 48 hours of a fix, the question for a small IT team is not whether it patches but how many days a critical patch waits. Inventory of internet-facing systems is the medium-business recommendation in the report. Harden: Microsoft 365 and endpoint security.

Evidence beats assurance

Compromised accounts and credentials, extensive compromises up from 26 to 40 and data breaches up 66% are what an ISO 27001 internal audit tests for: access reviews, logging, offboarding and incident response, sampled from operational data rather than described in a policy. ISO 27001 internal audit.

A framework stops the next request being a surprise

Medium-business losses rose 45% in a year. Customers, insurers and tenders respond to that by asking for ISO 27001, SOC 2 or Essential Eight evidence. An ISMS scoped to the organisation turns each of those into the same body of evidence. ISO 27001 implementation.

Three different questions

“Where do attackers aim” (Microsoft, share of observed impact), “what does a breach cost an organisation” (IBM, per-incident average, same method in 16 places) and “how much did victims report losing” (each national authority, its own definition) are three different measures. Only the IBM series is comparable across countries.

Reported, not total

Every national figure is what was reported to that authority. ASD, the FBI, the CAFC and Singapore Police all say most cybercrime goes unreported; the Canadian Anti-Fraud Centre estimates 5 to 10 per cent is reported.

Currency conversion

The approximate USD column uses European Central Bank reference rates, 26 October 2026 (via frankfurter). It exists so the scale can be read across rows and is not a published statistic. Native-currency figures are the ones to quote.

Periods

Most rows are calendar 2025. ASD and New Zealand report financial years to 30 June 2026. India’s portal total is cumulative from 2021 to 2025 and is labelled as such. INTERPOL’s African loss figure is cumulative from 2019 to 2025.

What we did not use

Gartner research is licensed and its figures are spending forecasts, not losses, so none appear here. Headline “global cost of cybercrime” estimates in the trillions are modelled, not measured; their own publisher has cautioned against the growth rates others apply to them, so they are excluded.

Self-reported, per report

Cost figures are the average amount victims reported losing per cybercrime report to ReportCyber. They are not a national cost of cybercrime, not a cost per attack and not a survey of all businesses. ASD notes that most cybercrime likely goes unreported.

“Consistent” means under 5%

The report treats a percentage change of less than 5% as a similar or consistent trend and may not highlight it. “Consistent with last year” on this page carries that meaning.

Incidents are what ASD handled

Incident counts are cyber security incidents ASD’s ACSC responded to, categorised by severity, including unsuccessful incidents. They measure ASD’s workload as well as adversary activity; ASD itself notes improved reporting culture as a likely contributor.

Survey figures are the surveys’

The individual behaviour percentages come from the Australian Cybercrime Survey 2025 and the Australian Government’s Act Now. Stay Secure. campaign research, as reproduced in the report. Their sampling is described in those publications, not here.

Currency

All dollar figures are Australian dollars as published by ASD. No figure on this page is converted, rounded or recomputed.