The short version
Most of the numbers are steady. Artificial intelligence has made familiar tricks faster and more convincing. And the things that protect a business your size are the same things that protected it last year. If you already have the basics in place, this report is a reason to check they're still working, not a reason to start again.
Where a 20-person business sits
ASD received more than 82,000 cybercrime reports in 2025-26 - about one every six minutes, and consistent with the year before. It breaks the cost of those reports down by business size, and a 20-person business sits right around the line between "small" and "medium", depending on how it's counted.
For small businesses, the average self-reported cost per report was $55,400, steady on last year. For medium businesses, it was $141,300, up 45%. Those are averages across the businesses that reported something, not a prediction of what any one business will lose. ASD also notes that most cybercrime likely goes unreported, so the real picture is bigger than the numbers suggest.
The useful takeaway isn't the dollar figure itself. It's that the cost of a problem grows quickly as a business grows - more staff, more systems, more suppliers, and more to put back together afterwards.
What's new: AI has sped things up
ASD describes AI as the defining force in the threat landscape over the past year. In practice, that means two things for a business like yours. Phishing emails are now cleaner and more convincing - the spelling mistakes that used to give them away are disappearing. And attackers can find and use known weaknesses faster than before. In ASD's words, "In the past, defenders had months to patch, now they have days, sometimes only hours."
It's worth keeping that in perspective, and ASD does.
"AI capabilities have not introduced new cyber threats, but they have amplified and sped up existing ones." - ASD Annual Cyber Threat Report 2025-26
What hasn't changed: the basics still matter most
When ASD analysed the techniques behind the incidents it responded to, phishing was the most common, appearing in 39% of them. Compromised accounts came next, at 21%. ASD also recorded a successful attack this year that used a weakness first identified in 2008 - a reminder that old, unpatched gaps are still being used.
None of this is sophisticated. It comes down to stolen passwords, convincing emails and software that hasn't been updated. That's genuinely good news, because those are problems a small business can fix with the tools it's most likely already paying for.
Six practical steps, drawn from ASD's advice
The report includes specific advice for small and medium-sized businesses. Here it is in plain English. Most of these are a conversation with whoever looks after your IT, rather than a new purchase.
Turn on MFA or passkeys everywhere
ASD names multi-factor authentication or passkeys as essential to reducing the likelihood of becoming a victim. Start with email and admin accounts, then extend it to every user.
Let updates happen automatically
ASD's advice for small businesses is to enable automatic updates. With the time between a fix being released and attackers using the weakness now measured in days, waiting for a quarterly patch cycle is no longer enough.
Know what's facing the internet
For medium-sized businesses, ASD recommends keeping an inventory of internet-facing systems. If nobody can quickly list your remote access tools, websites and cloud services, that's the place to start.
Retire what can't be updated
Old software and devices that no longer receive security updates were a major focus for ASD this year. Replacing them before support ends is the most effective option.
Be clear about who does what
ASD recommends clear responsibility for security monitoring and incident response. That's a conversation with your IT provider, not a technical project - and it's one worth having before you need it.
Rehearse the bad day
ASD suggests medium-sized businesses test their incident response and business continuity plans. Even a one-hour walk-through of "what would we do if email was down?" will surface gaps.
This is a business decision, not just an IT one
The line in the report most worth reading twice isn't about technology at all.
"Cyber resilience cannot be treated as a purely technical issue. It is a core business risk and leadership responsibility." - ASD Annual Cyber Threat Report 2025-26
Your IT provider can implement the controls. Deciding how much risk the business is comfortable carrying, and checking that what's been agreed is actually in place, sits with the owner or the board. That doesn't mean you need to become a security expert. It means you need a clear, honest view of where you stand.
A note on ASD Essentials
The report also confirms that, in October 2026, ASD released the Essentials series - the evolution of the Essential Eight. ASD says the Essential Eight "remains effective in preventing cyber security incidents", and that work already done on it can be carried forward. We've explained what that means for smaller businesses in Why your business should implement the Essential Eight.
The bottom line
The 2025-26 report doesn't ask small businesses to do anything dramatically new. It asks them to do the basics well, and to keep doing them as attackers get quicker. MFA on every account, updates that happen without anyone having to remember, and a clear owner for security will put a 20-person business in a strong position.
You can read the full report at cyber.gov.au.