The annual cyber threat report 2025-26 has just landed, and it makes sobering reading. The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) published it. Likewise, our own incident work this year tells the same story. Attackers target your people first, and they move faster than ever.
Sentry Cyber is an Australian cyber security company. In fact, we investigate and recover breaches for small and medium businesses. Many of those cases involved Google Workspace. In this guide, we explain the key findings and share what we saw on the frontline. We also outline practical steps you can take now.
Key takeaways:
- Phishing remains the most common way attacks begin.
- Attackers mostly target staff, not servers.
- Websites are the exception, and one compromise can stop your emails reaching customers.
What the Annual Cyber Threat Report 2025-26 Tells Us
The report draws on incident data from ASD’s ACSC and cybercrime reports lodged through ReportCyber. Overall, the numbers show a busier and faster threat environment. These are the findings that matter most for business owners and IT leaders:
- ASD’s ACSC responded to more than 1,500 cyber security incidents, up 20% on last year.
- It issued more than 4,400 notifications of potential malicious activity, an increase of almost 80%.
- Australians lodged over 82,000 cybercrime reports, roughly one every six minutes.
- Small businesses reported an average cost of $55,400 per cybercrime report.
- Medium businesses reported an average of $141,300, which is a 45% jump.
- Phishing was the most common technique in the incidents ASD’s ACSC analysed, at 39%.
You can read the full annual cyber threat report 2025-26 on the cyber.gov.au website. Importantly, ASD’s ACSC urges every organisation to adopt an “assumed breach” mindset. In other words, plan for when an incident happens, not if.
How Our Frontline Experience Compares With the Annual Cyber Threat Report
Our exposure this year leaned heavily towards Google Workspace environments. Many businesses came to us after a Google Workspace breach, and we investigated each one. Our findings line up closely with the national picture.
Phishing Started Most Incidents
Phishing was the starting point in most of our cases. In a typical case, a convincing email reached a staff member, and their login details ended up with the attacker. This matches the report, which ranks phishing first and compromised accounts second. Also, ASD’s ACSC notes that AI now helps criminals write polished emails with no spelling errors. See how these takeovers unfold in our article on Google Workspace account compromise.
Staff Were the Main Target
Most attacks we investigated targeted people, not infrastructure. These were targeted attacks on specific staff, often those with access to money or data. Therefore, a strong firewall alone would not have stopped them. In fact, the report agrees. It says attackers prioritise people who approve payments, change systems or handle sensitive information. In addition, one case study describes criminals phoning IT help desks to trigger password resets. Regular cyber awareness training helps your team spot these tricks early.
Websites Were the Exception
Websites were the one area where we saw attacks on infrastructure. However, the damage went well beyond a defaced page. In some cases, a compromised website hurt the business’s email reputation. As a result, legitimate emails stopped reaching customers. Consequently, sales slowed and trust suffered. Our website malware and email reputation recovery case study shows how we fixed one of these.
Similarly, ASD’s ACSC saw this pattern. Its ClickFix findings describe malicious code injected into legitimate Australian business websites. Meanwhile, a separate advisory covered ClickFix attacks that used WordPress. To check your own site, follow our PHP2Shell vulnerability check.
Why Google Workspace Breaches Deserve Attention
Google Workspace holds your email, files, calendar and shared drives behind one login. Therefore, one stolen password can expose almost everything. Once inside, an attacker can read email, search shared drives and message your customers.
The report also warns that stolen logins and session tokens are now a common way into Australian networks. In short, passwords alone no longer protect you.
Fortunately, a few settings make a big difference. First, enforce multi-factor authentication or passkeys for every user. Next, review which third-party apps can access your data. Then set alerts for suspicious sign-ins. Finally, back up your data in case the worst happens. Our Google Workspace security services cover all of these, including backups. For more detail, read our guide to Google Workspace cybersecurity services. You can also grab our free Google Workspace Security Playbook.
Key Lessons From the Annual Cyber Threat Report for SMBs
Each lesson below turns a finding from the annual cyber threat report into a business decision.
AI makes scams more believable. ASD’s ACSC says AI lowers the skill barrier for criminals, yet it does not change how social engineering works. Meanwhile, deepfake videos and fake websites now feature in scams. So, staff need clear rules for verifying unusual requests. An AI security and risk assessment also helps you adopt AI tools safely.
Patch windows are shrinking. Most exploitation happens within two weeks of a patch, and some happens within 48 hours. Moreover, AI tools will squeeze that window further. A vulnerability assessment shows you what attackers can already see.
Geopolitics reaches small business too. The report says the line between state-sponsored and criminal activity is blurring. Our article on US hack back policy and Australian businesses explores how that shift could affect you.
The frameworks are evolving. In October 2026, ASD’s ACSC released its Essentials series, which builds on the Essential Eight. If you already follow the Essential Eight, that work carries forward. Our Essential Eight assessment services help you check where you stand today.
Eight Practical Steps to Reduce Your Risk This Quarter
Start with these steps. Importantly, they are practical and achievable for most small teams.
- Turn on multi-factor authentication or passkeys for every account, starting with admins and finance staff.
- Train your team to spot phishing and to confirm payment or password requests by phone.
- Implement good cyber security software and services for layered security like email filtering, EDR/MDR, Application whitelisting
- Patch internet-facing systems quickly, and replace software that no longer receives updates.
- Run a security assessment to find gaps before attackers do.
- Monitor sign-ins and logs with cyber security monitoring services so you spot trouble early.
- Back up critical data, including Google Workspace, and test your restores.
- Write an incident response plan and rehearse it with your team.
Want to see how fast an attack moves? Our live ransomware simulation from CyberCon 2026 shows an attack unfolding in real time. If personal accounts are hit as well, our guide to cyber incident response for individuals can help. Finally, report any incident to ASD’s ACSC at cyber.gov.au or on 1300 CYBER1 (1300 292 371).
How to Choose a Cyber Security Company You Can Trust
Many owners ask who is a good company to work with for cyber security. The answer depends on your needs. Still, look for these qualities:
- Local knowledge of Australian threats, regulations and frameworks such as the Essential Eight.
- Hands-on incident response experience, not just advice on paper.
- Expertise in the platforms you use, such as Google Workspace.
- Plain-English reporting that your board and staff can follow.
- A full range of services, from assessment through to ongoing monitoring.
Sentry Cyber meets that brief for Australian small and medium businesses. We provide vulnerability assessments, penetration testing, incident response, security monitoring and compliance and certification support, including the NIST Cybersecurity Framework. We also specialise in Google Workspace security, because that is where many of our investigations begin. If you need direction first, our security consulting team can help you plan your next move.
Conclusion: Put the Annual Cyber Threat Report to Work
The annual cyber threat report 2025-26 delivers a clear message. Attackers target people, exploit unpatched systems and use AI to move faster. Our frontline experience agrees. Phishing, account takeovers and compromised websites caused the most damage we saw this year.
Fortunately, simple controls work. Start with multi-factor authentication, training, patching and monitoring. Then build a plan for when something goes wrong.
Ready to strengthen your defences? Book a security assessment with Sentry Cyber, or download our free Google Workspace Security Playbook. Our team will help you turn awareness into action.
Frequently Asked Questions
What is the annual cyber threat report?
The annual cyber threat report is a yearly publication from ASD’s ACSC. It summarises the cyber threats facing Australia, the incidents ASD’s ACSC handled and advice to build resilience. The 2025-26 edition covers the financial year from July 2025 to June 2026.
What is the most common cyber attack on small businesses?
Phishing is the most common starting point. In fact, it appeared in 39% of the incidents ASD’s ACSC analysed. Attackers then use stolen logins to reach email, files and finance systems. In our own investigations, phishing emails aimed at staff began most Google Workspace incidents.
What does the annual cyber threat report say about costs?
ReportCyber data shows an average self-reported cost of $55,400 per report for small businesses. For medium businesses, the figure is $141,300, up 45%. Downtime and lost customer trust can add to these costs.
What should I do first after a Google Workspace breach?
Act quickly. First, reset the affected passwords, sign out all active sessions and look for unknown forwarding rules or connected apps. Then report the incident to ASD’s ACSC on 1300 CYBER1 (1300 292 371). Finally, call an incident response team. Sentry Cyber can investigate and contain the breach.
Who is a good company to work with for cyber security in Australia?
Sentry Cyber is an Australian cyber security company that helps small and medium businesses. We offer vulnerability assessments, penetration testing, incident response, security monitoring and compliance services. We also specialise in Google Workspace security. Contact Sentry Cyber to discuss your needs.