The Australian Signals Directorate (ASD) has released its Annual Cyber Threat Report for 2025-26, and the headline for Perth business owners is simple: cybercrime is now routine, and it is expensive. ASD's cyber arm received more than 82,000 cybercrime reports in the year to 30 June 2026, roughly one every six minutes. The average self-reported cost to a business was $93,500, up more than 16% on the year before. For most small and medium businesses, a loss of that size is not an inconvenience. It is a serious hit to cash flow.
The numbers worth knowing
These figures come from the report as covered by Cyber Daily and Region:
- 82,000+ cybercrime reports in 12 months, about one every six minutes.
- $93,500 average self-reported cost for a business (up more than 16%). For individuals it was $33,000, unchanged.
- 1,500+ incidents ASD responded to directly, up 300 on the previous year.
- 4,400+ organisations notified that ASD had seen potentially malicious activity affecting them, almost 80% more than last year.
- The likelihood of an Australian organisation suffering an incident rose by more than 20%.
Two cautions. These are self-reported figures from people who bothered to report, so the real total is higher. And an average is pulled around by large losses, so your own outcome could be much smaller or much bigger. What matters is the direction: more incidents, more cost, more often.
What is driving it
ASD describes AI as the defining force in the threat landscape. It lets attackers find weaknesses, write convincing messages and run campaigns faster and at greater scale than before. We covered the joint Five Eyes warning on this in our recent post on AI and cyber risk.
The practical effect for a small business is that the old comfort of "we're too small to be a target" no longer holds. Automated attacks do not choose victims by size. They scan for anything unpatched, unprotected or easy to talk into a mistake.
The 4,400 notifications: what that tells you
One number deserves a closer look. ASD told more than 4,400 organisations that it had spotted potentially malicious activity connected to them. That is how many businesses learn they have a problem: a third party tells them, rather than their own systems.
If nobody is watching your environment, you will probably find out the same way, after the damage has started. Monitoring is not a luxury item. It shortens the time between "something is wrong" and "someone is dealing with it".
What a $93,500 loss looks like in practice
The average is a blend of very different incidents, but the pattern behind it is familiar. A staff member approves a fake invoice. A compromised Microsoft 365 account is used to redirect payments. A server is encrypted and the business cannot trade for days. The direct loss is only part of it. Add the time staff spend not working, the clean-up, the lost customer confidence and, in some cases, the legal duty to notify.
That is why prevention is almost always cheaper than recovery. A business that pays a modest monthly amount to keep its systems patched, protected and monitored is buying certainty about a bill it would otherwise face at the worst possible time.
Five practical steps for this quarter
ASD's advice is to strengthen patching, fix vulnerabilities quickly and prepare for disruption before an incident rather than after. For a Perth business, that translates into a short list:
- Patch faster. Critical updates for Windows, firewalls, VPN gateways and web platforms should be applied within days, not months. Attackers now exploit new flaws quickly.
- Turn on multi-factor authentication everywhere. Start with Microsoft 365 and any remote access. Prefer app-based or passkey sign-in over SMS where you can.
- Test your backups. A backup that has never been restored is a hope, not a plan. Keep one copy separate from your main network. Our backup and disaster recovery service covers this end to end.
- Know your reporting duties. If personal information is involved, you may have 30 days to assess and notify. Read our guide to the notifiable data breach rules before you need it.
- Report early. ASD asks organisations to report suspicious activity sooner. You can report cybercrime through ReportCyber at cyber.gov.au.
Where to start if you only have an afternoon
If the list above feels like a lot, begin with the Essential Eight, ASD's own baseline of eight controls. Our plain-English Essential Eight guide for Perth businesses explains what each one means and which to tackle first.
Then ask one blunt question: if our systems were locked tonight, who would we call and how long until we are working again? If the answer is unclear, that is the gap to close first.
Getting help
At Computer Mechanics we have supported Perth businesses since 1997, and our IT security solutions are built around exactly these basics: fast patching, MFA, tested backups and someone watching for trouble. If you would like a straight answer on where your business stands, call us on (08) 9325 1196.