AI Is Now the Defining Cyber Threat to Australian Business

Australia's cyber agency just named AI the defining threat

Australia's Signals Directorate has put a name to what changed in the last year. In its Annual Cyber Threat Report for 2025–26, released on 27 October, the Deputy Prime Minister, Richard Marles, called artificial intelligence “the defining force in the cyber threat landscape.” The number underneath that line is the one to sit with: the average Australian small business that reported a cybercrime lost $55,400. The agency now fields a report every six minutes.

What the report actually found

The ASD logged more than 82,000 cybercrime reports and 1,524 cyber security incidents over the year — incidents up 20 per cent. The cost per report held roughly steady for small business at $55,400, but climbed everywhere else: the average medium-business report rose 45 per cent to $141,300, and the all-business average 16 per cent to $93,500. These are self-reported figures lodged with ReportCyber, so they understate the real toll — the losses nobody reports don't show up at all.

AI's fingerprints are on the method, not a new category of attack. The report describes AI accelerating reconnaissance, vulnerability research, phishing and impersonation — the unglamorous middle of an attack, made faster and cheaper. That is the shift. The same scams, industrialised.

Why AI changes the maths for a small business

For years the thing that protected a small Australian business was obscurity and friction. A phishing email came in broken English; a scammer impersonating your supplier couldn't hold the tone. AI removes both. It writes a fluent, personalised email in seconds, mimics the cadence of a real supplier's invoices, and does it at a scale that used to need a call centre. The owner on the receiving end hasn't changed. The quality of the bait has.

The attack that lands hardest on SMEs is still the oldest one in the book: payment redirection. A fabricated or intercepted invoice, a quietly swapped bank account, a transfer you authorise yourself. We've written about how payment redirection cost Australian businesses $166.8 million in a year, and it rarely comes back — because from the bank's side, you sent the money. AI just makes the fake invoice look more like the real one.

There's a second edge the report sharpens. Every AI tool you switch on is a new door into the business — a phone agent that reads your calendar, a bookkeeping feature that touches every transaction. We've written before about how Australian SMEs adopted AI faster than they secured it; this report is the bill for that gap arriving. If you're not sure where your own exposure sits before you add the next tool, map it here.

What to lock down this month

The ASD's own top recommendation is dull, and it works: multi-factor authentication — or passkeys — on your email and your banking, everywhere, no exceptions. Email is the master key; once someone is inside it, every password reset flows from there. Second, lock the money door: never change a supplier's or an employee's bank details on the strength of an email or a phone call alone — ring back on a number you already had, and put a second approver on any payment above a threshold you set. Third, write the rules before the tools. A one-page policy on what staff may and may not paste into public AI tools costs nothing — the free template we pointed to still exists.

None of this is a reason to slow down on AI. The same report that names AI the defining threat is describing attackers who already use it — and the firms that respond by stalling their own adoption get the worst of both outcomes: the exposure without the productivity. The move is the opposite. Secure the basics, then adopt with confidence, and point AI at the defence too — the filters that catch the anomalous payment, the tools that flag the odd login — with a human still reading the output. If you'd rather map that in order — what to secure first, then where AI earns its place — a short conversation is the place to start.