Cyber Security Trends Every Business Should Know

Cyber security is no longer a problem only for banks and governments. In 2024–25, the Australian Signals Directorate (ASD) received more than 84,700 cybercrime reports — about one every six minutes (ASD).

The cost of each incident is rising fast. ASD's average self-reported cost per cybercrime report was:

For many small businesses, a single incident of that size is the difference between a good year and a bad one. The good news is that most attacks still rely on a small number of predictable techniques. Understand the trends and you can close most of the doors attackers use.

1. AI has made scams far more convincing

Phishing emails used to be easy to spot. Generative AI has changed that. Verizon's 2026 Data Breach Investigations Report found attackers now use GenAI for reconnaissance, phishing and malware development (TechRepublic / Verizon DBIR).

The most expensive version is the deepfake. In early 2024, a finance worker at engineering firm Arup's Hong Kong office joined a video call with what appeared to be the company's CFO and colleagues. Every other participant was a deepfake. He made 15 transfers totalling about US$25.6 million (CNN via ABC17).

Closer to home, email is still the front door. Email compromise and business email compromise fraud were two of the three most common cybercrimes reported by Australian businesses in 2024–25 (ASD).

First move: require out-of-band verification — a call to a known number — for any payment change or urgent transfer request, however senior the requester appears.

2. Unpatched software is now the top way in

For years, stolen passwords were the leading entry point. That has shifted. Verizon found exploited vulnerabilities accounted for 31% of initial access in breaches, ahead of credential abuse at 13% (TechRepublic / Verizon DBIR).

Organisations are slow to respond. Only 26% of critical, known-exploited vulnerabilities were fully fixed, and the median time to patch rose from 32 to 43 days. Attackers move far faster than that.

First move: keep an inventory of internet-facing systems and set a target to patch critical vulnerabilities within days, not weeks. Replace software that no longer receives security updates.

3. Your suppliers are part of your attack surface

Almost half of breaches now involve a third party. Verizon reported third-party involvement in 48% of breaches, up from 30% the year before (TechRepublic / Verizon DBIR). The same report noted a sharp rise in attackers abusing remote management tools — the software IT providers use to support their clients.

Every accounting platform, IT provider, payroll service and software integration with access to your systems or data is a potential route in.

First move: list the suppliers with access to your systems or data, confirm what each can reach, and ask how they protect it. Remove access that is no longer needed.

4. Ransomware is still here — with new legal obligations

Ransomware was present in 48% of breaches Verizon analysed, and small and mid-sized businesses made up the large majority of victims where organisation size was known (TechRepublic / Verizon DBIR).

Australian businesses also face a reporting duty. Since 30 May 2025, businesses with annual turnover above $3 million, and critical infrastructure entities, must report any ransomware or cyber extortion payment to ASD within 72 hours. There is no minimum amount and no grace period (MinterEllison).

First move: keep tested backups that ransomware can't reach, and make sure your incident response plan covers who decides on payment and who reports it.

5. Shadow AI is leaking data you can't see

Staff are using AI tools whether or not the business has approved them. Verizon found regular AI use on corporate systems rose to 45% of employees, up from 15% a year earlier — and 67% of users accessed AI services through non-corporate accounts on company devices (TechRepublic / Verizon DBIR).

That means customer details, pricing, contracts and code may be pasted into tools the business doesn't control, under terms no one has read.

First move: provide an approved AI tool with business-grade data protections, and publish a short, plain-English policy on what can and can't be shared.

6. Data breaches are at record levels — and regulators are watching

The Office of the Australian Information Commissioner received 1,205 data breach notifications in 2025, the highest since the scheme began in 2018 and about 8% more than in 2024. Around 59% resulted from malicious or criminal attacks (OAIC). Health service providers reported the most breaches, followed by financial services.

A breach now carries regulatory, legal and reputational consequences on top of the direct cost. Holding less data, for less time, reduces all of them.

First move: identify where personal information is stored, delete what you don't need, and know your obligations under the Notifiable Data Breaches scheme before an incident occurs.

7. Legacy technology and the quantum horizon

ASD's advice to organisations is direct: replace legacy technology or put mitigations in place, choose products that are secure by design, maintain good event logging, and begin adopting post-quantum cryptography. It also recommends working from an "assume compromise" mindset and prioritising your most valuable assets (ASD).

Post-quantum cryptography sounds distant, but data stolen today could be decrypted in future. Businesses that hold long-lived sensitive data should start asking their technology providers about their transition plans now.

First move: identify systems that are out of support or nearing it, and build their replacement into your budget and roadmap.

The trends at a glance

Where to start this quarter

Most businesses don't need an expensive overhaul. They need the basics done consistently. ASD's Essential Eight remains the best practical baseline for Australian organisations, and these steps cover the trends above:

1. Turn on multi-factor authentication everywhere, prioritising email, finance, remote access and admin accounts. Phishing-resistant methods are strongest.
2. Patch quickly and replace unsupported software.
3. Back up critical data to a location ransomware can't reach, and test that you can restore it.
4. Verify payments out of band and train staff to recognise deepfake and impersonation attempts.
5. Review supplier access at least annually.
6. Set an AI use policy and provide an approved tool.
7. Write a one-page incident response plan that names who to call, who decides and who reports.

Conclusion

The threats of 2026 are faster and more convincing, but they are not mysterious. They exploit predictable gaps: unverified payments, unpatched software, over-trusted suppliers, untested backups and unmanaged AI use. Businesses that close those gaps make themselves far harder targets than most of their peers.

Phalanx Digital helps businesses assess their cyber risk, put practical controls in place and govern the AI tools their teams are already using — so security supports growth instead of slowing it.

Sources and references

• Australian Signals Directorate — Annual Cyber Threat Report 2024–25: factsheet for businesses and organisations
• TechRepublic — Verizon 2026 Data Breach Investigations Report findings
• CNN via ABC17 — Arup revealed as US$25 million deepfake scam victim
• MinterEllison — Mandatory ransomware payment reporting obligations in force
• Office of the Australian Information Commissioner — Data breach notifications at all-time high in 2025