Email compromise is the most reported cybercrime against Australian businesses. AI now writes those emails in a supplier's tone, about a real invoice, at almost no cost to the attacker.
Source: ASD Annual Cyber Threat Report 2024–25, factsheet for businesses. Self-reported costs per report, FY2024–25.
Downtime, mandatory notification and stalled contracts follow an incident and sit outside its direct cost.
Ransomware encrypts the systems the business operates on, including email, finance and file storage.
Under the Notifiable Data Breaches scheme, an eligible breach is notified to the OAIC and to each affected individual.
Enterprise and government buyers issue security questionnaires before contract. Where evidence is missing, procurement stalls or the contract goes to a supplier that holds it.
An estimate from annual revenue and working days offline. It excludes recovery, legal costs and customers who do not return.
Based on 260 working days a year.
Revenue at risk is annual revenue ÷ 260 × days offline. The ASD figure is the FY2024–25 average self-reported cost per cybercrime report.
Generative AI writes convincing phishing in any language, researches a target from public sources and automates steps that took an operator days.
Emails in an executive's writing style that name real suppliers and real invoices.
A near-copy of the company domain, registered in minutes and used against its customers.
Widely deployed software is exploited within days of a vulnerability being published.
Contracts, customer data and source code entered into AI tools without approval.
Average self-reported cost per report (ASD, FY2024–25), excluding lost revenue, lost customers and regulator penalties.
Under A$1,600 a month across the three-year certification cycle. Secure60 performs about 80% of the work; customer input is scope, risk appetite, sign-off and the audit interview.
Secure60 identifies cyber and AI exposure, governs AI programmes and maintains compliance through the Secure60 security baseline or a certified framework.
