Understanding the Real Cost of Cyber Attacks on Critical Infrastructure

Three numbers and a sentence

On 27 October 2026, Cyber Daily reported that Tony Burke, Minister for Home Affairs and Minister for Cyber Security, had warned that being under attack in Australia is "certain, constant and ever present". The warning came with the Australian Signals Directorate's seventh Annual Cyber Threat Report, covering the 2025-26 financial year.

The headline numbers, as Cyber Daily reports them: over 82,000 cybercrime reports, about one every six minutes; more than 1,500 cyber security incidents that ASD responded to; and more than 4,400 Australian organisations notified of potentially malicious activity. The average reported cost of cybercrime was $93,500 for businesses and $33,000 for individuals.

If you run a water treatment plant, a port, an energy network or a Defence-adjacent enclave, those numbers settle one question. Whether you will be targeted is no longer the debate. The question that stays open, and that no annual report can answer for you, is what a successful attack on your specific assets would cost, and how far anyone should trust the number you are given.

What ASD and the ministers said

The framing from government is blunt. Burke described the threat as "certain, constant and ever present" and said the response starts with protecting critical infrastructure and government systems. ASD's own statement, quoted by Cyber Daily, said that "it is vital that businesses prepare for service disruptions from a cyber incident". It also said that protecting critical infrastructure and essential services starts with strengthening cyber resilience, addressing vulnerabilities quickly and embedding strong cyber security practices before incidents occur.

The report also puts AI at the centre of the picture. Cyber Daily reports ASD describing AI as the defining force in the threat landscape, and Defence Minister Richard Marles said in his own statement that AI is enabling criminals and state-sponsored actors to launch faster, more sophisticated and scalable attacks. Our reading, not ASD's: the practical effect for a risk owner is speed. The gap between a weakness becoming known and someone trying to use it keeps shrinking, which squeezes the window that a quarterly register review was designed around.

Two details matter for what follows. First, the language is about disruption and preparation, not just prevention. Second, the numbers are counts. Cybercrime reports received. Incidents responded to. Organisations notified. They are measures of activity that someone saw, reported or was told about.

One caution on growth rates. Cyber Daily describes the 4,400 notifications as 80 per cent more than the previous year, while the headline on Industrial Cyber's coverage, which we could not open to read, describes a 20 per cent rise in incidents and a jump of nearly 80 per cent in threat notifications. We could not read the report to confirm which figure the 80 per cent attaches to, so we use the counts and leave the growth rates alone. The business average of $93,500 is up about 16 per cent on the $80,850 ASD reported a year earlier.

A count of what was seen is not a measure of what it costs

Look at what each number is. The 82,000 reports are things people chose to report. The 1,500 incidents are things ASD responded to. The 4,400 notifications are, on a plain reading, cases where someone outside an organisation saw activity that the organisation had not flagged itself. That last one is worth sitting with. It is a fair description of the telemetry problem: if you have no sensors on an asset, there is nothing on your side to notify you.

The $93,500 is an average of losses that businesses reported. It is a useful picture of a typical bad day for a typical reporting business. It cannot tell an energy network what a week without a control system looks like, because that cost is driven by things an average does not contain: how long the process stays down, what depends on it, whether it can be run by hand, what it takes to restore it and what is owed to regulators and customers while it is out.

The same limit applies to the 1,500 incidents. Each one cost its victim something, but the report counts responses, not dollars, and two incidents of the same type can differ enormously depending on what the affected system did. Frequency tables are good at telling you what is common and poor at telling you what is expensive. Those are different lists, and the expensive one is usually short.

Figure: the right-hand checklist is illustrative, not ASD's list. Left-hand figures as reported by Cyber Daily.

None of this is a criticism of the report. An annual threat report exists to describe the threat landscape, and it does. The mistake is to treat a landscape as a loss estimate. A board that reads "one cybercrime report every six minutes" and then asks its CISO "so what is our number?" has asked a fair question that the report was never built to answer.

When attack is certain, likelihood stops doing the work

Risk, in the FAIR taxonomy, is frequency multiplied by magnitude. A heatmap has a likelihood axis for a reason: for years the honest answer to "will this happen to us?" was "maybe", and ranking assets by how likely maybe was had some value.

If the answer for an exposed class of asset is now "yes, and repeatedly", the likelihood column fills with the same word. Every asset sits in the top row. The ranking between them has to come from somewhere else, and there are only two places left: how much each one costs when it fails, and what fails with it.

The first is loss magnitude, in dollars, with a range. The second is shared dependency. A single identity service, a single remote-access path, one maintenance contractor or one vendor appliance can take several assets down on the same day. A register that scores each asset separately will sit comfortably below the real bad day, because it treats the assets as independent when they share the same weather. We made the same point about a supermarket refrigeration attack: the cost was set by what the attacker could reach through a shared path, not by how clever the entry was.

This is also why a single maturity rating cannot stand in for a loss figure, a theme we covered when ASD Essentials replaced the single Essential Eight rating. A rating describes where you are on a ladder. It does not say what falling off costs.

Where the number is hardest to get

The assets with the largest consequences are often the ones with the least data. Operational technology that cannot be actively scanned without risking the process. Air-gapped and classified networks where no agent is permitted. Legacy systems that cannot run modern tooling. Third-party systems you do not administer.

For many of these, the working control for years was obscurity. Few people understood the protocols, the equipment was awkward to reach and the engineering knowledge sat with a handful of staff. Rubrik's Niraj Naidu, quoted in the same Cyber Daily article, put the point from the other direction: "technical complexity is not the safety net it once was", with AI shrinking the time between a flaw becoming public and someone trying to exploit it. Whatever you think of that view, it describes the control many unscannable assets have been quietly relying on.

You cannot scan your way to a number for these assets, so the number has to come from judgement. That is not a weakness. It is how most large risk decisions have always been made. The weakness is judgement that is undocumented, uncalibrated and held by one person. The useful version is structured expert estimates, with ranges, a record of who disagreed and why, and a track record that shows whose estimates have held up.

Calibration matters because experts are not equally good. Some are reliably overconfident, others reliably cautious. Asking five engineers for a number and averaging the answers hides that. Scoring their past estimates against what actually happened, and weighting what they say accordingly, does not. For operational technology and classified systems, where no scan will arrive to correct an estimate, a record of who has been right is the nearest thing to a sensor.

In nine years at the Australian Department of Defence building risk quantification for classified systems, the lesson that stuck was that the mathematics was never the obstacle. The obstacle was getting honest, defensible numbers out of busy experts without making the process painful. A method that experts will not use produces nothing, however good the model behind it.

Five things to do before Christmas

The bottom line

ASD has told the country, with numbers behind it, that being under attack is certain. That is useful, and it should end the argument over whether cyber risk is worth quantifying at all.

What it cannot do is price your plant. The report counts what was seen, reported and notified. Your board needs the part that was never counted: what your specific assets cost when they fail, how much of that is judgement, and how confident anyone should be in it. For the assets you cannot scan, that figure has to be built from calibrated expert estimates and written down so someone can challenge it.

For operators with obligations under the SOCI Act, the board attestation is signed by people who will want to know what stands behind the risk statements in front of them. A number with a range, written assumptions and a recorded challenge is something a director can stand behind. A colour on a grid is not.

Attack is certain. The number should not be a guess.

Bring one asset you can't scan. We'll put a number on it in 30 minutes.

Related reading

• ASD Annual Cyber Threat Report 2025-26 (primary report)
• Report: Aussie cyber agency received more than 82k cyber crime reports in 12 months, Cyber Daily, 27 October 2026
• Australia reports 20% rise in cyber incidents, nearly 80% jump in threat notifications, Industrial Cyber
• Supermarket Fridge Hack: Pricing Building Control Risk, CyQuantiFi
• Navigating the Transition to ASD Essentials, CyQuantiFi