Cybersecurity: Protecting your small business

Cybersecurity is a global concern, and Australian small businesses are squarely in the firing line. According to the Australian Signals Directorate’s latest Annual Cyber Threat Report, the Australian Cyber Security Centre (ACSC) received more than 84,700 cybercrime reports in the 2024–25 financial year (one every six minutes). It responded to over 1,200 confirmed cybersecurity incidents, an 11% increase on the year before. 

The average self-reported cost of a cybercrime incident for an Australian small business reached $56,600 in 2024–25, up 14% on the previous year. These attacks can range from industrial espionage and financial theft to attempts to destroy carefully constructed business networks. Small businesses remain an attractive target precisely because their defences are often weaker than larger organisations’.

What can you do as a small business?

The good news is that a small number of practical steps go a long way. Here’s where to start.

Activate: Build your foundation

The Australian Signals Directorate’s Essential Eight is the government’s recommended baseline for this: eight practical controls covering application control, regular patching, restricting administrative access, multi-factor authentication and regular backups. It isn’t a one-off project (it’s an ongoing discipline), but even reaching the first maturity level makes a business a substantially harder target than an unprotected competitor. 

Multi-factor authentication alone is one of the simplest, highest-impact steps available: enabling it across your accounts can typically be done in a day, and it blocks the large majority of credential-based attacks. Reconsider who has access to your information (employees, managers, contractors) and whether that access is still appropriate.

Adapt: Keep pace with modern threats

The threat landscape has moved a long way from viruses and basic malware. Ransomware-as-a-Service has dramatically lowered the barrier to entry for cybercriminals: groups like LockBit, Akira and RansomHub lease out ready-made ransomware tools to affiliates, who carry out the attacks themselves in exchange for a cut of the ransom. 

At the same time, phishing has become harder to spot. Attackers are using generative AI to write emails that are far more convincing than the clumsy, typo-ridden scams of a decade ago — sometimes even mimicking a colleague’s or supplier’s writing style. The ACSC has published specific guidance for small businesses on managing these AI-related risks, alongside its more familiar advice on the fundamentals: keep software updated, stay aware of what’s currently circulating and don’t treat cybersecurity as “set and forget.”

Know your legal obligations

Beyond good practice, there’s a specific legal obligation to be aware of. Under the Notifiable Data Breaches scheme, businesses covered by the Privacy Act must notify affected individuals and the Office of the Australian Information Commissioner when a data breach is likely to result in serious harm. 

Most small businesses under $3 million in annual turnover are still exempt from this. But from 1 July 2026, that exemption no longer applies to accountants, lawyers, conveyancers, real estate agents and dealers in precious metals or other high-value goods, regardless of turnover. If your practice falls into one of these categories, the scheme now applies to you directly.

This doesn’t replace good prevention. But knowing what you’re required to do if the worst happens is now as much a part of running a compliant Australian business as lodging a tax return. Regardless of the size or type of your business, the internet is both an essential tool and a genuine risk. Staying safe means staying vigilant and staying prepared for the digital dangers that come with doing business online.

Small businesses can’t always afford the price that cyberdefenses demand. Contact Wilson Porter today for a business development plan and see where cybersecurity can fit into your budget.