Small businesses are still under-prepared for cyber attacks

Most small business owners know cyber attacks happen to businesses like theirs. Far fewer have the basic protections in place. Attackers now use AI tools to scan thousands of businesses at once for an easy way in, so a business with gaps is found faster than it used to be.

In its Annual Cyber Threat Report 2025–26, the Australian Signals Directorate recorded more than 82,000 cybercrime reports, one every six minutes. The average cost of a cybercrime reported by a small business was $55,400.

What the surveys show

In auDA’s Digital Lives of Australians 2026, a survey of 408 small business owners and managers, 92% said they hold personal or sensitive data about staff, customers or suppliers. Only 26% were very confident they could keep business data secure online.

The basic protections explain much of that doubt. Half of those businesses use multi-factor authentication where it is available, 18% provide staff training and 15% have an incident response plan.

Research by Ipsos for Optus, published in May 2026, found much the same. Sixty per cent of the 1,000 small businesses surveyed had no cyber plan in place, and around one in three said they had already been attacked.

Small businesses are a target

In the auDA survey, 38% of small businesses believed they were too small to be targeted. That group was also less likely to have the basics in place: 38% of them used multi-factor authentication, against 57% of businesses that saw themselves as a target.

Size has little to do with who gets attacked. Automated tools check thousands of businesses at a time for a reused password, an out-of-date system or an email domain that anyone can send from, and the businesses that turn up are the ones with gaps. AI tools now write the scam as well, as our story of Little Red Bookkeeping shows.

How many can you tick today?

Most of these cost little or nothing, and a business with all seven in place stops most of the attacks that reach small businesses. Each unticked box is a gap an automated scan can find.

Lock down your accounts

Multi-factor authentication on email, banking and accounting. A second check, usually a code or a prompt on your phone, means a stolen password is not enough on its own. Start with email, since whoever controls your inbox can reset most of your other passwords.

A password manager and no shared logins. A password manager creates and stores a different strong password for every account, so one leaked password opens one account. Shared logins hide who did what, and they keep working after the person who knew them has left.

Keep your systems safe

Automatic updates on computers, phones, apps and websites. Most updates close holes that attackers already know about, and AI tools help them turn a newly announced flaw into a working attack quickly. Turn on automatic updates wherever they are offered, and include your website and its plugins.

Tested backups, including Microsoft 365 or Google. A backup only counts once you have restored something from it. Keep at least one copy that ransomware on your network cannot reach, and restore a file every few months to prove it works. Email and documents in Microsoft 365 or Google Workspace need a backup of their own, because both services keep deleted items for a limited time.

Prepare your people

Staff awareness training on spotting scams. Short, regular training teaches staff the patterns behind current scams: an urgent payment, a new bank account, a request to keep something quiet. With 18% of small businesses providing staff training, this is one of the widest gaps in the auDA figures.

Call back before you pay on any change of bank details. A request to change bank details gets a phone call, on a number you already hold, before any money moves. The rule costs nothing and stops the fake invoice scams that AI tools now write so convincingly.

An incident response plan, on one printed page. List who to call (your IT provider, your bank, your insurer and ReportCyber at cyber.gov.au), who can approve payments and where the backups are kept. Print it, because an attack often takes email and shared files down at the same time.

Where to start

Start with the unticked box that protects the most money. For most businesses that is multi-factor authentication on email and the call-back rule for bank details, and neither needs new software or a large budget.

Most of these controls also appear in SMB1001, the Australian cyber security standard written for small and medium businesses, so the same work counts towards certification if your customers or insurer start asking for it.

Get help with the basics

If you want help working out which boxes your business can tick, or closing the ones it cannot, get in touch. Cyber People supports Sunshine Coast businesses on site, and Australian businesses remotely.

Sources: Australian Signals Directorate, Annual Cyber Threat Report 2025–26 (October 2026); auDA and SEC Newgate Research, Digital Lives of Australians 2026, as cited in auDA’s submission to the House inquiry into cyber security for small to medium sized businesses (August 2026); ARN, reporting on Ipsos research commissioned by Optus (6 May 2026).