Cyber security for small business in Australia: where to start
Start with multi-factor authentication on every account, automatic updates, backups you have tested and a way for staff to report suspicious emails. Then get a review that shows what is exposed.
What attackers go after
Most attacks on small businesses are not clever. They use a stolen or guessed password, a convincing email, an unpatched laptop, remote access left open to the internet, or a file shared with the wrong people.
Small businesses are targeted because they hold money, customer data and access to bigger partners, and often have no one whose job is security. The fixes below cost far less than recovering from an incident.
A 4-week plan
- Week 1
- Turn on multi-factor authentication for email, Microsoft 365 or Google accounts, banking, accounting software and every administrator account. Remove accounts for people who have left.
- Week 2
- Switch on automatic updates for laptops, phones and software. Replace any device or program that no longer receives security updates.
- Week 3
- Check that backups run, are kept apart from your main network and can be restored. Restore one file to prove it works.
- Week 4
- Agree how staff report a suspicious email or payment request, and who they tell. Write down who to call if something goes wrong.
When to get help
Get a second opinion when you hold customer or health data, run Microsoft 365 for more than a handful of people, rely on remote access, or have never had your settings reviewed. A review finds the gaps you cannot see from the inside.
Our Microsoft 365 security review and vulnerability assessment give you a ranked list of fixes in plain English. You can start with the free cyber checkup.
Where to report and learn more
If you have been scammed or hacked in Australia, report it through ReportCyber, run by the Australian Signals Directorate. The Australian Cyber Security Centre publishes free guidance for small business.
Australian Cyber Security Centre (cyber.gov.au) (opens in a new tab)
Common questions
What is the most important first step in cyber security?
Multi-factor authentication on email and every administrator account. A stolen password is behind many incidents, and a second sign-in step stops most of them.
How much should a small business spend on cyber security?
There is no single figure. Start with the free steps above, then size spending to what you hold and how much downtime you could survive. A review gives you a ranked list so you can spend on the biggest risks first.
Do small businesses really get attacked?
Yes. Attackers often use automated scans and mass phishing, so size does not protect you. Businesses with weak sign-ins or unpatched systems are found quickly.
Do I need cyber insurance?
It can help with recovery costs, but insurers increasingly ask for controls such as multi-factor authentication and backups. Treat insurance as a back-up to those controls, not a replacement.
Start with the free cyber checkup.
The checkup is free and runs on its own site. If you would rather talk first, email the team.