In today’s world, businesses around the globe, including in Australia, face increasingly sophisticated and innovative cybercriminals who target what matters most to them: their money, data and reputation. Critical business assets like bank accounts, email systems and business devices face compromise and are lucrative targets for malicious actors.
In the 2025–26 financial year, the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) received over 82,000 cybercrime reports – on average, one report every 6 minutes. According to ASD’s Annual Cyber Threat Report 2025–26, the average self-reported cost of cybercrime per report was $55,400 for a small business and $141,300 for a medium business (up 45% on the previous year).
How is cybersecurity different for SMBs?
Cyber criminals do not discriminate. Regardless of size, type or industry, businesses in Australia and around the world are under threat from cyber criminals. For Australia’s more than 2.6 million small businesses, the actions of cyber criminals can be devastating, leaving their businesses unable to recover. Small to medium businesses operate in a different environment compared to larger enterprises, with 97% of Australian businesses having fewer than 20 staff. With limited resources, many of these businesses lack the skills and experience to maintain a high level of cybersecurity. However, there are certain steps SMBs can take to prevent cyber criminals from hacking into their sensitive systems and networks.
What are the key cyber threats for SMBs?
A cyber attack is an attempt to disable computers, steal data, or use a breached computer system to launch additional attacks. Cybercriminals use different methods to launch a cyber attack. Below are three common types:
Malware
Malware is a blanket term for malicious software including ransomware, viruses, spyware and trojans. Malware gives criminals a way to gain access to important information such as bank or credit card numbers and login credentials. Malware can be used by criminals to spy on their victims or even take control of a victim’s computer system. SMBs make lucrative targets for criminals, as many of them lack the resources to detect and combat malware.
Ransomware
Ransomware is a form of malware that encrypts a victim’s files, systems or networks. A ransomware attack can bring a business to its knees, with an attacker holding its systems hostage until the ransom has been paid. Cybercriminals may also steal business information and threaten to publish or sell it unless a ransom is paid, which is known as data extortion. Small businesses can be particularly vulnerable, as they are less likely to implement cyber security measures that could help prevent and recover from ransomware.
Phishing
Phishing is a social engineering tactic that consists of an attacker sending an employee a fraudulent message via email, instant message or text message, in the hope that the unaware employee will click a link that downloads malware onto their system, freezes the system as part of a ransomware attack or reveals sensitive information of the organisation. Many SMBs do not adequately train their employees in information security best practices, which can make it hard for employees to identify and avoid phishing attempts.
How can these cyber threats be prevented?
Small to medium businesses can implement a number of best practices to avoid succumbing to cyber threats. Below are the top ways for SMBs to protect themselves from cyber criminals.
Regularly update software
Cyber criminals exploit known vulnerabilities to break into your devices, and regular system updates include the security fixes that close them. Making sure employees install the latest patches and updates to software reduces the chance that a cyber criminal uses a known weakness to get into your system or network. The easiest way to keep up is to switch on automatic updates for software and systems; where that option isn’t available, employees need to check for updates regularly. Devices and software that no longer receive security updates should be removed or replaced.
Maintain data backups
A backup is a digital copy of your business’ most important information, such as customer details and financial records, kept on an external storage device or in the cloud. Automatic backups run on a schedule without anyone having to remember to start them. Backups matter because data can be lost in many ways, from hard drive failures and ransomware attacks to human error or physical theft. Whatever the incident, a backup can let you restore the information stored on your devices.
Keep backups separate from your main systems and regularly test that you can restore from them. ASD’s Small Business Cyber Security Handbook notes that regular backups that are tested and stored separately are one of the most effective ways to reduce the impact of a ransomware attack.
Data backups can greatly reduce the downtime a business could face in the event of a ransomware attack.
Multi-factor authentication & strong passwords
SMBs should turn on multi-factor authentication (MFA) wherever it is available, starting with high-risk accounts such as email, banking, cloud storage and accounting software. MFA, such as two-factor authentication, requires another factor besides a username and password before access is granted, so a stolen password alone is not enough to get into an account.
SMBs also need to encourage strong password management practices among employees: passwords should be long, unique and never shared or reused across accounts, and they should be changed if they may have been compromised. Where MFA cannot be used, ASD recommends passwords of at least 15 characters, and passkeys are a more secure option where services support them. Good password management limits the damage if an attacker obtains login credentials – when every password is unique, the attacker’s access can be restricted to a single account.
Access control
SMBs need to implement access controls, so that only authorised employees can reach sensitive data and systems. Giving each employee the right level of access for their role and responsibilities limits how much damage a cyber attack can do, whether it comes from an external actor or from an internal error. Access should be reviewed whenever staff change roles or leave the business.
An effective method of implementing access control is by following the concept of least privilege.
Least privilege is defined as the strict assignment of access rights and permissions for users, accounts, applications, systems, devices and computing processes, to the absolute minimum so that assigned organisational activities can be carried out.
It gives users the bare minimum permissions they need to perform their work. It also lowers the chance that an ‘insider’ harms your business, whether by accident or on purpose.
Training & awareness
Security awareness training is a strategy SMBs should use to reduce the risk of their information security being compromised. These programs show employees clearly what their roles and responsibilities are in keeping information secure.
A successful security awareness program helps employees understand good cyber habits, the security risks that come with their actions and how to recognise the cyber attacks they may face in their everyday work. Human error remains a common factor in cyber incidents, so by giving employees thorough, regular training on information security, SMBs can greatly reduce the chance of a successful cyber attack and build a strong cybersecurity culture across the business.
How can StickmanCyber help?
Any business, big or small, is vulnerable to cyber attacks. But for small businesses, even small-scale cyber attacks can be incredibly damaging. They can severely impact how a business is run, wreaking irreparable financial and reputational damage.
Similar to how physical locations use back-to-base alarm systems, your business can benefit from qualified, certified and experienced cyber security experts who monitor, detect and respond to cyber attacks and threats targeted at your business’ computers and networks. StickmanCyber’s Startup/SMB plan includes 24/7 security operations centre (SOC) monitoring, dark-web monitoring, GRC advisory and third-party risk management for Australian small and medium businesses.
Not sure where your business stands? Talk to our team about the steps that will make the biggest difference for your business. Book a free consultation with a StickmanCyber expert.
Frequently asked questions
How often should a small business back up its data?
Back up important business and customer information regularly, ideally automatically as part of normal business operations. ASD suggests writing a simple backup plan that sets out what is backed up, when, where backups are stored, who manages them, how long they are kept and how often they are tested. Include information held in email and cloud accounts, and regularly check that you can restore it.
Should small businesses use a password manager?
Yes. ASD recommends using a password manager to create, store and fill in long, unique passwords, so staff are not tempted to reuse them. Because the password manager protects many important accounts, secure it with a strong, unique master password and multi-factor authentication. Add your most important business accounts first and use the manager to create passwords of at least 15 characters.
Is it safe for staff to share a login?
Shared accounts increase security risks and make it harder to track who did what. Create individual accounts for each staff member wherever possible. Where a shared login is unavoidable, keep a record of who has access, keep that group as small as you can and change the login details whenever someone leaves or changes roles.
What is business email compromise?
Business email compromise (BEC) is a targeted form of phishing in which cybercriminals impersonate a business contact, such as an executive, supplier or customer, to trick staff into transferring money, changing payment details or sharing sensitive information. Small businesses are often targeted because payment approvals can rely on email and trust. Verify any unusual payment request through a trusted channel, such as a known phone number.
What should a business do with devices that no longer get security updates?
Upgrade or replace them. Once a device, application or system reaches end of support, it no longer receives security updates from the manufacturer, so known vulnerabilities can stay unpatched and be exploited. Check when your devices and software will reach end of support and plan upgrades early. If something cannot be replaced straight away, ASD advises isolating it from your network and not storing important data on it.
Is antivirus software enough to stop hackers?
No. Security software such as antivirus helps detect and remove malware, and most modern Microsoft and Apple computers include it, but ASD notes that no software is 100% effective. Set it to run regular scans, and combine it with software updates, multi-factor authentication, backups and staff awareness to reduce the risk of a successful attack.
