Quick summary
Australian small businesses are not too small to be targeted. ASD's Annual Cyber Threat Report 2024-25 puts the average self-reported cost of cybercrime at $56,600 per report for a small business, up 14 per cent, and $97,200 for a medium business. Email compromise and business email compromise fraud were the most reported cybercrime threats for businesses. The good news is that the defences are well understood: the Essential Eight, applied properly and kept current. This guide covers the main threats, the Essential Eight in plain terms, what a sensible security setup looks like and your first 90 days.
On this page
- What ASD's figures say about small business
- Top 5 threats to small business
- The Essential Eight for small business
- A sensible security setup
- Why some IT providers fall short on security
- What good managed security looks like
- Getting started: your first 90 days
What ASD's figures say about small business
The Australian Signals Directorate (ASD) publishes an Annual Cyber Threat Report each year. The 2024-25 report, published on 14 October 2025, includes these figures for the 2024-25 financial year:
| Measure (FY2024-25) | Figure |
|---|---|
| Cybercrime reports to ReportCyber | Over 84,700, about one every 6 minutes |
| Average self-reported cost per report, small business | $56,600, up 14% |
| Average self-reported cost per report, medium business | $97,200, up 55% |
| Average self-reported cost per report, large business | $202,700, up 219% |
| Top self-reported cybercrime threats for business | Email compromise with no financial loss (19%), business email compromise fraud with financial loss (15%), identity fraud (11%) |
| Cyber security incidents ASD's ACSC responded to | Over 1,200, of which 11% included ransomware |
Source: ASD Annual Cyber Threat Report 2024-25.
ASD also notes that the vast majority of cybercrime goes unreported, so the real picture is worse than the reports show. And ASD's advice to businesses is consistent: use strong multi-factor authentication, keep software updated, be alert to phishing and back up important data. ASD says these basics can prevent the majority of the incidents reported to it.
Small businesses are attractive targets for a simple reason: they hold customer records, bank details and access to larger partners, often with fewer controls than a large company.
Top 5 threats to small business
Threat 1: Phishing and business email compromise
What it is: Emails that appear to come from someone you trust (your director, your bank, a supplier) asking for urgent action, usually a payment to a new account or a login on a fake page.
Why it works: Small businesses often have fewer checks on payments and changes to supplier bank details, and a convincing email at the end of a busy day gets through.
How to protect: Multi-factor authentication on email and finance systems, a call-back rule for any change to bank details using a number you already hold, two-person approval for larger payments, and regular awareness training. Business email compromise fraud was one of the top three cybercrime threats self-reported by businesses in 2024-25 (ASD).
Threat 2: Ransomware
What it is: Malware that encrypts your data and demands payment, often after stealing a copy and threatening to publish it.
Why it works: Many small businesses have backups that have never been restored, or backups the attacker can reach and delete.
How to protect: Backups that are separated from your normal admin accounts and restored on a schedule, multi-factor authentication, fast patching, application control and network segmentation. ASD's guidance is never to pay a ransom. See our ransomware protection guide.
Threat 3: Supplier and service provider compromise
What it is: An attacker compromises a supplier or service provider with access to your systems, then uses that access to reach you.
Why it works: Suppliers are often given broad, permanent access that nobody reviews.
How to protect: Give suppliers the minimum access they need, use separate accounts with MFA, remove access when the work ends and ask key suppliers how they secure their own systems.
Threat 4: Insider mistakes and misuse
What it is: Staff, contractors or former staff causing an incident, usually by accident (a misdirected email, a misconfigured share) and occasionally on purpose.
How to protect: Restrict admin privileges, give people access to what their role needs, and run a consistent offboarding checklist so leavers lose access on their last day.
Threat 5: Unpatched vulnerabilities
What it is: Attackers exploit known weaknesses in software and devices that have patches available but not applied. ASD's report notes publicly reported vulnerabilities increased 28 per cent in 2024-25, and that malicious actors can exploit internet-facing systems quickly once a weakness is public.
How to protect: Automated patching with internet-facing systems first. The Essential Eight maturity model expects patches for internet-facing services and devices to be applied within 48 hours when a vulnerability is critical or a working exploit exists.
The Essential Eight for small business
The Essential Eight is ASD's set of prioritised mitigation strategies. It is not only for government agencies and large companies; it is equally useful for a 10-person firm.
The eight strategies in plain terms
| Strategy | What it means for your business | How to start |
|---|---|---|
| 1. Application control | Only approved programs can run on your computers | Start with workstations, allow approved software only, and review exceptions |
| 2. Patch applications | Keep software up to date | Automate updates; patch internet-facing services within 48 hours when critical or exploited, other apps on a regular cycle |
| 3. Configure Microsoft Office macro settings | Stop malicious macros in Office documents | Block macros from the internet; allow only macros your business genuinely needs |
| 4. User application hardening | Configure browsers and apps to block risky content | Block web ads and Java in browsers, and stop users changing security settings |
| 5. Restrict administrative privileges | Limit who has admin access and how it is used | Separate admin accounts that are not used for email or web browsing |
| 6. Patch operating systems | Keep Windows, macOS and servers up to date | Automate updates and replace systems that are no longer supported |
| 7. Multi-factor authentication | A second factor to log in | MFA on email, remote access, cloud services and admin accounts |
| 8. Regular backups | Back up data, applications and settings, and prove they restore | Keep backups out of reach of normal admin accounts and test restores |
Maturity levels
The maturity model has four levels, Zero to Three. Maturity Level One is aimed at opportunistic attackers using commodity techniques, Level Two at attackers willing to invest more time and effort, and Level Three at more capable, targeted attackers. ASD recommends choosing a target level suited to your environment and reaching the same level across all eight strategies before moving up.
For most small businesses, Maturity Level One across all eight is the right first goal, with Maturity Level Two the common target after that. Our Essential Eight compliance guide goes into the detail.
A quick self-check
| Strategy | Not done (0) | Partly done (1) | Done well (2) |
|---|---|---|---|
| Application control | No restrictions on what can run | Some known-bad programs blocked | Approved programs only |
| Patch applications | No automated patching | Monthly patching | Automated, critical patches within 48 hours |
| Macro settings | Default Office settings | Internet macros blocked | Only approved macros allowed |
| Application hardening | Default browser settings | Some settings applied | Settings enforced and locked |
| Admin privileges | Shared admin accounts used for everything | Separate admin accounts | Separate admin accounts, reviewed regularly |
| Patch operating systems | Manual or no patching | Monthly updates | Automated, critical patches within 48 hours |
| Multi-factor authentication | None, or email only | Email and remote access | All online services and admin accounts |
| Regular backups | Irregular or none | Daily backups, rarely tested | Protected copies, restores tested |
This is a rough guide to where the gaps are, not a formal assessment. A score below 8 means the basics need attention; a formal Essential Eight assessment will tell you exactly where you stand.
A sensible security setup
You do not need a large security budget to cover the Essential Eight. For most small businesses the setup looks like this:
| Component | What it covers |
|---|---|
| A business Microsoft 365 plan with security features, configured properly | MFA, device management, email filtering, macro and browser settings |
| Automated patch management | Patching applications and operating systems on a schedule you can prove |
| A backup service with protected copies | Regular backups of Microsoft 365, servers and key systems, with restore tests |
| Admin account controls | Separate admin accounts and unique local admin passwords |
| Vulnerability scanning | Finding unpatched systems before attackers do |
| Security awareness training | Helping staff spot and report phishing |
The cost depends on your number of users, devices and systems. The bigger factor is usually not the tools but whether someone is configuring them properly and checking them every month.
Cyber insurers commonly ask about MFA, patching, backups and admin rights before offering cover. Having the Essential Eight in place, with evidence, makes those questionnaires much easier to answer.
Why some IT providers fall short on security
If your IT provider says they "handle cybersecurity", check what that means in practice:
| Activity | Checkbox approach | What should happen |
|---|---|---|
| Antivirus | Installed and assumed to work | Endpoint protection monitored, with alerts reviewed by someone who can act |
| Patching | "We patch monthly" | Critical and exploited vulnerabilities patched to ASD timeframes, with reporting |
| MFA | "Enabled on email" | MFA on all online services and admin accounts, with no standing exceptions |
| Backups | "Running daily" | Restores tested and documented, with protected copies |
| Vulnerability scanning | Annual scan, report filed | Regular scans with fixes tracked to closure |
| Essential Eight | "We are compliant", with no assessment | A maturity assessment, evidence and an uplift roadmap |
| Incident response | "We have a plan", never tested | A tested runbook with clear contacts |
The simplest test: ask your provider what your Essential Eight maturity level is. If they cannot tell you, with evidence, they are not managing your security.
What good managed security looks like
| Capability | Checkbox approach | What good looks like |
|---|---|---|
| Threat detection | Signature-based antivirus, alerts reviewed occasionally | Endpoint detection and response, with alerts reviewed by a person who can act on them |
| Incident response | Reactive, no tested plan | Documented runbook, tested in tabletop exercises, with clear escalation contacts |
| Essential Eight | Assessed once, if at all | Ongoing maturity tracking with evidence kept current |
| Patching | Monthly manual cycles | Prioritised patching to ASD timeframes |
| Vulnerability management | Annual scan | Regular scans with remediation tracked |
| Security awareness | Annual phishing test | Ongoing training and simulated phishing, with results reported |
| Backup integrity | Restores rarely tested | Protected storage and scheduled restore tests with documented results |
| Reporting | Annual summary | Regular reporting on maturity, open risks and progress |
What to ask when comparing providers
| Question | Why it matters |
|---|---|
| Is an Essential Eight assessment included or a separate project? | Many providers quote it separately |
| Is incident response included, or billed hourly when you need it? | Hourly incident response is costly at the worst possible time |
| How often are restores tested, and will we see the results? | Untested backups are a common reason recoveries fail |
| What reporting will we receive, and how often? | Without reporting you cannot tell whether security is improving |
Getting started: your first 90 days
Days 1-30: assess and baseline
| Action | Outcome |
|---|---|
| Essential Eight maturity assessment | Current maturity for all 8 strategies |
| Vulnerability scan across all systems | List of unpatched vulnerabilities with risk ratings |
| Backup restore test | Confirmation that backups can be restored, and how long it takes |
| MFA audit | List of systems with and without MFA |
| Phishing simulation | Baseline for staff awareness |
Days 31-60: quick wins
| Action | Outcome |
|---|---|
| Enable MFA on all online services and admin accounts | Stolen passwords alone no longer get attackers in |
| Deploy automated patch management | Patching on a schedule you can prove |
| Add a protected or immutable backup copy | Backups ransomware cannot delete |
| Configure macro restrictions | Blocks a common malware delivery method |
| Deploy browser security policies | Reduces web-based attacks |
Days 61-90: build on it
| Action | Outcome |
|---|---|
| Application control on workstations | Unapproved programs blocked |
| Separate admin accounts | No more shared, everyday admin accounts |
| Scheduled restore tests | Recovery capability proven, not assumed |
| Security awareness program | Staff who spot and report phishing |
| Incident response runbook tested | Everyone knows what to do and who to call |
By day 90 you should be at or close to Essential Eight Maturity Level One across all eight strategies, with MFA everywhere, tested backups, automated patching and a tested response plan.
If a breach does happen and personal information is involved, remember the Notifiable Data Breaches scheme: organisations covered by the Privacy Act must notify affected individuals and the OAIC when a breach is likely to result in serious harm.
Ready to secure your business?
Start with the self-check above, then work through the 90-day plan in order: MFA, patching and tested backups first. If you want help assessing your Essential Eight maturity and closing the gaps, see our managed cybersecurity service. If you would rather have security run as part of day-to-day IT, see managed IT services.