In 2024/25, the Australian Cyber Security Centre (ACSC) received reports of a cyber attack every six minutes. Small businesses aren't immune. In fact, cyber criminals deliberately target small businesses because they know technology and security may be weaker. Fortunately, every small business has the opportunity to put preventive measures in place, and there is plenty of support available from government cyber security online resources as well as the expertise of Gallagher cyber risk management specialists.
Cyber risks can damage businesses financially, operationally and from a reputation perspective. Imagine if you couldn't log on or access your scheduling for the day or month, or someone took over your identity and started stacking up bills in your name, or broke into your e-mail, impersonated you and started sending invoices out to your customers with a fake account embedded into those invoices. These scenarios are day-to-day realities, so it's critical that you understand your risk and address it in the most effective way you can.
Common cyber threats
- Business email compromise — hacked email credentials used to scam money or goods
- Data breaches — unauthorised leaking of personal or sensitive information
- Hacking — infiltration of a business system by exploiting a software weakness
- Identity theft — impersonation of you or your business to steal money or other benefits
- Malware — malicious software such as 'Trojans', 'viruses' or 'worms' used to harm your system
- Ransomware — malware that locks up your system or encrypts essential files
- Scams — the impersonation of known brands or entities to obtain money
- System and network attacks — internal or external attempts to illicitly access your business systems
Ransomware continues to be a major threat to all Australian businesses, and small businesses specifically are constantly under attack. (Note: if you back up your business data regularly you are less likely to need to pay a ransom for its return.)
Essential steps for SMEs to safeguard their cyber security
The costs associated with data breaches, business downtime, legal fees and reputational damage are high. In the 2024-2025 financial year, the average cost per cybercrime reported to the ACSC rose to $56,000 for small businesses, up 14% on the previous year. This is enough to send some companies to the wall, but help is available — firstly through simple security measures and secondly through cyber insurance.
The first step would be to secure your systems and accounts by:
- Turning on multi-factor authentication
- Using strong, unique passwords (or a password manager)
- Putting automatic updates on your software (patching)
- Using security software — technical controls
- Backing up your info so it can be restored
- Securing your network and external services
- Resetting devices before selling or disposing of them
- Keeping your devices locked and physically secure
- Protecting your business data
- Educating employees — most attacks are the result of human error
- Making an emergency plan for a data breach
- Staying informed about cyber risks and security advice
The Australian Government provides support through its recommended risk management framework called the Essential Eight1. The government cyber.gov.au website provides clear directives for the specific controls that need to be implemented in order to achieve a reasonable level of cyber security for your business. There is a small business guide2 that which breaks these controls down into easy-to-understand sections.
Could your cyber security be jeopardised by your IT service provider?
We have seen an uptick in the incidence of expensive claims resulting from cyber attacks on IT service providers of small businesses. Often, these managed service providers have weaknesses in their own security, which then impact their clients.
Managed service providers are a major target for cyber criminals due to their ability to hit multiple victims in one attack. For this reason, you should be asking the following questions of yourself and your IT service providers:
- Do you have a written contract in place?
- Does it provide clear scope of their services?
- Is it clear who has the responsibility to manage your cyber security?
- Do you know what would happen in the event of a cyber breach?
- Is there a clear response plan in place?
- Who will pay for the cost of a cyber breach?
Why SMEs need cyber insurance
Cyber insurance is now accessible and affordable to businesses of all sizes. Your Gallagher cyber insurance broker can run scans of your IT environment and help you understand where your risks are.
Without insurance your business will bear all the costs involved with a data breach, which can escalate very quickly. Insurance provides protection from when you first suspect you have a problem until you're back to business as usual and gives you access to experts who guide you through all the steps involved.
Last updated March 2026
