Running a small or medium business in Australia today means juggling sales, staff, suppliers, and customer expectations, often with a lean team and a long to-do list. Cyber security tends to sit near the bottom of that list, right until something goes wrong. We’ve watched this pattern play out across the businesses we work with, and 2026 is shaping up to be the year that pattern needs to change.
The numbers tell the story plainly. The ASD’s Australian Cyber Security Centre received 84,700 cybercrime reports last year, working out to one every six minutes, while handling over 1,200 serious incidents, an increase of 11 percent on the previous year. Small businesses are absorbing a disproportionate share of the damage, with average losses of $56,600 per incident, up 14 percent year on year.
Below is a breakdown of the threats showing up most often, and what makes each one dangerous for a business that doesn’t have a dedicated IT security team watching the door.
Phishing and Business Email Compromise
Email remains the easiest way into a business, and attackers know it. A convincing email asking someone in accounts to update banking details, or a “supplier” chasing an overdue invoice, can slip past even careful staff on a busy Monday morning.
Recent reporting shows just how common this has become. Email compromise incidents with no immediate financial loss made up 19 percent of reports, often acting as reconnaissance before a larger fraud attempt, while Business Email Compromise with actual financial loss accounted for 15 percent, typically involving fake invoices or redirected payments.
What makes this category tricky is that it doesn’t rely on hacking in the traditional sense. It relies on trust, urgency, and routine. A few warning signs worth flagging to staff:
Requests to change payment details arriving via email rather than a phone call
Slightly altered email addresses that look correct at a glance
Pressure to act quickly, bypass usual approval steps, or keep a request “confidential”
Invoices from familiar suppliers with new account numbers
Ransomware Targeting Smaller Operators
Ransomware has shifted from a headline-grabbing enterprise problem to something far more democratic. Attackers now run automated scans across thousands of businesses at once, and the criteria for getting flagged are uncomfortably simple.
The pattern is consistent: cybercriminals use automated tools to scan thousands of businesses looking for vulnerabilities, and when they find a small business with outdated systems, untrained staff, or no multi-factor authentication, they move in.
Once inside, the mechanics are brutal in their simplicity. Files get encrypted, operations stall, and a payment demand appears. The frustrating part is that paying doesn’t guarantee a clean outcome. Even paying the ransom doesn’t guarantee data won’t be leaked or that the business won’t be targeted again. For a business reliant on its website, booking systems, or customer database to function day to day, even a short outage can mean lost bookings, frustrated customers, and a scramble to communicate that everything is “back to normal soon.”
Compromised Websites and Supply Chain Risks
A business website is often the public face of the brand, and increasingly it’s also a target. WordPress sites in particular have been flagged in recent advisories. Government cyber authorities have noted threat actors targeting Australian networks with a social engineering technique called ClickFix, used to distribute malware through compromised WordPress websites.
A practical defence playbook often starts with this exact issue, because a website isn’t a “set and forget” asset. Plugins, themes, and hosting environments all need attention over time. Vulnerabilities in widely used hosting management software have also been flagged this year, with one advisory referencing exploitation of a vulnerability affecting cPanel/WebHost Manager, a platform many small business hosting plans run on.
Three things tend to slip through the cracks for SMBs managing their own sites:
Outdated themes or plugins that haven’t been updated in months
Shared hosting environments where one compromised site can affect neighbouring accounts
No clear process for who is responsible for applying security updates
The State of Compliance and Reporting Obligations
Cyber security regulation in Australia has been tightening, and 2026 has brought it closer to everyday business operations rather than something only large corporations need to think about. Ransomware reporting obligations now apply to businesses meeting certain thresholds, which means a cyber incident isn’t purely an operational problem anymore. It can carry a reporting requirement attached to it.
Frameworks that were once aimed squarely at government and critical infrastructure are also filtering down. The shift in tone is notable: in 2026, cyber security is no longer just a technical function, it’s a core business capability, a compliance obligation, and a determinant of national resilience. The Essential Eight framework, originally built for larger organisations, is increasingly used as a reference point for what “reasonable” security looks like across the board.
For an SMB, this doesn’t necessarily mean adopting every control overnight. It means understanding which obligations apply, and having a clear picture of where the gaps sit. setting up a cyber security policy is usually the natural starting point for businesses trying to work through this without overhauling everything at once.
The Cost of Getting Caught Out
It’s worth sitting with the financial reality for a moment, because it changes how the risk feels. Across all Australian businesses, the cost of cybercrime surged 50 percent overall to an average of $80,850 per incident. For small businesses specifically, that average sits at $56,600.
That figure rarely accounts for everything, though. Beyond the direct loss, there’s the time spent rebuilding systems, the awkward conversations with customers whose data may have been exposed, and the dent to reputation that doesn’t show up on a balance sheet but shows up in bookings, reviews, and referrals. As one industry summary put it, these incidents represent stolen invoices, fraudulent transfers, compromised data, and long nights spent rebuilding systems.
Government guidance has shifted accordingly. The ACSC urges all organisations to adopt an “assume compromise” mindset, treating every system as potentially vulnerable and focusing on detection and containment. That’s a meaningful shift from the older idea that good security just means keeping attackers out entirely.
Building Habits That Actually Hold Up
None of the threats above require a business to become a cyber security expert overnight. What they call for is a shift from reactive thinking (“we’ll deal with it if it happens”) to a small set of habits that genuinely reduce exposure.
Multi-factor authentication on email and key business systems is one of the highest-impact, lowest-effort changes available. Regular software and plugin updates close off the exact vulnerabilities that automated scanning tools are hunting for. A short, written process for verifying payment requests, even something as simple as a phone call to confirm any change to bank details, can stop Business Email Compromise before it starts.
The ACSC’s own guidance reinforces this approach: organisations are encouraged to classify their most critical assets and maintain a tested incident response plan rather than a theoretical one. For a small business, “tested” doesn’t need to mean elaborate. It can mean knowing who to call, what to switch off, and how to keep operating while things get sorted.
Cyber security for an SMB doesn’t have to mean enterprise budgets or a full-time security team. As a Western Australian digital agency working with small and medium businesses across web design, infrastructure, and security, this is the gap we spend most of our time closing, helping businesses put sensible, proportionate protections in place without slowing down the parts of the business that actually make money. If any of the threats above sound familiar, or you’re not entirely sure where your business currently stands, this defence playbook is a good place to start, and this guide to building a cyber security policy walks through turning awareness into an actual plan.
