“We’re too small to be a target” is the assumption we hear most from small business owners. The data says otherwise. In September 2026, Jasmine, CEO and co-founder of CYBR, presented a webinar on cyber security maturity for small businesses. This article summarises the session and gives you steps you can work through. The full recording sits alongside this article. If you only have time for one thing, start with the asset register section.
What an incident costs a small business
In the 2024-25 financial year, the Australian Cyber Security Centre received over 84,700 cybercrime reports, or roughly one every six minutes. The average self-reported cost per report was $56,600 for a small business and $202,700 for a large business.
Large businesses lose more in absolute terms. For a small business, though, $56,600 can represent weeks or months of cash flow, and it is harder to absorb.
Reported figures also understate the problem. Many incidents are never reported, often because owners don’t know where to go, feel embarrassed or fear repercussions.
Costs arrive in two forms. Some are immediate: a fraudulent payment, a ransom, the cost of recovery. Others follow later: time spent with the bank, lost customers, regulatory penalties, legal fees and the stress placed on staff.
Think in confidentiality, integrity and availability
Cyber security is easier to reason about when you ask three questions of each system you depend on:
- Confidentiality: Could someone read information they shouldn’t see?
- Integrity: Could someone change information, such as payment details, without you noticing?
- Availability: Could you lose access to it when you need it?
Availability is the one businesses most often overlook. If you were locked out of your email today, how would you take orders, reply to customers or tell your team what was happening?
Take the systems you use every day and ask what would cause the most disruption if they were accessed, changed or unavailable.
Payment fraud often arrives through a normal thread
A common scenario runs like this. A regular supplier sends an invoice that looks routine. Then a small change arrives: new bank details. The payment goes to a criminal’s account, and the business only finds out when the real supplier chases the unpaid invoice.
The question to test is whether your process still holds when an invoice is urgent and someone is pressuring you to pay before close of business. Processes that look sound on paper often fail under that pressure.
Technology sprawl costs money and creates gaps
Most businesses add tools for good reasons and never review them. In one example from the session, a business was paying for both Google and Microsoft after a migration. The old Google account was never closed, held data the business still needed, and had none of the security settings applied to the new environment. The duplicate cost about $1,000 a year.
Old website hosting is another common trap. After a business moves to a new provider, the previous hosting often keeps running, still holding email, files or admin access nobody remembers.
Ask of every tool: who has administrative access, could we be locked out, and who do we call if it breaks?
Connected AI tools widen the risk
Generative AI and meeting-notes tools save time, and the session was clear that businesses should use them. The risk lies in connection. One business connected a meeting-notes tool to an AI assistant to generate action lists. A step in that chain began sending actions to the other people in the meetings, something the owner had not intended and did not expect.
Before connecting any tool, work through four questions:
- What information does it need to access?
- What can it read?
- What can it create, change or send?
- What else can it reach once it is connected?
Where possible, make “no” your default when software asks for ongoing access, or allow access only once. Remove connections you no longer use. If you don’t yet understand a connection’s risk, do the task manually and revisit the connection later.
The more tools are linked together, the more one weak account can expose.
Everyday protections every business needs
- Multi-factor authentication (MFA) using an authenticator app or a physical key. Avoid SMS and email codes where you can. Never approve a sign-in prompt you did not expect.
- A unique password for every account, stored in a password manager. When one service is breached, reused passwords let attackers into everything else.
- Individual accounts for each person. Shared logins make it hard to see who did what, and they affect the whole team when a password changes.
- Separate everyday and administrative accounts. If the account you use for email is compromised, criminals should not also be able to change billing or create new users with it.
- Apply these to every account, not just the bank and email. Criminals use the less important accounts to build the story that makes the attack convincing.
Two further habits matter. Turn on automatic updates wherever you can, and be clear about who owns updates for phones, tablets, software and your website. Delayed updates leave known weaknesses open.
On backups, a copy stored in the cloud is not automatically an independent backup. Ask your provider a practical question: “Can you show me how we get last Tuesday’s bookings back if we lost access to everything?” A backup you have never restored from is only a hope.
Practise verification before you need it
Most people know the advice: don’t trust an unexpected message, and call back on a number you already hold. The harder part is making it automatic. A text message claiming to come from your IT provider, saying there has been fraudulent access, will prompt a stressed reply to the number that sent it.
Make sure your team knows where verified contact numbers are kept, and rehearse what to do when something urgent arrives. Criminals rely on pressure and urgency, so your process has to hold under exactly those conditions.
Start with a technology asset register
A simple spreadsheet is enough. For each tool or service your business relies on, record:
- What it is used for
- Who owns it
- Who has access, including former staff and contractors
- What information it holds
- Whether MFA is on, whether it is backed up, and how you would restore it
- What it costs and when it renews
- For AI tools, what it can access and what it is allowed to do
Most businesses find gaps once they complete this. Choose the three most important actions and complete them within the next week. Common early findings include MFA that is switched on for email and banking but nowhere else, subscriptions nobody uses, and admin access held by people who have left.
Where to get help
The Australian Cyber Security Centre at cyber.gov.au provides practical guidance and is where cyber incidents should be reported.
Small business support programmes can help you put these steps into practice. The session mentioned the Digital Solutions Programme, the Women in Business Programme and the Business to Business Drought Programme. Your local council or regional development australia (RDA) office can tell you what is available in your area.
Forge and Guild helps businesses adopt AI with clear rules on access, approval and data use before tools are connected. If that is where your business is now, get in touch through this website.
