Cybercrime against Australian small businesses continues to climb, with a report logged nationally every six minutes and average losses for small firms rising to around $49,600 per incident in FY23–24. Ransomware, business email compromise, and invoice redirection scams remain the most disruptive, commonly exploiting phishing, weak passwords, and unpatched systems. Australian small business research shows widespread exposure to suspicious messages and payment scams, underscoring the need for practical, affordable controls.

Focus first on people and process: implement multi-factor authentication on email and key apps, train staff to verify bank detail changes by a phone call to a known number, and run periodic simulated phishing. Keep systems current with timely patching and use backups that are isolated and regularly tested for restoration, aligning with the ACSC’s Essential Eight as scaled for SMEs. Document a short incident response plan naming IT support, insurer, and legal contacts, and rehearse a simple detect–contain–notify–recover playbook to reduce downtime and data exposure.

Insurance complements, not replaces, good security: modern cyber policies can fund expert incident response, data restoration, business interruption, and third‑party liability, but often require minimum controls and prompt notification to respond as intended. Directors should recognise that regulators and stakeholders expect reasonable cyber risk oversight, and poor preparedness or disclosure after a breach can escalate legal and regulatory exposure. For Perth SMEs, prioritising MFA, patching, tested backups, and clear response and notification pathways delivers measurable risk reduction at a manageable cost.

Contact the team at Momentum Insurance Brokers to find out more.