Quick answer
The main cyber threats for small businesses are phishing, invoice fraud, ransomware, AI-powered scams, weak passwords and unpatched software. Multi-factor authentication, tested backups, updates and staff training stop most of them.
Key takeaways
- Phishing and business email compromise remain the most common attacks.
- Ransomware can halt operations and lead to data theft.
- AI is making scams more convincing.
- Simple controls like MFA, backups and training stop most attacks.
What are the main threats?
- Phishing: fake emails and texts that steal passwords.
- Business email compromise: fake invoices and changed bank details.
- Ransomware: locked files, often with data theft.
- AI scams: convincing emails and deepfake voices.
- Weak or reused passwords and unpatched software.
How do you prepare?
| Control | Why it matters |
|---|---|
| Multi-factor authentication | Stops most account takeovers |
| Tested backups | Lets you recover from ransomware |
| Automatic updates | Closes known gaps |
| Staff training | Helps people spot scams |
| Payment verification | Call suppliers on known numbers |
The ACSC's Essential Eight is a useful framework for prioritising these controls.
What should be on your checklist this month?
- Turn on multi-factor authentication for email, banking and accounting.
- Check backups run and test a restore.
- Enable automatic updates.
- Confirm bank detail changes by phone.
- Remove former staff accounts and review admin access.
What are the signs you may be compromised?
- Unexpected password reset emails.
- Customers receiving odd emails from your address.
- New email forwarding rules you did not create.
- Files that will not open.
What should your response plan include?
- Know who to call: IT provider, bank and insurer.
- Disconnect affected devices and change passwords.
- Report at cyber.gov.au.
- Notify affected people where the Notifiable Data Breaches scheme applies.
Our cyber security services team can assess your risks.
Why are small businesses targeted?
Attackers know small businesses handle payments, customer data and supplier relationships, often without dedicated security staff.
The Australian Cyber Security Centre regularly reports that small businesses are frequent victims. Basic, well-maintained controls stop most attacks, so start with multi-factor authentication, backups and updates this week.
Bottom line
Most attacks start with a convincing message and a weak login. Multi-factor authentication, tested backups and staff training stop a large share of them.
