Being small is no protection against a cyber attack

It is a common misconception that cyber attacks are only experienced by large organisations – banks, hospitals and multinational companies - and that small and medium businesses fall outside a threat actor’s radar due to their modest customer bases and smaller digital footprint.

In reality, small and medium-sized businesses are very attractive targets for cyber criminals as they have fewer resources to allocate towards combatting cyber threats. Small and medium businesses are often time poor, have limited finances to uplift their information technology frameworks, and often rely on third party service providers for their IT needs. The data supports this: 1 in 3 cyber security incidents that the Australian Signal Directorate’s Australian Cyber Security Centre responded to were from small and medium sized businesses (Australian Signals Directorate Annual Cyber Threat Report 2025-2026).

The cost of a cyber attack

In McAfee’s Cybersecurity for Small Business Guide, of the surveyed small businesses that experienced a cyberattack, 61% lost more than USD$10,000 dealing with the attack. In 58% of the cases, the company lost more than a week of valuable business time dealing with IT issues due to the attack.

Whilst the average self-reported cost of an incident was $55,400 for small businesses and $141,300 for medium businesses (Australian Signals Directorate Annual Cyber Threat Report 2025-2026), the true cost in responding to a cyber-attack is likely significantly higher once longer-tail recovery costs and reputational damage are considered.

One incident, multiple consequences

What makes today's cyber environment particularly difficult for small and medium businesses is that incidents rarely stay contained. A single event may begin as a compromised system or fraudulent email, but will often trigger operational disruption, privacy exposures, extortion demands, and legal action. Many of these can take months, and even years, to respond to and hopefully recover from.

Additionally, not every cyber incident starts with a sophisticated attack. Misconfigurations, accidental data exposure and privacy missteps (including issues with website tracking and analytics tools) are a growing source of claims. A business does not need to be deliberately targeted to face a costly incident.

In addition to encrypting systems, instances of threat actors also stealing sensitive data are on the rise, using the threat of public exposure of this data to amplify reputational damage and increase pressure on an SME to pay a ransom demand.

The Marsh Global Cyber Claims Report identifies business interruption as one of the most significant cost drivers in cyber claims, and notes that the most severe outcomes are becoming increasingly costly. For a small business with limited cash flow and internal resources, a multi-layered incident can quickly become an existential problem.

A changing legislative landscape

The Australian legislative environment is also shifting to reflect evolving cyber threats. On 10 December 2026, the small business exemption under the Privacy Act 1988 (Cth) is being removed and the full scope of the Privacy Act regime, including the Australian Privacy Principals and the Notifiable Data Breaches Scheme, will apply to many small and medium businesses. This brings with it strict notification requirements in the event of a data breach, and significant financial penalties if a business is found to be in contravention of its privacy responsibilities.

The recently announced Australian Signals Directorate’s new ASD Essentials guidance reflects a more flexible approach to cyber resilience, while still reinforcing the core controls that help protect against common attacks. For small to medium businesses, the framework will offer a practical roadmap for improving cyber hygiene and reducing exposure to increasingly sophisticated threats.

Prevention on its own is not enough 

Multifactor authentication, backups and staff training reduce risk and remain essential components of mitigating cyber risk, but they do not make a business immune to attacks. This is where cyber insurance can play a critical role. Cyber insurance provides an important safety net, and in combination with good cyber hygiene, ensures that a small to medium business has access to specialist resources and financial protection. Cyber insurance can help ensure that when prevention is not enough, a business has the support and financial capacity to recover. Depending on the policy, it can provide access to incident response specialists, legal support, business interruption cover, notification costs and liability protection. 

For a small business owner managing multiple functions at once, that support can mean the difference between a well-managed and fast recovery, or a prolonged crisis.

Cyber insurance is not just for large organisations; specific small to medium business policies are now available that better reflect the unique needs and exposures of smaller businesses. As incidents become more complex and the cost of recovery continues to rise, businesses without dedicated cyber insurance cover are often the most exposed.

References

1. Australian Signals Directorate, "Annual Cyber Threat Report 2025–2026", https://www.cyber.gov.au/publication/annual-cyber-threat-report-2025-26, accessed on 21 October 2026.
2. McAfee, "Cybersecurity for Small Businesses", https://media.mcafeeassets.com/content/dam/npcld/ecommerce/en-us/docs/guides/gd-small-business-resource-guide.pdf, accessed on 21 October 2026.
3. Marsh, "Global Cyber Claims Report", https://www.marsh.com/en-gb/services/cyber-risk/insights/global-cyber-claims-report.html, accessed on 21 October 2026. 
4. Australian Signals Directorate, " ASD Essentials", https://www.cyber.gov.au/essentials, accessed on 21 October 2026.

LCPA 26/3884