Strengthening Cybersecurity on an SMB Budget

For many small and medium-sized enterprises, cybersecurity still carries the wrong label. It is too often treated as a technical problem — something for IT to manage, a software tool to buy, or a compliance box to tick. But for Australian SMEs, cyber risk has become something far more serious: a governance, resilience and business continuity issue.

The numbers make the point clearly. In FY2024–25, ASD’s Australian Cyber Security Centre received more than 84,700 cybercrime reports — roughly one every six minutes — and responded to more than 1,200 cyber security incidents, an 11% increase year on year. The average self-reported cybercrime cost per report rose to $56,600 for small businesses and $97,200 for medium businesses.

For an SME, those figures are not abstract. A cyber incident can interrupt trading, compromise customer information, delay payroll, damage supplier relationships, trigger regulatory obligations and undermine trust. In practical terms, cybersecurity is now a business risk that belongs alongside finance, legal, safety, privacy and operational resilience.

The good news is that meaningful improvement does not require enterprise-sized budgets. For most SMEs, the strongest return comes from disciplined basics: multi-factor authentication, patching, backups, access control, supplier governance, logging, staff awareness and tested response plans. The objective is not to build a bank-grade security function overnight. It is to make the business harder to compromise, faster to recover and better prepared to make decisions under pressure.

Why SMEs Are Now Prime Cyber Targets

Cyber criminals are economically rational. They look for reachable targets with valuable data, payment flows and uneven controls. SMEs often fit this profile perfectly.

Australian guidance highlights that cybercriminals target Australia because of its widespread digital adoption, perceived wealth and varied levels of cyber maturity. SMEs commonly hold customer information, identity data, health data, finance records and commercial information — all of which can have criminal value. They also depend heavily on cloud platforms, managed service providers, accountants, payroll systems, SaaS applications and sector-specific platforms, creating third-party exposure that may sit outside day-to-day management visibility.

The threat landscape is also becoming more efficient. Phishing and social engineering remain major risks, with ASD’s ACSC recording phishing as an initial access technique in 38% of incidents and noting that AI is making social engineering easier to execute at scale. Business email compromise and invoice fraud remain among the top self-reported cybercrime types for Australian businesses, often causing direct financial loss without requiring highly sophisticated technical attacks.

Credential theft is another major concern. Compromised accounts can give attackers access to email, finance systems, cloud storage and business applications. ASD highlighted aggressive credential theft campaigns and the role of information stealer malware in enabling ransomware, extortion and fraud. Globally, Verizon’s 2025 Data Breach Investigations Report found credential abuse remained the most common initial access vector at 22%.

For SMEs, this means the cyber conversation must move beyond firewalls and antivirus. The real question for directors and executives is: where could a cyber event disrupt revenue, cash flow, operations, privacy obligations or reputation — and are we governing that risk properly?

Cybersecurity Is a Governance Issue, Not Just an IT Issue

Directors and executives do not need to become technical specialists. But they do need to ensure cyber risk is understood, owned, prioritised and monitored.

ASIC’s guidance frames cyber risk as part of broader board and senior management responsibility, stating that recognising and managing risk is a crucial part of the role of the board and senior management, and that cyber risks should be integrated into the broader risk framework with board-level oversight. Australian guidance from ASIC, ASD and AICD also emphasises board oversight, risk integration, tested response capability and stronger third-party governance.

In practice, this means cyber should appear in executive and board conversations in business language. Leaders should be asking:

• What are our most important systems and data?
• Which business processes would be most affected by a cyber incident?
• Who owns cyber risk at executive level?
• How do we know our key controls are working?
• Could we restore operations if ransomware affected critical systems?
• Which suppliers have access to our systems or data?
• Have we tested our incident response plan?

A practical SME governance model should include clear accountability for cyber, incident response and third-party risk; regular business-focused reporting on key risks, incidents, control uplift and recovery readiness; and integration of cyber into enterprise risk, operations, privacy, legal exposure and resilience planning.

The discipline matters because cyber incidents rarely stay technical for long. An email compromise can become a financial loss. A ransomware attack can become a business continuity issue. A supplier breach can become a privacy, contractual and customer trust problem. A poorly handled incident can become a reputational event.

The Budget-Conscious Path: Strong Basics, Applied Consistently

For SMEs, the most effective approach is not necessarily to buy more tools. It is to implement the right controls in the right order, with executive visibility and practical accountability.

The research points to a disciplined baseline aligned to the ASD Essential Eight, using NIST Cybersecurity Framework 2.0 and ISO/IEC 27001 as governance and risk-management wrappers. Essential Eight provides a practical preventive baseline; NIST CSF adds a management structure across Govern, Identify, Protect, Detect, Respond and Recover; and ISO/IEC 27001 reinforces continuous risk management, leadership accountability and process discipline.

For many SMEs, five areas deserve immediate attention and offer the highest return on investment:

1. Multi-factor authentication

MFA should be enforced for email, administrator accounts, remote access, cloud applications and finance systems. It is relatively low-cost, often available within existing platforms, and materially reduces the risk that stolen credentials alone can lead to compromise. For businesses using Microsoft 365, Google Workspace, cloud accounting platforms or line-of-business SaaS tools, MFA is one of the most important risk-reduction steps available.

2. Patching and vulnerability management

Routine patching is essential across user devices, servers, browsers, VPNs, firewalls and other internet-facing systems. This matters because exposed and outdated systems are a common path to compromise. ASD reported more than 120 incidents associated with attacks on edge devices in FY2024–25, of which 96% were successful.

For SMEs, the key is not perfection. It is visibility and rhythm: know what systems exist, identify unsupported technology, prioritise internet-facing assets and establish a patching cadence that is actually followed.

3. Backups that are tested, not assumed

Backups are not an administrative task; they are a business recovery control. SMEs should back up critical data and key configurations, store backups securely and test restoration. In a ransomware, deletion or system failure scenario, a backup that has never been tested may provide false confidence.

Executives should ask a simple question: if our most critical system became unavailable today, what could we restore, how confidently, and in what order?

4. Privileged access control

Attackers want administrator access because it increases their ability to move through systems, disable protections and cause broader damage. SMEs should separate administrator and standard accounts, minimise privileged access, review dormant accounts and tightly control administrator use.

This is often a low-cost governance improvement. It requires discipline more than major capital expenditure: fewer admin accounts, clearer ownership, periodic review and better separation of duties.

5. Supplier and third-party risk management

Many SMEs outsource important services — IT support, payroll, accounting, CRM, industry platforms, web hosting and cloud applications. That creates operational leverage, but also risk.

Third-party involvement in breaches doubled to 30% in Verizon’s 2025 DBIR dataset. OAIC and ASD also stress supplier governance, and ASIC identifies third-party cyber risk as a frontline issue.

A sensible SME approach is to maintain a supplier register, identify critical vendors, document what data or systems each supplier can access, require incident notification clauses where appropriate, and limit third-party access to what is genuinely required.

Don’t Neglect Detection and Response

Prevention matters, but it is not enough. SMEs also need the ability to detect, respond and recover.

Logging and alerting for critical systems — including email, identity, firewall/VPN, endpoints and administrator activity — improves detection speed and investigation quality. Staff awareness is equally important. Short, recurring training and easy suspicious email reporting can reduce human-driven compromise and improve early detection.

Incident response planning is also a leadership issue. A plan should identify who makes decisions, who contacts legal advisers, insurers and suppliers, how communications will be handled, and how the business will prioritise recovery. Australian guidance emphasises maintaining and testing incident response plans, including communications, decision rights, legal escalation and supplier coordination.

This is particularly important because regulatory expectations are increasing. Notifiable Data Breaches obligations remain relevant for entities covered by the Privacy Act, and OAIC expects mature preparation and response capability. Mandatory ransomware payment reporting under the Cyber Security Act 2024 applies to businesses carrying on business in Australia with annual turnover of $3 million or more, and to certain critical infrastructure entities, where a ransom or cyber extortion payment is made; reporting must occur within 72 hours.

A 90-Day Cyber Uplift Plan for SME Leaders

Cyber improvement becomes more achievable when it is sequenced. Rather than launching a large, unfunded programme, SME leaders can start with a practical 90-day uplift.

In the first 30 days, enforce MFA on email, administrator accounts, remote access and finance systems; review backup coverage and test one restore; patch internet-facing systems; brief directors and executives on top cyber risks using a one-page dashboard; and confirm incident response contacts, including legal counsel, insurer and key vendors.

In the next 60 days, create a simple cyber risk register linked to business processes and sensitive data; review privileged accounts and dormant access; introduce a supplier risk register with criticality ratings and notification obligations; deliver targeted phishing and business email compromise awareness for finance, payroll and executive support staff; and enable centralised logging for email, identity and perimeter systems.

By 90 days, assess the business against Essential Eight Maturity Level One, conduct a tabletop exercise covering ransomware, business email compromise and privacy breach scenarios, review Privacy Act and Notifiable Data Breach obligations, and establish a 12-month roadmap that sequences controls into affordable quarterly steps.

This approach turns cybersecurity from an overwhelming technical backlog into an executive-managed risk programme.

The Leadership Mindset: Right-Sized, Risk-Based and Resilient

SMEs do not need to copy enterprise security programmes. They need a right-sized approach that reflects their business model, risk profile, systems, data, suppliers and budget.

The most common mistakes are predictable: treating cyber as technology-only, buying tools before fixing basics, ignoring supplier risk, underestimating logging and recovery, failing to test response plans, and assuming the business is too small to be targeted. The data does not support complacency. Verizon found ransomware present in 88% of breaches affecting SMBs, while ASD data shows high and rising costs for small and medium businesses.

A mature SME cyber posture is not defined by the number of tools deployed. It is defined by clarity of ownership, protection of critical assets, disciplined execution of key controls, tested recovery capability and informed oversight.

Conclusion: Cyber Resilience Is Now Part of Business Resilience

For Australian SMEs, cybersecurity is no longer optional, peripheral or purely technical. It is a core business risk that affects cash flow, operations, customer trust, regulatory exposure and strategic resilience.

The challenge for directors and executives is to make cyber manageable. That starts with reframing the issue: not as a technology spend, but as a governance responsibility. The most effective first steps are often practical and affordable — MFA, patching, backups, access control, supplier discipline, logging, awareness and tested response.

Done well, cybersecurity becomes more than defence. It becomes a sign of operational maturity, customer trust and board-level discipline.

Protogy helps SME owners, directors and executive leaders take a practical, business-focused approach to cybersecurity governance. If you want to understand your current cyber risk position, prioritise affordable uplift actions, improve board reporting or build a 90-day cyber resilience roadmap, Protogy can help you move from uncertainty to clear, accountable action.