Cybersecurity Basics Every Business Should Know

"We're too small to be a target" is one of the most common things we hear from small business owners, and it's backwards. Automated attacks don't pick targets one at a time — they scan thousands of businesses looking for the easiest door in, and small businesses are disproportionately hit precisely because they tend to have weaker defences and no dedicated IT team watching for problems. The good news is that a handful of unglamorous habits stop the overwhelming majority of real-world attacks, and none of them require a security background.

What you should take away

If you only do five things, protect email with multi-factor authentication, use a password manager, keep software updated, back up important data, and teach staff how to verify suspicious payment requests.

Use strong, unique passwords with a password manager

Reused passwords are the single biggest gift you can hand an attacker: once one site is breached, every other account using the same password is exposed too. The fix isn't willpower, it's a password manager — a small piece of software that generates and stores a long, random, unique password for every account, so you only need to remember one master password. Set one up for yourself and everyone on your team, prioritising email, banking, and any admin logins for your website or software first. It takes an afternoon to set up and removes an entire category of risk permanently.

Turn on multi-factor authentication for email and critical accounts

Multi-factor authentication (MFA) means logging in requires something beyond a password — usually a code from your phone or an authenticator app. It matters most on email, because a compromised email inbox is often the master key to everything else: password resets, invoices, customer data, banking notifications. Turn it on for email first, then banking, accounting software, and your website's admin login. Most services offer this as a free toggle in account settings. It adds a few seconds to login and blocks the vast majority of account takeover attempts, even when a password does leak.

Run patching as an owned process

Automatic updates reduce delay, but they do not cover every library, runtime, container image, plugin, integration, or managed service. Build a patch register for important systems. Record the component, deployed version, vendor advisory source, severity, responsible engineer or provider, target date, test evidence, production confirmation, and rollback route.

Set response targets according to exposure and impact. An internet-facing vulnerability affecting authentication or data handling deserves faster action than a low-risk internal tool. After deployment, verify the live version and critical customer path; a successful build does not prove that production received the fix.

Back up your data — and actually test the restore

Backups are what turn a ransomware attack or a failed hard drive from a business-ending event into an inconvenience. The common mistake isn't skipping backups, it's assuming they work: a backup that's never been restored is just an unverified hope. Set up automatic, regular backups of anything you couldn't afford to lose — customer records, financial data, website content — ideally stored somewhere separate from your main systems. Then, a few times a year, actually try restoring from one. If it fails, you want to find that out on a quiet Tuesday, not during an emergency.

Build basic staff awareness of phishing

Most real-world small business breaches don't start with a sophisticated hack — they start with someone clicking a convincing fake email, an invoice attachment, or a text message impersonating a supplier or the ATO. You don't need formal training programs to fix this; a short, plain-language conversation with your team covering a few habits goes a long way:

• Pause before clicking links or attachments in unexpected emails, even if they look like they're from someone you know
• Verify unusual payment or bank detail change requests by phone, using a number you already have on file, not one from the email
• Report anything that feels off to you rather than quietly deleting it or ignoring it

30-minute security check

Set a timer and check these seven things:

• Email account has multi-factor authentication turned on.
• Business passwords are stored in a password manager, not browser notes or shared spreadsheets.
• Internet-facing applications and their key dependencies appear in a patch register.
• Each important system has a named technical owner and advisory source.
• The latest important patch has production evidence and a rollback route.
• Backups exist for customer, finance, website, and operating documents.
• At least one backup has been restored and checked in the last six months.

Payment request rule

Use one rule with every staff member: any request to change bank details, pay a new supplier, or urgently transfer money must be verified through a second channel using contact details already on file. Do not use the phone number or link inside the suspicious message.

None of this requires becoming a security expert. A password manager, MFA on your important accounts, staying current on updates, backups you've actually tested, and a team that knows to pause before clicking are enough to stop most of what actually happens to businesses your size. If you're unsure where you stand on any of these, it's a reasonable thing to raise with whoever manages your technology.

Takeaway: Start with email, passwords, updates, backups, and payment verification. These basics reduce the most common small-business risks before you spend money on more complex security tools.

Source note: This article provides general risk-reduction information, not a complete cybersecurity assessment or guarantee. Use the Australian Signals Directorate's guidance on patching applications and operating systems and its small-business cybersecurity guide as a baseline, then monitor advisories for your actual technology stack. The October 2026 Express security release provides a current example of why dependency inventories, deployment evidence, and runtime ownership matter.