Cyber Risk Isn’t Just a Big-Business Problem

Email compromise, stolen credentials and online fraud continue to affect Australian businesses — including small businesses.

For many smaller businesses, technology has made operating easier than ever.

Invoices are sent electronically. Employees work from cloud platforms. Customer records are storedonline. Banking happens digitally. Suppliers communicate by email.

But this reliance on technology also means a cyber incident can quickly become a business issuerather than simply an IT problem.

The Australian Signals Directorate's Australian Cyber Security Centre reported more than 84,700cybercrime reports during the 2024–25 financial year — around one every six minutes. Forsmall businesses that reported a financial loss, the average self-reported cost was approximately$56,600.

One of the biggest risks can start with an emailBusiness Email Compromise, commonly known as BEC, can occur when criminals gain access toor imitate a legitimate business email account.

A fraudulent email may appear to come from a supplier, employee, director or customer and ask forpayment details to be changed.

Everything can look legitimate — the company name, email history and even the tone of themessage.

A payment is then made to the criminal's account before anybody realises something is wrong.

Email compromise and Business Email Compromise were among the most commonly reportedcybercrime threats affecting Australian businesses in the ASD's latest annual report.

AI is creating another layer of riskArtificial intelligence is also becoming increasingly common in small businesses.

Used appropriately, AI can help businesses automate tasks and improve productivity. However, theAustralian Cyber Security Centre has warned that businesses also need to consider risks includingdata leakage, privacy breaches, manipulation of AI outputs and vulnerabilities introduced throughthird-party technology providers.

Simple controls still matterNot every cyber security measure needs to be complicated.The Australian Cyber Security Centre recommends practical steps including:

• Keeping software and devices updated
• Using multi-factor authentication
• Using strong and unique passwords or passphrases
• Regularly backing up important information
• Being alert to phishing and suspicious emails
• Managing access to important systems
• Having a cyber incident response plan

Businesses should also consider internal payment controls. For example, verbally confirmingunexpected changes to supplier bank details using a trusted phone number can provide another layerof protection.

Where does insurance fit?Cyber Insurance does not replace good cyber security.Instead, it can form one part of a broader risk-management strategy. Depending on the policy, Cyber Insurance may provide cover for certain costs associated with cyber incidents, including specialist incident response, forensic investigation, data restoration, business interruption and certain liabilities.

The appropriate cover will depend on how your business operates, what information it holds and thesystems it relies on.

If cyber risk hasn't been part of your recent insurance conversations, speak with EIB Melbourne about whether it should be.

SourcesAustralian Signals Directorate – Australian Cyber Security Centre, Annual Cyber Threat Report2024–25.Australian Cyber Security Centre, Small Business Cyber Security Hub.Australian Cyber Security Centre, Artificial Intelligence for Small Business: Managing CyberSecurity Risks.

General Information DisclaimerThis information is general in nature and does not take into account your individual objectives,financial situation or needs. Cyber Insurance policies differ between insurers and are subject topolicy terms, conditions, limits and exclusions. Cyber Insurance should not be considered asubstitute for appropriate cyber security and risk-management practices.