Cyber Risk Isn’t Just a Big-Business Problem

Email compromise, stolen credentials and online fraud continue to affect Australian businesses — including small businesses.

For many smaller businesses, technology has made operating easier than ever.

Invoices are sent electronically. Employees work from cloud platforms. Customer records are stored
online. Banking happens digitally. Suppliers communicate by email.

But this reliance on technology also means a cyber incident can quickly become a business issue
rather than simply an IT problem.

The Australian Signals Directorate's Australian Cyber Security Centre reported more than 84,700
cybercrime reports during the 2024–25 financial year — around one every six minutes. For
small businesses that reported a financial loss, the average self-reported cost was approximately
$56,600.

One of the biggest risks can start with an email
Business Email Compromise, commonly known as BEC, can occur when criminals gain access to
or imitate a legitimate business email account.

A fraudulent email may appear to come from a supplier, employee, director or customer and ask for
payment details to be changed.

Everything can look legitimate — the company name, email history and even the tone of the
message.

A payment is then made to the criminal's account before anybody realises something is wrong.

Email compromise and Business Email Compromise were among the most commonly reported
cybercrime threats affecting Australian businesses in the ASD's latest annual report.

AI is creating another layer of risk
Artificial intelligence is also becoming increasingly common in small businesses.

Used appropriately, AI can help businesses automate tasks and improve productivity. However, the
Australian Cyber Security Centre has warned that businesses also need to consider risks including
data leakage, privacy breaches, manipulation of AI outputs and vulnerabilities introduced through
third-party technology providers.

Simple controls still matter
Not every cyber security measure needs to be complicated.
The Australian Cyber Security Centre recommends practical steps including:

• Keeping software and devices updated
• Using multi-factor authentication
• Using strong and unique passwords or passphrases
• Regularly backing up important information
• Being alert to phishing and suspicious emails
• Managing access to important systems
• Having a cyber incident response plan

Businesses should also consider internal payment controls. For example, verbally confirming
unexpected changes to supplier bank details using a trusted phone number can provide another layer
of protection.

Where does insurance fit?
Cyber Insurance does not replace good cyber security.
Instead, it can form one part of a broader risk-management strategy. Depending on the policy, Cyber Insurance may provide cover for certain costs associated with cyber incidents, including specialist incident response, forensic investigation, data restoration, business interruption and certain liabilities.

The appropriate cover will depend on how your business operates, what information it holds and the
systems it relies on.

If cyber risk hasn't been part of your recent insurance conversations, speak with EIB Melbourne about whether it should be.

Sources
Australian Signals Directorate – Australian Cyber Security Centre, Annual Cyber Threat Report
2024–25.
Australian Cyber Security Centre, Small Business Cyber Security Hub.
Australian Cyber Security Centre, Artificial Intelligence for Small Business: Managing Cyber
Security Risks.

General Information Disclaimer
This information is general in nature and does not take into account your individual objectives,
financial situation or needs. Cyber Insurance policies differ between insurers and are subject to
policy terms, conditions, limits and exclusions. Cyber Insurance should not be considered a
substitute for appropriate cyber security and risk-management practices.