Cyber security and backups for small business

“We’re too small to be a target”

It’s the most common reason small businesses put security off, and it’s the reason they’re targeted. Most attacks aren’t aimed at anyone in particular. Criminals send scam emails and try stolen passwords at enormous scale, and smaller businesses are assumed to have fewer protections in place.

The cost is real. In the Australian Signals Directorate’s Annual Cyber Threat Report 2024–25, the average self-reported cost of cybercrime to a small business was $56,600 per report, up 14% on the year before. Compromised email accounts and business email fraud were among the cybercrimes businesses reported most.

The money is only part of it. A locked or hacked inbox can mean days without quotes, invoices or customer messages, and it can damage the trust you’ve spent years building.

SafeSMB explains more in Too small to be a target? What actually happens to small business email. (Disclosure: AusBusiness.net has a commercial relationship with SafeSMB.)

Start with three steps

The Australian Signals Directorate’s Small business cyber security handbook (cyber.gov.au, October 2026) recommends three starting points. Together they block a large share of everyday attacks.

1. Turn on multi-factor authentication (MFA)

MFA means logging in needs something more than a password, such as a code in an app or a tap on your phone. Even if someone steals your password, they can’t get in without that second step.

Turn it on first for email, then banking, accounting software, cloud storage and social media. Use an authenticator app where you can; it’s safer than SMS codes.

2. Keep software updated

Updates fix security holes that criminals know about. Turn on automatic updates for computers, phones, tablets, browsers and apps. Replace devices that no longer receive updates.

3. Back up your data

Backups are what turn a disaster into an inconvenience. They protect you from attacks, but also from the everyday: a deleted folder, a lost phone, a staff member leaving, or a laptop that won’t start. The next section covers how to do it properly.

Backups done properly

A backup only counts if you can get your data back when you need it. Follow the 3-2-1 rule:

• 3 copies of anything important: the original plus two backups.
• 2 different kinds of storage, such as a cloud backup service and an external drive.
• 1 copy kept separate: offline, or in a backup that can’t be changed or deleted from your normal login. That’s the copy that survives ransomware.

Don’t forget cloud email and files

Many owners assume that because their email and files are “in the cloud”, they’re backed up. Cloud providers keep their service running, but restoring something you or a staff member deleted, or something an attacker damaged, is usually limited to a short window. Check what your provider actually keeps and for how long, and add a separate backup for your email, shared files and chat (for example Microsoft Teams) if it isn’t included.

SafeSMB covers this in One bad day: what losing your inbox really costs and Teams backup: what you need to know.

Test your restores

Every three months, restore one file and one email from your backup. It takes ten minutes, and it’s the only way to know your backup works.

Protect your email first

Email is the front door to almost everything else: password resets, invoices, bank notices and customer data. Our guide to professional email for your business covers choosing and setting up email properly. The essentials:

• MFA on every mailbox, including shared ones like info@.
• Built-in protection that filters scam emails and dangerous attachments before they reach you.
• “Email ID checks” (known technically as SPF, DKIM and DMARC) set up on your domain, so criminals can’t easily send emails pretending to be you. The Australian Signals Directorate recommends all three.
• A backup of your mailbox, kept separately from the mailbox itself.

Payment redirection scams

The most expensive email scam for small businesses is simple: a criminal sends an invoice, or a “change of bank details” message, that looks like it comes from a real supplier. The money goes to the criminal’s account.

Before paying anyone new, or anyone whose bank details have changed:

1. Call them on a number you already have, not one from the email.
2. Look at the actual sender address, not just the display name. A single changed letter is a common giveaway.
3. Slow down on anything urgent. Pressure is a scammer’s main tool.
4. Make it a rule that bank details are only ever changed after a phone call, and tell your customers you’ll never change yours by email.

SafeSMB’s guide How tradies can spot scam invoices and payment redirection walks through real examples.

Passwords: use a password manager

Reusing passwords is how one leaked password becomes ten hacked accounts. A password manager creates and remembers a different strong password for every account, so you only remember one. Business versions let you share logins with staff safely and remove access when someone leaves.

Devices, home offices and networks

• Lock every device with a PIN, password or fingerprint, and turn on “find my device” and remote wipe.
• Home-based business? Change your Wi-Fi router’s default admin password, use WPA3 or WPA2 encryption, keep the router updated, and put visitors and smart-home gadgets on a separate guest network.
• Smart devices such as cameras, printers and smart TVs are often the weakest link. Change their default passwords and keep them updated, or keep them off the network your business computers use. SafeSMB explains more in IoT at work: smart device security.
• Public Wi-Fi: avoid logging in to business accounts on it, or use your phone’s hotspot instead.

People: a short habit beats a long policy

Most attacks rely on someone clicking, paying or sharing a code. A few habits, agreed with everyone who works with you, go a long way:

• Never share an MFA code with anyone, even “IT support” or “the bank”.
• Check before you pay, and check before you click a login link. When in doubt, go to the website directly.
• Report anything odd straight away. Make it clear nobody gets in trouble for reporting, even if they’ve already clicked.
• When someone leaves, remove their access the same day.

Have a plan for a bad day

Write a one-page plan and keep a printed copy, because you might not be able to get into your email when you need it.

If money has been sent to a scammer:

1. Call your bank immediately and ask them to stop or recall the payment.
2. Change passwords, starting with your email, and check that MFA is still on.
3. Contact IDCARE (Australia’s national identity and cyber support service) on 1800 595 160 for free help to limit the damage.
4. Report it through ReportCyber at cyber.gov.au, and to Scamwatch.

If you’re locked out, hacked or hit by ransomware: disconnect affected devices from the internet, don’t pay a ransom without advice, call your IT provider or email provider’s support, restore from your separate backup, and report it through ReportCyber.

cyber.gov.au’s Small Business Hub also offers free tools to test and improve your readiness, including a cyber health check, Exercise in a Box (which walks you through a pretend incident), and IDCARE’s free small business cyber resilience service.

Getting help

If this feels like a lot to manage, there are three common routes:

• Do it yourself with your existing email and software, using the steps above and the free guidance at cyber.gov.au.
• A local IT provider who sets up and looks after your systems for a monthly fee.
• An all-in-one service that bundles email, protection and backup. One example is SafeSMB, built for Australian businesses with 1–20 staff. Whatever you choose, check that protection and backup are included and switched on, not optional extras.