The Australian Signals Directorate received more than 84,700 cybercrime reports in 2024–25 — one every six minutes. For small business, the average self-reported cost per report rose 14% to $56,600. Across businesses of all sizes the average jumped 50%, to $80,850.
Those are self-reported direct costs. They do not capture the fortnight you spend rebuilding, the customers who quietly go elsewhere, or the insurance excess. And the businesses in that data set are, by definition, the ones that noticed.
Where the money actually goes
Very little of that $56,600 is ransom. The bulk of it is downtime, forensic investigation, rebuilding systems from scratch because nobody could confirm what was clean, notifying customers, and lost trading. A three-day outage for a business turning over $2m a year is roughly $23,000 of revenue before anyone sends an invoice.
The controls that stop most of it
The uncomfortable truth is that the majority of successful attacks on small business still exploit basics. The ACSC’s Essential Eight exists precisely because a short list of unglamorous controls prevents most incidents:
Multi-factor authentication everywhere — not just email. MFA on remote access, admin accounts and any cloud platform holding customer data. This is the single highest-return control available to a small business.
Patch operating systems and applications within two weeks, and critical vulnerabilities within 48 hours. Most breaches exploit flaws that were fixed months earlier.
Restrict administrative privileges. Day-to-day accounts should not be able to install software. This one change contains the blast radius of most malware.
Tested backups, stored offline or immutably. An untested backup is a hope, not a control. Ransomware operators now target backup infrastructure first, specifically because they know it is the difference between paying and not paying.
What training does and does not fix
Awareness training helps, but treating your staff as the last line of defence is a design flaw. People will click things — that is what an inbox is for. The goal is an environment where a single bad click cannot become a company-wide incident: MFA blocks the stolen credential, least privilege blocks the install, and DNS filtering blocks the callback.
A realistic starting point
If you do nothing else this quarter: turn on MFA for every account that touches company data, confirm your backups actually restore by testing one, and get someone to check what is exposed to the internet. Those three cost very little and remove the most common paths in.