The Australian Signals Directorate put the average self-reported cost of cybercrime at $55,400 per report for a small business in its 2025–26 threat report, about the same as the year before. That’s not a ransomware crew choosing you. That’s mostly an email account someone got into, and an invoice with different bank details on it.
Most of what happens to small businesses is prevented by 8 things you can check yourself, on your own systems, in about half an hour. None of it needs a vendor and none of it needs you to understand cryptography. My reference point is the ACSC’s Essential Eight, cut down to the parts you can check without a technician. What follows is the version you can run on a Tuesday morning.
The short version
- Text-message codes, stale logins and a domain held by someone else all let attackers in.
- The cloud copy you rely on won’t survive ransomware, and old plugins invite scanners.
- The costliest attack breaks nothing technical. It just asks you to pay into a new account.
- Holding patient files or a big customer list? This check won’t be anywhere near enough.
1. Multi-factor authentication on email and admin accounts (6 minutes)
Open your Microsoft 365 or Google Workspace admin console and list every account without MFA.
Why: email is the account that resets every other account. If it falls, everything downstream falls with it.
Not all MFA is worth the same. The ACSC’s guidance is to use phishing-resistant methods (passkeys or a hardware security key) because those can’t be relayed by a fake login page the way a code can. An authenticator app is the acceptable middle. SMS is the weakest and the ACSC says so: your number can be moved to someone else’s SIM without you knowing, and the codes go with it.
A bad answer: MFA on your account but not the bookkeeper’s. SMS on the account that resets every other password. Any admin account without it.
2. Who still has access (5 minutes)
Write down every system that holds money or data: email, the website CMS, hosting, the accounting file, the bank, the ad accounts, the socials. Open each user list.
Why: nobody offboards properly, and dormant accounts are the ones nobody notices being used.
A bad answer: a staff member who left last year. The agency you stopped working with. A shared login called “admin” that 6 people know. A 20-person business with 9 global administrators. If you can’t name who owns an account, nobody does.
3. Domain, DNS and email authentication (5 minutes)
Log in to your domain registrar. Not your web developer’s registrar. Yours.
Why: whoever controls the domain controls your email and your website, regardless of who owns the business.
Check 4 things. Is the registrant contact an address you can still read? Is the domain locked against transfer and set to auto-renew on a card that hasn’t expired? Do you have SPF, DKIM and DMARC records? Is the DMARC policy still p=none?
A bad answer: the domain sits in a former contractor’s personal account. The registrant email is someone who left. p=none set 3 years ago and never moved to p=quarantine or p=reject, which means you’re collecting reports about people spoofing your business and doing nothing with them.
4. Backups, and a restore you’ve actually done (4 minutes)
Ask 2 questions: what’s backed up, and when did someone last restore from it.
Why: an untested backup is a belief, not a control.
A bad answer: “it’s all in the cloud.” File sync isn’t backup: delete a file or encrypt it and the sync obediently copies that everywhere. Another bad answer: backups exist but nobody has ever restored one, so nobody knows it takes 3 days and a password that left with the last IT person. Restore one file this week. That’s the test.
5. Patch currency on the website (3 minutes)
Log in to the CMS. Look at core version, plugin versions, theme version and the PHP version underneath.
Why: public websites get scanned constantly, and known holes in old plugins are the cheapest way in there is.
A bad answer: a plugin last updated 2 years ago, which usually means abandoned rather than finished. Automatic updates switched off after one broke something. A paid plugin installed from a free download site, which is routinely where the modified ones come from. An end-of-life PHP version.
6. Password reuse and a manager (3 minutes)
Ask where passwords live right now.
Why: reuse turns one breach at an unrelated service into a breach at yours.
A bad answer: a shared spreadsheet, a shared document or a note in the accounting file. Browser-saved passwords on a laptop that never locks. The same password on the bank and on a forum someone joined in 2016. Put a password manager in, move the shared credentials into it and stop emailing logins. That’s an hour of work, not a project.
7. The payment process, not the technology (3 minutes)
This one is a rule, not a setting. Write down what happens when a supplier emails to say their bank details have changed.
Why: invoice fraud doesn’t break anything technical. It asks politely, in a thread that already exists.
The rule that works: any change to payment details is verified by phone, on a number you already had, not one in the email. Every time, no dollar threshold, no exceptions for the person who signs your pay.
A bad answer: verification only over $10,000. Confirmation by replying to the same email thread. A rule that exists but that no one junior feels able to apply to an urgent request from a director.
8. Know who you call (1 minute)
Write 4 numbers on paper. Your IT provider’s after-hours line. Your bank’s fraud line. Your insurer, if you have cyber cover. And ReportCyber at cyber.gov.au/report, or the ASD’s 24/7 hotline on 1300 CYBER1 (1300 292 371).
Why: you’ll be looking for this list on the day you’ve lost access to the place you stored it.
A bad answer: the list is in the email account.
This is a floor
In 2020 a client was hacked and nobody would help, so I spent a fortnight learning Kali. I got the data back, and handed everything I’d found to the authorities. Nothing in that fortnight was as useful as the 30 minutes of checks nobody had run beforehand.
Half an hour gets you a floor. It doesn’t get you logging, or a tested incident response plan, or anything near the maturity levels in the Essential Eight. If you handle health records or hold real volumes of customer data, you need more than this and you need someone whose job it is.
But most businesses that get hurt weren’t outmatched. They just never checked who still had a key.