How Much Should Small Businesses in Australia Spend on Cybersecurity?
Small business cyber security should start with fixing everyday working habits, and only then move on to buying more tools. The Cyber Readiness Institute says most incidents stem from human error that is “predictable and preventable”, not from sophisticated attacks.
In early November 2026, a federal parliamentary inquiry continued to hear evidence on how ready small and medium-sized businesses are for cyber risk. Many nail salons, restaurants, retail shops and accounting practices already know the risk exists. What they are less sure about is how much they need to invest to be adequately protected.
Key Takeaways
- According to the Australian Signals Directorate (ASD) annual report, the average self-reported cost of cybercrime is A$55,000 for small businesses and A$141,300 for medium businesses.
- According to insurer QBE, only about 20% of small and medium-sized businesses in Australia hold cyber insurance. The Insurance Council of Australia says insurance is not a complete solution.
- Most incidents trace back to preventable human error, so basic habits and processes should come before tools.
- What counts as “enough” protection depends on the accounts, devices and customer data a business holds, not on how much software it has bought.
Key points
What is Parliament examining on small business cyber security?
According to Australian Associated Press (AAP), the federal inquiry is assessing how prepared small and medium-sized businesses are for cyber threats. It is also looking at whether government guidance is adequate and easy for these businesses to access. The most recent hearing took place in early November 2026.
The Illawarra Mercury, republishing the AAP report, noted a recommendation that small businesses take part in hands-on cyber mentoring rather than relying on reading material alone.
At Holdrix, we think the biggest gap is not awareness. Many owners have heard of phishing emails and hijacked accounts, but nobody in the business has the time to turn general guidance into specific actions for their own operation.
How much can a cyber incident cost a small business?
According to the ASD annual report, the average self-reported cost of cybercrime is A$55,000 for small businesses and A$141,300 for medium businesses. Your Life Choices calls the A$55,000 figure a risk that small business owners should not take lightly.
It is worth remembering that these are averages drawn from reported cases. Some businesses lose far less, others lose more, and not every incident is reported.
Example (assumed figures): if a nail salon makes a net profit of A$8,000 a month, a A$55,000 loss is equal to almost seven months of profit.
Reported figures may also miss hidden costs: time when bookings cannot be taken, the effort of contacting customers again, fees for someone to restore your systems, and damage to your reputation. For a restaurant or clinic, a single day without the booking or appointment system can wipe out that day’s revenue.
Is cyber insurance enough to give you peace of mind?
According to QBE, only about 20% of small and medium-sized businesses in Australia have cyber insurance. That means most businesses in this group would likely have to carry the cost of an incident themselves.
Even so, the Insurance Council of Australia notes that insurance should be encouraged but is not a complete solution. It may offset part of the financial loss, but it cannot stop an incident from happening or bring back customer data that has already been exposed.
Claim conditions also vary from policy to policy. Before signing, businesses should read the scope of cover carefully, along with any protective measures the insurer requires.
Why should cyber security start with habits rather than tools?
The Cyber Readiness Institute points out that most incidents come from human error that is “predictable and preventable”. Some common mistakes in small businesses include:
- Shared passwords: every staff member logs into email, the booking software and the website admin page with the same password, unchanged for years.
- Unmanaged accounts: former employees can still log into the point-of-sale system or company email.
- Payments based on fake emails: a bookkeeper pays an invoice with altered bank details without phoning the supplier to confirm.
- No two-factor authentication: important accounts can be accessed with just a password.
A common mistake is to react by buying several tools at once. The result is often overlapping subscription fees and software that nobody configures, while the shared password is still in use.
That said, tools still matter. AAP reported that small businesses are being encouraged to strengthen their defences against cyber threats. The key is the order: work out what you need to protect first, then choose the tools to match.
Holdrix technology consulting services
Where should your business start?
Before spending money on new tools, you can work through these steps:
- List your accounts: email, banking, booking software, point-of-sale system and website admin page. Note who has access and who the administrator is.
- List your devices: the computers, phones, tablets and wifi routers used for work, including staff members’ personal devices.
- Identify the customer data you hold: phone numbers, emails, payment details, health or tax records, and where each type is stored.
- Ask an expert to assess the level of protection that suits your size: rather than guessing or buying several tools at once, get an independent assessment so you know what to do first and what can wait.
When don’t you need to buy more security tools yet?
You probably don’t need more tools until you have a list of your accounts, devices and data. Without that list, it is hard to know what a new tool would actually protect.
Likewise, if features you already have are switched off, deal with those first. For example, many email services already offer two-factor authentication, yet the business hasn’t turned it on for a single account.
Frequently Asked Questions
How much should a small business spend on cyber security?
There is no single figure for every business, because the right level of investment depends on the number of accounts, devices and types of customer data you hold. Many basic measures, such as individual passwords for each person and two-factor authentication, often don’t require any extra software.
Should you buy cyber insurance?
Insurance may cover part of the financial loss, but the Insurance Council of Australia says it is not a complete solution. We suggest combining insurance with basic security habits and reading the claim conditions carefully.
Are very small businesses targeted by cybercriminals?
Yes, they can be. According to the ASD report, small businesses self-reported an average cybercrime cost of A$55,000, and according to the Cyber Readiness Institute, most incidents come from human error such as weak passwords or fake emails, the kind of mistake that can happen in a business of any size.
In summary
Small business cyber security doesn’t mean buying as many tools as possible. It means knowing exactly which accounts, devices and data your business holds. Fixing the habits that cause incidents first, then choosing tools based on an assessment that fits your size, is a more controlled way to invest.
Holdrix handles the tech, you focus on growth.
Not sure what level of protection is enough for your nail salon, restaurant or accounting practice? Book a consultation
Is cyber security consulting right for your business?
Talk to the Holdrix team for advice and find the right solution for your business.
Where should your business start?
Talk to the Holdrix team for advice and find the right solution for your business.