Most small business owners already know they should be doing more about cyber security. Knowing has never been the problem. Getting round to it is.
That is the thinking behind a quiet change this year. October used to be Cyber Security Awareness Month. In 2026 it has become Cyber Security Action Month, with the theme “Take a second. Stay secure.” The message from the government’s cyber security agencies is that awareness on its own is not enough, and what is missing now is people actually making the changes.
It is worth taking seriously. In its most recent Annual Cyber Threat Report, covering 2024-25, the ASD put the average self-reported cost of a cybercrime for a small business at $56,600, up 14 per cent on the year before. That is not a large company’s problem scaled down. For a lot of small businesses it is the difference between a good year and a bad one.
The three things to do this week
The Australian Cyber Security Centre’s list for the month is led by three items: updates, backups and multi-factor authentication. Everyone has heard them. Here is the version of each that most small businesses have not actually done.
1. Update the gear nobody thinks about
Your PCs probably update themselves. The bigger risk is the equipment that does not: the internet router, the firewall, the NAS (the box that stores your shared files) and any remote access tool your IT provider or software vendor uses to log in. These are the front doors to your network, and attackers scan the internet for them. The ACSC has published dedicated guidance on securing these “edge devices” because they are targeted so often.
The same goes for anything that has stopped getting updates altogether, like the back office PC still running Windows 10, which Microsoft stopped supporting in October 2025. Old equipment that no longer gets patched stays open to every weakness found from then on.
Do this: log in to your router or firewall and check the date of its firmware, the software built into the device. If the manufacturer no longer releases updates for it, replace it. Then on each Windows 11 PC, open Settings > Windows Update > Update history. If the last successful install was more than a month ago, an update is stuck.
2. Keep one backup ransomware cannot reach
Ransomware looks for backups and locks up any it can reach. A USB drive that is always plugged in, or a NAS that shows up as a drive letter on your PC, does not count. Keep at least one copy offline, or in a backup service that stops anyone deleting or changing it for a set period. That is called an immutable backup.
Microsoft 365 is not a backup either. A file deleted from OneDrive or SharePoint stays in the recycle bin for 93 days, and a deleted email is kept for 14 days by default. If nobody notices for three months, the file is gone.
Do this: restore a file that is at least a month old, and time how long it takes. That is how long you would really be down.
3. Multi-factor sign-in: email first, then the accounts that move money
Start with email, because whoever controls your inbox can reset almost every other password, and can send invoices that look exactly like yours. Next do online banking, your accounting software, and the account where your domain name is registered. Whoever takes over your domain can redirect your email and your website.
Use an authenticator app rather than codes sent by text message. The ACSC rates text message codes as one of the weaker forms, because criminals can steal them by moving your phone number onto their own SIM card.
Do this: in Microsoft 365, check that Security Defaults is still on. It is free on every plan, makes everyone register for multi-factor sign-in, and blocks the older sign-in methods that skip it. The one exception is if your IT provider has replaced it with Conditional Access policies, which do the same job with more control. And never approve a sign-in request you did not start yourself.
The problem with doing it yourself
You can do all three of these yourself this week, and you should. What a checklist cannot tell you is what you missed. The forwarding rule somebody set up on a mailbox two years ago, the staff login that is already sitting in a breach database, the device on the network nobody remembers buying.
That is what our Security Snapshot is for. It checks the six areas that actually get businesses breached, from your network and Microsoft 365 to your email domain and the dark web, and gives you a plain English report with what to fix first. It is a fixed $297 including GST, the report is with you inside 48 hours, and there is nothing to sign up to afterwards.
Either way, the three changes above are a good week’s work, and each one makes your business a harder target than it was on Monday. If you get stuck on any of them, get in touch and we will happily point you in the right direction.