Security Published February 2026 · 6 min read
If you run a business in Melbourne, you don’t need to be told that cyber risk is rising. The headlines — Optus, Medibank, Latitude, and the steady drumbeat of mid-market incidents that don’t make the front page — have made cyber security a board-level conversation. What’s less obvious is what to actually do. The vendor noise is overwhelming, the budget is finite, and the decisions are being made by business owners and operators who never signed up to be cyber experts.
This article cuts through that noise. We’ll cover the threat landscape as it actually is in 2026, the layered defences every Australian SMB should have in place, the regulatory backdrop, and a 30-60-90 day plan for businesses starting from a low baseline. The framing throughout is practical — what works, what’s worth the money, and what to skip.
The 2026 Threat Landscape
Three trends define cyber risk for Australian SMBs right now.
Phishing and business email compromise (BEC) remain the dominant entry point. AI-generated phishing is more convincing, more targeted, and harder to detect. Fake invoice attacks, payroll redirection scams, and CEO-impersonation transfers are netting Australian businesses tens of millions of dollars per year, with the average loss per incident continuing to climb.
Ransomware has shifted to data extortion. Modern attackers don’t just encrypt your files — they exfiltrate them and threaten release if you don’t pay. Backups still matter, but they no longer fully solve the problem because the data has already left your network.
Supply-chain attacks are democratising. Compromises at MSPs, software vendors, and third-party services cascade into client environments. Every connection to a supplier’s system is a potential ingress path.
The common thread: SMBs are not too small to be targets. Automated reconnaissance and AI-assisted attacks have made it economical to attack smaller businesses at scale. The question isn’t whether you’ll be probed; it’s whether you’ll be ready when you are.
The Essential Eight: Your Baseline
The ACSC’s Essential Eight is the de facto Australian baseline for cyber security maturity. It’s pragmatic, prioritised, and tied to real-world attack patterns. If your business doesn’t have a documented Essential Eight maturity level, that’s the first thing to fix.
The eight controls, grouped by purpose:
Prevent malware execution. Application control (only approved software runs), patching applications, configuring Microsoft Office macro settings, and user application hardening (locking down browsers, PDF readers, etc.).
Limit the extent of incidents. Restricting administrative privileges, patching operating systems, and multi-factor authentication.
Recover data and system availability. Regular backups that are tested and offline.
The model uses three maturity levels — Level 1 protects against opportunistic attackers, Level 2 against more capable adversaries, and Level 3 against state-grade threats. Most Australian SMBs should be aiming for Level 2 across the board, with Level 1 as the absolute minimum.
The Five Layers Every Business Needs
Stepping above the Essential Eight, here’s the practical layered architecture we deploy and recommend.
Layer 1: Identity
Identity is the new perimeter. The single highest-leverage investment is multi-factor authentication on every account, every service, every login. Phishing-resistant MFA — passkeys, FIDO2 hardware keys, or properly-implemented number matching — outperforms SMS or basic push notifications by a wide margin. Beyond MFA: conditional access (block sign-ins from unexpected geographies and risky devices), privileged access management (admin accounts separate from daily-use accounts), and regular access reviews.
Layer 2: Endpoint
Modern endpoint detection and response (EDR) replaces traditional antivirus. Tools like Microsoft Defender for Business, CrowdStrike Falcon Go, SentinelOne, or Sophos Intercept X provide behavioural detection and automated response, not just signature matching. Pair EDR with managed detection (a 24/7 SOC) for a meaningful step up — software alone can’t replace human investigation when alerts fire at 2am.
Layer 3: Email and Web
Email is the primary attack surface. Microsoft 365 and Google Workspace both ship effective base-line protection, but for any business handling regulated data or financial transactions, an additional secure email gateway and link-rewriting service pays for itself the first time it stops a credential-harvesting page. DMARC, SPF, and DKIM — configured to a reject policy — stop attackers from spoofing your domain to your customers.
Layer 4: Data and Backup
Three backup principles worth memorising: 3-2-1 (three copies, two media, one off-site), immutability (backups that cannot be deleted by a compromised admin), and tested restores (an untested backup is a hope, not a control). Modern ransomware specifically targets backup systems — air-gapped or immutable copies are not optional.
Beyond backup, deploy data loss prevention (DLP) on email and cloud storage, classify and label sensitive data, and use encryption at rest and in transit consistently.
Layer 5: Network and Cloud
Modern network security is less about firewalls and more about identity-aware access. Zero-trust principles — verify every request, assume breach, least privilege — apply equally to on-prem networks and cloud workloads. For SMBs, that often translates to: SASE or ZTNA in place of legacy VPN, Microsoft Entra Conditional Access for SaaS, and cloud-native security posture management (Defender for Cloud, AWS Security Hub) for cloud workloads.
The Human Layer: Training and Culture
Tools alone don’t stop a confident phisher. Effective security awareness training combines three elements: regular short modules (15 minutes monthly beats an annual hour), simulated phishing campaigns with debriefs, and a no-blame culture that encourages reporting near-misses rather than hiding them.
The single most important behavioural rule for staff: verify any payment-detail change through a second channel. A phone call to a known number prevents the vast majority of BEC fraud. Make this a written policy and audit compliance — including for the executives who think they’re too senior to follow it.
Incident Response: When (Not If)
Every business should have a documented incident response plan. It doesn’t need to be 80 pages — a five-page plan that’s actually been read and rehearsed beats a perfect plan that lives unread in a drawer. Cover:
Who’s in charge during an incident, who can make decisions, and how out-of-hours contact works. Initial triage steps (isolate affected systems, preserve evidence, do not pay or interact with attackers without legal advice). Internal and external communications (customers, suppliers, regulators, insurer, legal). Recovery procedures and decision criteria. Post-incident review and improvement.
Run a tabletop exercise once a year. Even 90 minutes around a meeting room with a hypothetical scenario surfaces gaps you won’t find any other way.
The Compliance Backdrop
Australian businesses face a tightening regulatory environment.
Privacy Act amendments. The 2024 and 2026 amendments significantly increased penalties for serious breaches (up to A$50 million or 30% of adjusted annual turnover), expanded individual rights, and introduced new transparency obligations around automated decision-making.
Notifiable Data Breaches scheme. Eligible breaches must be reported to the OAIC and affected individuals as soon as practicable. The clock is short and the documentation requirements are substantive.
Industry-specific obligations. Critical infrastructure (SOCI Act), financial services (APRA CPS 234), health (My Health Records), and education sectors all carry additional cyber security obligations.
Cyber insurance. Insurers now require evidence of MFA, EDR, immutable backups, and security awareness training as conditions of cover. Many businesses discover their insurer’s requirements during a claim — check yours before you need it.
A 30-60-90 Day Plan from a Low Baseline
If your security maturity is currently low, here’s a sequenced plan.
Days 1–30: Stop the bleeding. Enforce MFA on every account — no exceptions. Audit and remove unnecessary administrative privileges. Verify backups exist, are off-site or immutable, and run a single full restore test. Roll out EDR if you don’t have it. Configure email DMARC to a quarantine policy as a first step toward reject.
Days 31–60: Build the foundation. Document an Essential Eight maturity assessment with a target level. Roll out conditional access and security awareness training. Run a phishing simulation to baseline staff resilience. Draft an incident response plan and identify external partners (DFIR, legal, comms) before you need them.
Days 61–90: Mature and test. Implement application control where practical, harden Office macros, and patch all priority systems. Run a tabletop exercise. Engage a third party for an external vulnerability scan and a basic penetration test. Document, train, repeat.
What to Skip (For Now)
Some controls are valuable but premature for businesses still working on the basics. SIEM platforms, dedicated SOC tooling, advanced threat intelligence subscriptions, and bespoke red-team engagements all add real value — but only after the foundation is solid. Don’t buy a $50,000 SIEM if you haven’t enforced MFA.
Where Computers Unleashed Fits
We help Melbourne businesses move from low to genuinely defensible cyber security maturity, without breaking the bank or the business. Our typical engagement starts with an Essential Eight maturity assessment, prioritises gaps by risk and effort, and either runs the remediation as a managed service or hands a clear plan to your team. We’re practical, vendor-pragmatic, and we measure success by what doesn’t happen, not by how many tools we sold you.