Ask a mentor – cyber security for business

AI has dramatically changed the speed and effectiveness of cyberattacks. The Australian Signals Directorate warns that attackers can now use AI to find vulnerabilities, chain small weaknesses into a major breach, and run attacks at scale with little human effort.

Scams have become more convincing too, from fake invoices to AI-generated voices. Cyber risk is now a business-continuity, Board and leadership issue, not just an IT problem. All business owners need to understand it well enough to ask the right questions.

What has saved the day for my clients is discipline, not expensive technology.

• Tested off-site backups meant they could restore and keep trading.
• Ongoing staff education meant people stopped and checked before clicking or paying.
• Keeping guest Wi-Fi separate from the business network closed an easy way in.

Success came when the owner led digital security as a routine matter, rather than a one-off project.

Plan for the day all the screens go dark. AI-enabled attacks could shut down systems for days or weeks, or wipe data entirely. Keep hard copies of your Crisis Management Plan and mission-critical information somewhere secure and easy to reach. Include who to call, how to reach staff and customers, and how to keep trading manually.

Keep looking for the weakest link, which is very often a supplier, an old system or a rushed payment. Ask your IT provider and key software vendors how they protect your data. Check your cyber security clause in your insurance policy and understand it. Always confirm changes to bank details by phoning a known number. Start with the free guides at cyber.gov.au.

When I started working in IT nearly 30 years ago, most businesses worried about hardware failures and power outages. Today, the risks are very different.

Every business depends on technology. Whether it's email, accounting software, customer records, online banking or cloud services, a cyber incident can disrupt your operations, damage your reputation and impact your cash flow. Small businesses are not immune. In fact, they're often targeted because they typically have fewer resources and less formal security controls.

Cyber security is also becoming a business requirement rather than simply a good idea. Customers, insurers, government agencies and larger organisations increasingly expect businesses to demonstrate that they take cyber security seriously. I've seen businesses improve customer confidence, strengthen supplier relationships and become more competitive by proactively improving their cyber security.

Understanding cyber security isn't about becoming a technical expert. It's about understanding the risks, making informed decisions and putting sensible protections in place so you can focus on running and growing your business.

One thing I've learned over the years is that successful cyber security projects are rarely about technology alone.

I worked with a growing business that had invested heavily in technology, but very little time had been spent reviewing how it was being used securely. We identified gaps around account security, staff awareness, backups and access management.

Rather than overwhelming them with a long list of technical recommendations, we focused on the highest-priority risks first. We implemented stronger protections, improved backup processes, trained staff to recognise common scams and established practical policies and procedures.

What made it successful was that the business owners understood why the changes were important. When people understand the risk and see practical benefits, cyber security becomes part of the culture rather than just another IT project. The outcome wasn't just better security. It was greater resilience, confidence and preparedness for future growth.

For most small businesses, I recommend backing up important business data at least daily. Some organisations may require more frequent backups depending on how often their information changes.

At a minimum, businesses should back up:

• customer and client information
• financial and accounting records
• emails and calendars
• documents and spreadsheets
• websites and databases
• critical cloud data
• important system configurations.

I also encourage businesses to test their backups regularly. I've seen organisations assume everything was backed up correctly, only to discover a problem when they needed to recover data. Testing provides confidence that your recovery plan will work when you need it.

Most scams still arrive through email, but we're increasingly seeing text messages, social media messages, phone calls and even AI-generated content being used to trick people. Cyber criminals are becoming more sophisticated, but their goal remains the same—to exploit people rather than technology.

My advice to staff is simple—if something doesn't feel right, stop and verify.

Be especially cautious if the request involves:

• money transfers
• changes to bank account details
• gift cards
• passwords or login details
• urgent action designed to create pressure.

I've always told clients that nobody gets into trouble for asking questions. Creating a culture where staff feel comfortable speaking up and reporting something suspicious is one of the most effective cyber security controls a business can have.

Don't let cyber security become overwhelming.

Business owners sometimes think they need enterprise-grade solutions or huge budgets to be secure. In reality, some of the most effective protections are relatively simple:

• multi-factor authentication
• strong passwords
• regular backups
• software updates
• staff awareness training.

Cyber security isn't about buying the latest security product. It's about building good habits, putting sensible protections in place and continually improving over time.

I'm also a strong advocate for frameworks such as SMB1001. What I like about SMB1001 is that it provides a practical roadmap specifically designed for small and medium-sized businesses. It helps business owners understand what good cyber security looks like without needing to become cyber security experts themselves.

My philosophy has always been that good cyber security should enable a business, not slow it down.

The best time to improve your cyber security is before you need it. A few proactive steps today can save a lot of stress, downtime and expense down the track.

There is no single answer because every business needs to first determine what information and systems are critical to its operation.

If your email is critical, back it up. If your accounting system is critical, make sure that data can be recovered. The same applies to platforms such as Microsoft 365, Google Workspace, Xero, HubSpot, Salesforce and the other cloud services your business depends on.

Do not assume that because something is 'in the cloud' it automatically meets your backup and recovery requirements. Speak to your managed service provider (MSP) or IT provider about what is actually being backed up, how often it is being backed up, how long those backups are retained and, importantly, how quickly they can be restored.

There are 3 useful concepts businesses should understand:

• Recovery point objective (RPO) is how much data you are prepared to lose. If you back up once per day at 6pm, you are effectively accepting the possibility of losing up to 24 hours of work. For many businesses that might be acceptable. For a business processing high-value or time-sensitive transactions, it may not be.
• Recovery time objective (RTO) is how quickly you need the system or information restored. If the business needs to be operating again within 1 day, but restoring from backup takes 3 days, the backup strategy does not meet the business requirement.
• Maximum tolerable downtime (MTD) is the longest the business can operate without that system, platform or information before the consequences become unacceptable or potentially threaten the survival of the business.

Most importantly, test your backups. Restore an email. Restore a file. Restore a folder or system periodically. If you never test your backups, you do not actually know whether they work.

Email remains one of the most common ways scams reach businesses, including phishing and business email compromise.

One particularly damaging example is invoice fraud, where an attacker compromises or impersonates a supplier and sends altered bank account details.

The first defence is staff awareness training. If an email looks wrong, do not click the link, open the attachment or simply forward it around the organisation. If your organisation provides a 'Report Phishing' function in Outlook or your email platform, use it and follow your internal reporting process.

Businesses can also use email security services that inspect incoming messages and block or quarantine potentially malicious emails before they reach staff.

Payment and banking changes deserve particular attention. If you receive an email advising that a supplier's bank details have changed, stop and independently verify the request. Do not use the phone number contained in the suspicious email or altered invoice.

Go to your customer relationship management (CRM), accounting platform or another trusted source, obtain the supplier's known telephone number and call them. I also recommend asking them to read the invoice number, amount and banking details back to you, rather than giving them the information and asking them to simply confirm it. That small procedural difference can prevent a very expensive mistake.

For small and medium businesses, have a look at the SMB1001 cyber security standard. It provides a prescriptive and scalable approach designed specifically for smaller organisations and can provide a useful pathway for improving cyber security maturity.

Larger or more mature organisations may eventually move toward frameworks such as ISO 27001, but determining when that makes sense depends on the organisation, its customers, contractual obligations and risk profile.

Some other practical measures I strongly recommend are:

• Make sure all important accounts use multi-factor authentication.
• Speak with your insurance broker about appropriate cyber insurance.
• Use modern endpoint protection such as Endpoint Detection and Response, or EDR, rather than relying solely on traditional antivirus.
• Keep systems and applications patched and up to date.
• Have a documented cyber incident response plan.
• Have a business continuity plan and test it.

A cyber incident response plan does not need to start as a hundred-page document. At its simplest, it is a set of instructions telling people what to do when something goes wrong.

Who do we call? Who has authority to make decisions? Do we contact our MSP? Our insurer? Our lawyer? How do we communicate if email is unavailable?

When an incident occurs is not the time to start working those things out. The goal is to be able to take the plan off the shelf and start following it.

For Australian small businesses, I recommend starting with the Australian Signals Directorate's Australian Cyber Security Centre resources at cyber.gov.au.

There is an enormous amount of cyber security information available online, but businesses should be careful about whose advice they rely upon. Cyber security remains an industry where it can be difficult for a business owner to independently assess someone's expertise. Look beyond the website and marketing material. Look at a provider's qualifications, experience, professional engagement and contribution to the cyber security community. Do not rely solely on someone's website. Look at how they engage with others in the industry. Are they participating in the broader cyber security community? Are they operating at the level you would expect from someone presenting themselves as an expert?

Most importantly, make sure the person advising you understands your business. Good cyber security advice should help you manage business risk. It should not simply be a list of technologies somebody wants you to buy.

It's not a matter of if, but when. So you need to know how to deal with a cyber security incident.

Having passwords, backups, antivirus, multi-factor authentication and security systems is important. But having a control is not the same as knowing it works. Someone needs to own it, check it and know what happens if it fails.

For every important cyber control, ask:

• Who owns it?
• How do we know it works?
• Where is the evidence?

Think about the businesses you rely on to store your information, process payments, manage customers or provide technology. If they hold your data or have access to your systems, their cyber security can become part of your business risk.

For each important supplier, ask:

• What can they access?
• How is it protected?
• If something goes wrong, how quickly will we know?

For a small business, good cyber governance doesn't need to be complicated. Start by mapping:

People → Systems → Information → Suppliers → Controls → Owners

Then identify what would hurt your business most if it were lost, stolen or unavailable. That gives you somewhere practical to start.

One final thought:

Cyber security isn't about eliminating every risk, and it certainly isn't just about having more technology. Before buying another tool, understand what you already have.

It's about understanding your important risks and being prepared.

For me, the question isn't simply: 'Do we have cyber controls?' it's 'Do we know they work?'

That small shift can make a significant difference to how confidently a business responds when something goes wrong.

Without good cyber-security, a business leaves themselves open to hacking that can not only cost a lot of money, but it can also cause needless stress in the workplace. There may also be legal implications.

• No sharing of passwords.
• No generic passwords (e.g. Catherine1234, Maddy1234).
• If in doubt about a link sent via email or text message don't click, ask and discuss with your team first.

• Small Business Cyber Security Guide – Australian Cyber Security Centre
• Cyber security – business.gov.au

Understanding cyber security is crucial for businesses due to the increasingly digital landscape and the potential risks posed by cyber threats. Here is why:

Protection of sensitive data
Businesses handle a vast amount of sensitive data, including customer information, financial records and intellectual property. Failure to secure this data can lead to data breaches, financial loss and reputation damage.

Legal and regulatory compliance
Many industries are subject to strict data protection regulations such as General Data Protection Regulation (GDPR) and Payment Card Industry Data Security Standard (PCI DSS). Failing to comply with these regulations can result in significant fines and legal consequences.

Reputation management
A data breach can severely damage a company's reputation and erode customer trust. Rebuilding trust after a breach can be difficult and expensive.

Financial impact
Cyberattacks can lead to financial losses through theft of funds, business disruption and recovery costs. Additionally, insurance premiums may increase after a cyber incident.

Business continuity
Cyberattacks can disrupt business operations, leading to downtime, loss of productivity and potential revenue loss. Having robust cyber security measures in place ensures business continuity.

Supply chain security
Many businesses are interconnected through supply chains. Weaknesses in one company's cyber security can expose the entire supply chain to risks.

Intellectual property protection
Companies invest heavily in research and development. Cyberattacks can lead to theft of intellectual property, harming a business's competitive edge.

Employee awareness
Employees are often the first line of defence against cyber threats. Proper training and awareness programs can help employees identify and prevent potential security risks.

Innovation and growth
As businesses rely more on digital technologies, understanding cyber security becomes essential for innovation and growth. Protecting new technologies and digital initiatives is crucial for sustained success.

Global connectivity
The interconnected nature of the modern business world means that cyber threats can come from anywhere. Understanding cyber security helps businesses anticipate and mitigate these threats.