What cybersecurity does a small business actually need?

A business of one to five people needs five things: ring before you pay any changed bank details, turn on multi-factor sign-in, keep software up to date, keep backups that can't be changed, and have someone actually watch your protection. Two of them cost nothing, and you can do them this afternoon.

Three of the five come straight from the Australian Cyber Security Centre's advice for small business. The other two, ringing before you pay and having someone watch, are the ones we see make the biggest difference in practice.

The two you can do today

  1. Ring before you pay. A supplier you've paid for years emails to say they've changed banks. You pay, the supplier never sees the money, and you still owe them. False billing was the scam Australian small businesses reported most in 2025, according to the National Anti-Scam Centre. The rule that stops it: when bank details change, ring them on a number you already have, then pay.
  2. Turn on multi-factor sign-in. Signing in then needs a code from your phone as well as your password, so a thief who has your password still can't get in. Start with email, then banking, then your accounting software. About ten minutes each; the government's guide walks you through it.

The three that slip when you're busy

  1. Software kept up to date. Updates close the holes criminals already know about. Automatic updates do most of it, as long as you restart when asked. Today's step: check automatic updates are on, then restart the computer you've been putting off restarting.
  2. Backups that can't be changed. Your way back from ransomware (software that scrambles your files until you pay), theft or a bad Tuesday. A backup you can delete can also be deleted by whoever steals your password, so the copy needs to be locked for a set time. Today's step: ask yourself whether you could delete your own backup from your laptop. If you could, so could a thief. Then try bringing back one file, so you know it works.
  3. Protection someone watches. This is where your antivirus fits. An alert that pops up while you're on a job and gets swiped away is the same as no alert. Today's step: find out who else, if anyone, sees your security alerts. For most small businesses the answer is nobody.

If you'd rather it was simply done

Remember the alert you swiped away on a job? For a WISECLICK member, it has already reached our team by then. We work out what happened and fix it as part of the membership, and your app says "We're on it" until it's sorted. If files need to come back, we restore them for you from a copy that was locked the day it was made.

The backups and the watching, done for you, and a person in Australia to ask about the rest. From $59 a month, cancel any time. Or do all five yourself: everything on this page works without us.

See membership plans

Not sure where you stand?

The Cyber Report Card measures your business against the Essential Eight, the government's baseline list of eight protections, on your phone: eight subjects, one mark, a comment on each, and what to do next. Starting near the bottom is normal. That is the starting line, not a verdict.

Get your Cyber Report Card

Questions

Is antivirus enough?

It covers part of number five, and only if someone is watching it. On its own it does nothing for backups, sign-in or fake invoices.

What is the Essential Eight?

Australia's own baseline list of eight strategies to protect against cyber attacks, published by the Australian Signals Directorate.

How much should a small business spend?

Start with the two that cost nothing. After that, spend on whatever keeps you working on a bad day: a locked backup first, then someone watching.

Sources

Last reviewed 29 October 2026. Written by WISECLICK Pty Ltd, Sydney.

Related