10 common cyber security mistakes small businesses make.

Few small businesses are caught out by something exotic. The Australian Signals Directorate (ASD) describes cybercriminals who target Australian businesses as being after money, and the methods it lists are familiar ones: scam messages, phishing, stolen passwords and fake invoices. The ten mistakes below are the ordinary gaps those methods rely on. Most are habits that made sense when the business was three people and one computer.

Mistakes in how the risk is seen

1. Assuming the business is too small to be worth attacking. ASD received more than 84,700 cybercrime reports in 2024-25, about one every six minutes, and the average cost reported by a small business was $56,600. Criminals are after money, and a small business has what they need to get it: bank accounts, customer details, and suppliers who trust its emails.

2. Treating security as something the IT person owns. ASD’s handbook is written for owners, managers and employees, and much of its advice is about what staff do: how payments are checked, who is told when something looks wrong, what happens when someone leaves. Those are management decisions. An IT provider can carry them out but cannot make them for you.

Mistakes with accounts

3. Using the same password in more than one place. ASD calls weak or reused passwords a common cause of cyber security incidents in small businesses. When one website loses its customer passwords, every other account that shares that password is open too. The fix is a password manager, so that each account can have its own long password without anyone having to remember it.

4. Leaving multi-factor authentication switched off, or switched on for only some people. ASD describes MFA as one of the most effective ways to protect business accounts, because a stolen password alone no longer gets anyone in. The usual gap is the exception: the owner who found it annoying, or the old shared mailbox nobody wanted to touch. Our lesson on multi-factor authentication explains the types and where to start.

5. Sharing logins. One accounting login used by four people is convenient until something goes wrong. ASD’s point is that shared accounts make it harder to track who did what, and the password has to change every time one of the four leaves. Give people their own accounts wherever the software allows it, and keep a written record of the shared ones that remain.

6. Making everyone an administrator. An administrator account can install software and switch off security settings, and so can anything that takes that account over. ASD’s advice is least privilege: standard accounts for daily work, and a separate administrator account for the few people who need one. Review the list when people change roles or leave.

Mistakes with devices and data

7. Putting off updates. Updates fix security weaknesses that criminals can exploit, which is why ASD asks businesses not to ignore the prompts. The quieter version of this mistake is equipment that no longer gets updates at all: an old server, a router from ten years ago, a version of Windows the maker has stopped supporting. Turn on automatic updates, and replace what can no longer be updated.

8. Having a backup that nobody has tested. A backup job can report success every night and still be missing the accounting database, or the mailboxes, or everything created since it was set up. ASD’s list of questions for a backup plan ends with how often the backups are tested. If the answer is never, start with A backup you have never restored is a guess.

Mistakes with people and money

9. Paying on the strength of an email. Email compromise and business email compromise fraud were the two cybercrimes businesses reported most to ASD in 2024-25. The usual form is an invoice or a message that says a supplier’s bank details have changed. ASD notes that small businesses are targeted because their payment processes often run on trust and email. Call the supplier on a number you already have before you change anything, and train everyone who can make a payment to do the same. Our lesson on how to spot a phishing email is a good place to begin.

10. Having no plan, or a plan nobody can reach. When something does go wrong, people lose time working out who to call. ASD recommends a written plan that covers how staff report an incident, who to contact, how customers will be told and how work continues while systems are down. It also recommends keeping a copy offline, because a plan stored on the server is unreachable when the server is what failed.

Where to start

Ten at once is too many. ASD’s own starting point is three: turn on MFA, keep software up to date, and back up your data. That covers mistakes 4, 7 and 8. If you use Microsoft 365, the first may be partly done already, since Microsoft’s security defaults require every user to register for MFA and are switched on by default for new Microsoft 365 organisations. It is worth checking that nobody turned them off.

1. This week: check MFA is on for every person’s email, with no exceptions.
2. This month: turn on automatic updates everywhere, list anything that can no longer be updated, and restore one file from the backup to prove it works.
3. This quarter: move passwords into a password manager, replace shared logins with personal ones, and reduce the number of administrators.
4. Before the end of the year: agree the rule for confirming payment changes, write the one-page incident plan, and print it.

To see how the business measures up against the Australian Government’s baseline, our free Essential Eight assessment takes about five minutes. If you would like the gaps closed for you, Best Practices covers the account, device and policy work, and Security Awareness covers staff training and phishing practice.