The $56,600 question: what a cyber incident really costs a small Australian business
A cyber attack costs a small Australian business $56,600 on average, up 14% (ASD 2024–25). Where the money goes, and the five low-cost controls that cut it.
The Australian Signals Directorate's Annual Cyber Threat Report 2024–25 puts the average cost of cybercrime for a small business at $56,600 per report — up 14% in a year. Here's where that money actually goes, and the cheap controls that change the maths.
Cyber risk conversations usually stall on vague fear. Numbers work better. The same report says ASD received over 84,700 cybercrime reports in the year, roughly one every six minutes, and puts the average cost at $97,200 for medium businesses and $202,700 for large ones. For small businesses, averages hide the ugly tail: a business email compromise that redirects one large settlement, or a week offline after a ransomware attack, can multiply that $56,600 several times over.
Where does $56,600 actually go?
A cyber attack usually costs a small business far more than the money stolen: the $56,600 average spreads across five buckets, and the direct theft is often the smallest.
Downtime.
Staff paid to not work while systems are down — for a 15-person firm, every day offline is thousands in wages producing nothing, before a dollar of lost revenue.
Recovery.
Emergency IT help, rebuilt machines, restored data, after-hours rates. Unplanned work is always the most expensive kind.
Direct loss.
The redirected payment, the fraudulent invoice, the drained account — money that rarely comes back.
Obligations.
If personal information was involved, assessment and notification under the Privacy Act's Notifiable Data Breaches scheme, plus legal advice. If a ransom is paid, businesses turning over more than $3 million must also report the payment to the ASD within 72 hours. None of it is free.
The slow costs.
A client who quietly moves on, an insurance premium that jumps at renewal, a tender question you now have to answer awkwardly.
Why does a cyber incident hit small businesses harder?
Because the same loss lands on a much smaller balance sheet. A large company absorbs a $56,600 hit as a bad quarter for one department; for a small business it can be the year's profit — and unlike big companies, small firms rarely have in-house security staff, incident response retainers or war-chest reserves. That asymmetry is exactly why attackers aim at the small end of town: thinner defences, faster payouts, and owners under enough pressure to pay. The "too small to be a target" myth gets more expensive every year.
How can a small business avoid the $56,600 bill?
Put five controls in place. They stop the attacks behind most of these losses, and together they cost a fraction of one incident:
Multi-factor authentication
shuts down the stolen-password attacks behind most email compromise.
Patching that actually happens
closes the known holes automated attacks scan for.
Tested, tamper-proof backups
turns ransomware from an existential threat into a bad day.
Endpoint detection and response
catches the intrusion while it is one machine, not the network.
A payment-verification habit
one phone call, to a number you already hold, before changing any supplier's bank details. It is the cheapest defence against payment redirection scams.
That list maps directly onto the Essential Eight — the Australian government's baseline (explained here in plain English) — which is why Key IT builds every client on it. Compare the monthly cost of doing those five things properly against $56,600, and the business case writes itself. Not sure which of the five you already have? A free cybersecurity health check answers that in 30 minutes.
Frequently asked questions
How much does a cyber attack cost a small business in Australia?
On average, $56,600 per reported cybercrime, according to the ASD's Annual Cyber Threat Report 2024–25, up 14% in a year. Medium businesses averaged $97,200 and large businesses $202,700. Because the figures are self-reported, they may not capture slower costs such as lost clients or higher insurance premiums.
Is $56,600 the worst case?
No — it is the average. Business email compromise incidents routinely run into six figures when a large payment is redirected, and extended ransomware downtime costs more still. The tail is long and expensive.
Doesn't cyber insurance cover all this?
Good policies cover a meaningful slice — if your controls matched what you attested to. Insurers now verify MFA, backups and EDR before paying. Insurance is the backstop, not the plan; see our guide to what insurers check at renewal.
What should a small business spend on security?
Enough to cover the short list above, done properly — for most small businesses that is a modest, predictable monthly amount inside a managed IT plan, not a big capital project. The right comparison is against the cost of one incident.
What's the single first thing to fix?
MFA on email, today. It is free-to-cheap, takes an afternoon, and removes the entry point behind the most common and most expensive attack on small businesses.
What should a small business do straight after a cyber attack?
Contain it: disconnect affected devices from the network without wiping them and reset compromised passwords. If money moved, ring your bank straight away. Tell your cyber insurer early (many policies expect notice before outside help is engaged), bring in an incident response team, and report it to the ASD through ReportCyber or 1300 CYBER1.
More insights
The $18M SME cyber leg-up
Government cyber support for small business: a free Cyber Health Check and one-on-one IDCARE help…
Read article →Cybersecurity'Too small to be a target' myth
Are small businesses cyber targets? Yes. ASD puts the average small business cybercrime cost at…
Read article →Managed ITThe meter effect: included vs ad-hoc support
Included IT support vs ad-hoc comes down to behaviour: when every call costs money, staff sit on…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.