The federal government is putting real money behind small-business cyber security — a free Cyber Health Check and free one-on-one help. Most eligible businesses will never claim any of it. Here's what's on the table, what has already closed, and how to actually use it.
Small businesses have spent years being told to take cyber security seriously by people who then handed them a 40-page framework and left. That's finally shifting. Under Australia's 2023–2030 Cyber Security Strategy, the federal government committed about $18 million to small and medium businesses — $7.2 million for a free, voluntary cyber health check program and $11.1 million for the Small Business Cyber Resilience Service, which gives one-on-one help to plan improvements and recover from incidents. The money is real. The question is whether your business does anything with it.
Update, October 2026: the separate Cyber Wardens staff-training program, backed by $23.4 million of federal funding, has ended. That funding finished on 31 July 2026 and COSBOA stopped delivering the courses on 11 September 2026. COSBOA says it is talking to partners about a next phase; until something is announced, plan without it.
What government cyber security support is there for small business?
As of October 2026, the federal SME cyber support package gives Australian small businesses two free things: a five-minute Cyber Health Check that produces a prioritised action plan, and one-on-one help from the Small Business Cyber Resilience Service. Neither does the technical work itself — that's the part a managed IT provider like Key IT handles for Melbourne and Australian small businesses.
Free Cyber Health Check
A free, anonymous self-assessment on cyber.gov.au, built by Home Affairs with the Australian Signals Directorate. It takes under five minutes and returns a score, a rating and what to fix first. Think of it as a bulk-billed health check for your IT.
One-on-one support
The Small Business Cyber Resilience Service, run by the not-for-profit IDCARE, helps businesses with 19 or fewer full-time-equivalent staff (sole traders included) build a plan to improve their security, and guides recovery after an incident. Call 1800 595 170, Monday to Friday.
Action plans
A written, prioritised list in plain English rather than a compliance framework, designed for businesses without an IT department.
Cyber Wardens training (now closed)
Free online courses that turned a nominated staff member into the business's eyes and ears for phishing, scams and basic cyber hygiene. Delivery stopped in September 2026, after federal funding ended.
Why is the government paying for this?
Because small business is where Australia's cyber problem concentrates. Small businesses hold valuable data, connect to bigger organisations' supply chains, and mostly can't fund a security team — which makes them both the softest target and, collectively, a national vulnerability. Being too small to be a target is a myth. It is cheaper for the government to fund prevention than to keep absorbing the economic damage of successful attacks. For you, the reasoning matters less than the result: work that would normally cost money is currently free.
What won't free government cyber help do?
Free government help won't do the technical work for you. A checkup tells you what's wrong; it doesn't fix anything. A trained staff member can spot a phishing email; they can't configure conditional access or test your backups. Government programs are excellent at the awareness-and-assessment layer and stop exactly where the technical work starts. So the smart sequence is: take the free assessment, train your people — then treat the action plan as a to-do list that someone technical actually executes. That last step is where most businesses stall, and it's the step that changes your risk.
How should a small business use the free help?
In four steps: get a baseline, give one person ownership of security awareness, fix the gaps against the Essential Eight, and decide who owns the ongoing work.
1. Get a baseline now
Do the government's five-minute Cyber Health Check, then book our free cybersecurity health check, which covers the same ground with a security engineer reading the results.
2. Nominate a security champion
With Cyber Wardens closed, pick the staff member who already cares and make security awareness part of their job. Our free phishing simulation demo is a good first exercise: it shows how your team responds to a realistic attack. One aware person inside the business catches what filters miss.
3. Execute the action plan against a real framework
The items on any credible plan will map to the Essential Eight — MFA, patching, backups, application control. Our Essential 8 self-check shows which controls you have in place in about a minute.
4. Decide what's handled in-house and what isn't
For most small businesses the honest answer is that nobody internal owns patching, monitoring and backup testing — which is what small-business IT support exists to fix, at small-business prices. Still weighing a hire? Read managed IT vs in-house IT.
Frequently asked questions
Is my business eligible?
The Cyber Health Check is open to any small business, not-for-profit or individual — there's no eligibility test. The Small Business Cyber Resilience Service is for Australian businesses with 19 or fewer full-time-equivalent staff, including sole traders. Larger SMEs can still use the health check.
Is the Cyber Wardens program still running?
No. Federal funding for Cyber Wardens ended on 31 July 2026, and COSBOA stopped delivering the training on 11 September 2026. COSBOA has kept the brand and course content and says it is talking to partners about a next phase, but as of October 2026 nothing has been announced.
Is there government funding for small business cyber security?
Not as cash in hand. The federal SME package pays for free services — the Cyber Health Check and the Small Business Cyber Resilience Service — rather than grants you spend with a provider. State programs open and close, so check the grants finder on business.gov.au before budgeting around one.
Is the free government checkup as good as a paid assessment?
It's a genuine baseline and far better than nothing. A paid assessment goes deeper — actually testing controls rather than surveying them, as penetration testing does — and comes with someone accountable for fixing what's found. Do the free one first either way.
We did the checkup. Who fixes what it found?
That's the gap the package leaves, by design — the government funds assessment and guidance, not engineering. A managed provider (us, for many Melbourne and Australian small businesses) turns the action plan into completed work.
Who do we call if we've been hacked?
For a live incident, call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371); eligible small businesses can then get free recovery support from IDCARE. For hands-on containment and recovery, call Key IT on 1300 053 948 and ask for incident response.
Where does the Essential Eight fit into this?
It's the framework behind most of the advice. The government's action plans, insurer questionnaires and our own uplift work all point at the same eight controls — so progress against the Essential Eight is progress against everything at once.
Wondering how your own business measures up? A free IT & Cyber Security Review shows where you stand and what to fix first — no jargon, no obligation.
Book a Free Review