The Real Cost of a Cyber Attack on an Australian Small Business

The Australian Signals Directorate’s annual threat reporting puts the average self-reported cost of cybercrime for a small business at roughly $49,600 per incident. Talk to anyone who has lived through one and they’ll tell you the real number is bigger — because the headline loss is only the first line of the bill.

The bill nobody itemises upfront

• Downtime: days to weeks where quoting, invoicing and delivery stop while systems are rebuilt.
• Recovery labour: IT contractors, forensic specialists and your own team’s time at crisis rates.
• Notification obligations: if personal information was involved, Privacy Act assessment and possible notification to customers and the OAIC.
• The payment that already left: in email-compromise fraud, the redirected invoice is usually unrecoverable after the first day.
• Trust: the quiet cost — customers who don’t come back, and a tender question ("have you had a breach?") you now answer differently.

Why SMBs pay more per incident than enterprises

Big companies absorb incidents with response teams, insurance and redundancy. A 15-person firm absorbs them with the owner’s weekends. Proportionally, the same attack hits a small business many times harder — which is exactly why attackers automate against thousands of SMBs rather than duelling with one bank.

The economics of prevention

The controls that prevent the common attacks — MFA, patching, tested backups, staff training, monitored endpoints — cost a small business a few thousand dollars a year, delivered as a managed service. Against a five-figure average incident (and the non-trivial chance of a six-figure one), prevention isn’t an IT expense; it’s the cheapest insurance policy you can buy — and it makes your actual insurance cheaper too.