Protect your business in an afternoon — no jargon, no IT degree required. Six short lessons on the handful of habits that stop the attacks that actually happen.
Tell us where to send it and you'll get instant access on this page — plus a copy of the link by email so you can pick it up any time.
There's a comforting myth that cybercriminals only go after big companies. The opposite is true — small businesses are often the preferred target.
The good news: you don't need to be a fortress. You need to be a harder target than the business next door. A few basic locks send automated attackers off to easier prey — and that's most of the battle. This course gives you those locks, one lesson at a time.
When a website is breached, the stolen passwords end up on lists that criminals feed into software. That software tries the same email-and-password combinations on hundreds of other sites — your email, your accounting tool, your bank. If you reuse passwords, one old breach unlocks your whole business. It's called credential stuffing, and it's one of the most common ways small businesses get hit.
Install a password manager and move your five most important accounts into it: business email, online banking, accounting software, your website/domain login, and your main social media account.
A password can be stolen, guessed or phished. When that happens, it's the only thing between a criminal and your account. MFA adds a second lock — so a stolen password alone isn't enough to get in.
Enable MFA on your main business email account right now. Then do your accounting software next.
All software has flaws. When one is discovered, the maker releases an update to fix it — but that same announcement tells criminals exactly where the hole is. They then run automated tools to find anyone who hasn't updated. Old, unpatched software is one of the easiest ways in.
Switch on automatic updates on your computer and your phone today.
Ransomware locks your files and demands payment. A laptop is stolen or dropped. A staff member deletes the wrong folder. In every case the question is the same: can you get your data back? If your only copy is gone, the answer is no — and for many small businesses that's fatal.
Set up automatic cloud backup for your critical files (OneDrive, Google Drive, Dropbox or a dedicated backup service), and make one copy onto an external drive that you then unplug.
This is how most small businesses are actually hit. Instead of breaking in, the criminal tricks a person into letting them in — a fake email, a text pretending to be the bank, an "urgent" message from the "boss." The most expensive version is business email compromise, where a scammer poses as a supplier or executive and gets an invoice paid into the wrong account.
And it's getting harder to spot. Scammers now use AI to write flawless, personalised messages — the old giveaways of bad spelling and clumsy grammar are gone. AI can even clone a voice from a few seconds of audio, so a phone call "from the boss" may not be real. The lesson: trust your process, not how polished or convincing a message looks.
Put a "call to confirm" rule in writing: any invoice or change to bank details must be verified by phone, to a known number, before payment.
In the panic of a real incident, people freeze or make things worse. A simple plan written now means you act fast and calmly later — and speed limits the damage.
Fill this in now, print it, and keep a copy offline where you can find it without a working computer.
IF WE SUSPECT A CYBER INCIDENT, IN ORDER: 1. Isolate the affected device (disconnect from internet/network). 2. From a clean device, change passwords — email first, then banking. 3. Call the bank if money/financial data is involved. 4. Call IDCARE: 1800 595 160 5. Report at cyber.gov.au | Scams: scamwatch.gov.au 6. Notify affected customers/staff if their data was exposed. KEY CONTACTS Person leading our response: __________________ Phone: __________ Our bank (fraud line): __________________ Phone: __________ Our IT support: __________________ Phone: __________ IDCARE: 1800 595 160 OUR BACKUPS Where they are: _______________________________________________ How to restore: _______________________________________________ Last tested on: _______________________________________________ ACCOUNTS WITH MFA ENABLED [ ] Email [ ] Banking [ ] Accounting [ ] Payroll [ ] Social
Fill in the plan above and pin it somewhere the whole team can find it.
Tick these off and you're ahead of most small businesses in the country. Your progress is saved on this device.
These five habits aren't arbitrary — they're the foundation of the Australian Government's Essential Eight mitigation strategies, published by the Australian Cyber Security Centre (ACSC). Once the basics here are in place, the natural next steps are restricting who has administrator access, controlling which applications can run, and hardening your settings. When you're ready to level up, that's the roadmap.
We help Australian small businesses adopt AI safely — with the cyber and privacy guardrails built in from day one. If you'd like the basics set up properly, or you're weighing up AI and want to do it without getting something badly wrong, start with a free, no-obligation chat.
Book a free AI Opportunity Audit