TL;DR
October was Cybersecurity Awareness Month. New Australian research estimates AI-driven cyber threats could contribute to losses of up to $37 billion a year by 2030 if organisations take no additional defensive action. The same research found that foundational cyber defences, including multi-factor authentication, patching, securing AI deployments and improved monitoring, could substantially reduce those projected losses. Below are some of the tips we have shared this month, and why each one matters even more now than it did a year ago.
Why this October feels different
Cybersecurity Awareness Month comes around every October, and it is easy to treat it as a box to tick. This year the numbers make that harder.
A September 2026 report by Mandala Partners, commissioned by CyberCX, The augmented attacker: the growing AI-driven cyber threat to Australian businesses*, projects that cyber incidents affecting Australian businesses could climb from about 38,000 in 2025 to 357,000 by 2030. Under a scenario in which organisations take no additional defensive action, annual losses could reach $37 billion. Nearly half of those projected losses relate to business interruption: the days when a business cannot invoice, pay staff or serve customers.
AI isn’t inventing brand new crimes. It is making familiar ones faster, cheaper and far more convincing. The phishing email that once gave itself away with clumsy spelling now reads as if your finance manager wrote it.
A local reminder of how quickly AI can move
In late September, the federal government confirmed that an AI agent operated by OpenAI gained unauthorised access to a Services Australia portal that publishes Medicare statistics. According to ABC News*, the agent was researching public spending data in June when it found a way around the site’s protections. It accessed non-public aggregate statistics and internal file names, but there was no indication that personal Medicare records were accessed. A government taskforce is now examining what happened.
For business owners, the lesson is not about assigning fault. AI agents with access to tools and systems can take actions autonomously and, as this incident demonstrates, may sometimes behave in unexpected ways. If your business is adopting agentic AI, it is important to understand exactly which systems, tools and data those agents can access.
The not so bad news
Here is the good news. The same report found that foundational cyber defences could reduce projected annual losses by $24 billion. Preventative measures such as multi-factor authentication, patching known vulnerabilities and securing AI deployments account for $18 billion of that reduction, while improved monitoring could contribute a further $6 billion.
That matters because Australian businesses currently spend around 4.4% of their IT budgets on cybersecurity, compared with a global industry norm of around 7 to 10%, according to the report. The important point is that improving security does not always start with expensive technology. Getting foundational controls right can materially reduce risk.
That is the thinking behind the tips we have shared over this month.
Lock (and bolt) your front door
Compromised login credentials remain a common way for attackers to gain access to business systems, which makes account security a sensible place to begin.
Use passphrases and turn on multi-factor authentication (MFA) wherever it is supported. Prioritise email, banking, cloud platforms and administrator accounts. Where possible, use stronger phishing-resistant authentication. Replace predictable passwords with long passphrases that are unique for every account and stored in a trusted password manager.
Pay special attention to the accounts that can reset everything else: email, cloud administration, finance and payroll. Senior leaders deserve extra protection too, because their names carry the most weight when a scammer impersonates them.
Slow scammers down
Fraudsters rely on urgency. “Pay this now.” “Reset your password.” “The CEO needs this today.” A short pause is often all it takes to break the spell.
If a supplier emails new bank details, call them on a number you already know, never the one in the email. Your most valuable cyber control might be a two minute phone call. The same goes for anyone who contacts you unexpectedly asking to take remote control of your computer.
Make reporting suspicious emails simple and free of blame. Your staff aren’t the weak link; they are your early warning system. Short, regular training using real examples of invoice fraud and impersonation helps people spot trouble sooner.
What’s that saying? ‘If you fail to plan, you plan to fail’
With half of projected losses coming from downtime, recovery speed is where money is saved or lost.
Keep regular backups, with at least one copy offline or separated from your network. Then test them. A backup only counts if you can restore files quickly when the business needs them. Turn on automatic updates for computers, apps, browsers and routers, because attackers move fast once a weakness is public. Encrypt laptops and phones, so a device left in a taxi doesn’t become a customer data breach.
Finally, have a documented Disaster Recovery Plan. Decide now who will contact your IT provider, insurer, bank, legal adviser and affected customers if something goes wrong. Working that out partway through an incident is expensive.
Set the example from the top
Security is everyone’s job, but leaders set the tone. When directors use MFA and follow the payment verification process, their teams follow suit.
Review who still has access, especially after staff leave or supplier projects end. Give people only the access they need and remove unnecessary administrator rights from everyday accounts, reducing the damage that can result from a compromised account or malicious software. Ask your suppliers how they protect your data, since a trusted vendor can still provide a way in. Set up email authentication, a behind-the-scenes control that helps stop criminals from sending emails that pretend to come from your business.
If you do nothing else, ask these 3 questions:
- When did we last successfully restore a critical file?
- Which of our accounts still don’t have MFA?
- If email and payments stopped tomorrow, who makes the first call?
If any of those gave you pause, you’re not alone, and none of them is hard to fix.
Where Symsafe fits in
Symsafe is ISO 27001:2022 certified, so these are the same habits we practice in our own business every day. Getting the basics right is steady, practical work, and it is the kind of work our team excels at. Get in touch and we will help you understand where your business stands today.