Cyber security can sound complicated, but many of the most effective protections begin with simple everyday habits.
Small businesses rely on email, online banking, accounting software, customer records, cloud applications and connected devices. If one account or computer is compromised, the result can include stolen information, fraudulent payments, lost files, business interruption and reputational damage.
Australian small and medium businesses do not necessarily need an internal cyber security department, but they do need clear processes and suitable protection. The following steps provide a practical starting point.
Use Antivirus and Security Software
Antivirus software helps detect, block and remove malicious software such as viruses, spyware, trojans and ransomware.
Windows 11 includes Microsoft Defender Antivirus as part of Windows Security. For many small businesses, this provides a useful baseline when it is enabled, updated and configured correctly.
Check that:
- Real-time protection is enabled
- Virus definitions update automatically
- Regular scans are running
- Staff do not disable security warnings
- Threat notifications are reviewed
- Only trusted software is installed
Installing multiple antivirus programs does not necessarily provide better protection. Security products can interfere with each other, so businesses should use one properly configured antivirus solution rather than several competing programs.
Businesses with multiple computers may benefit from centrally managed endpoint protection. This allows an IT provider to monitor devices, apply security policies and respond to detected threats across the organisation.
Keep Windows and Other Software Updated
Software updates do more than add features. They frequently repair security weaknesses that cybercriminals could otherwise exploit.
Turn on automatic updates for:
- Windows
- Microsoft 365 and Office applications
- Web browsers
- Accounting and business software
- Mobile phones and tablets
- Antivirus software
- Routers and networking equipment
- Printers and other connected devices
Computers should also be restarted regularly so downloaded updates can finish installing. If employees continually postpone restarts, important security updates may remain incomplete.
Windows 10 Is No Longer Fully Supported
Microsoft ended standard support for Windows 10 on 14 October 2025. Windows 10 computers still operate, but standard installations no longer receive free security updates or technical support.
Continuing to use an unsupported operating system increases risk over time as new vulnerabilities are discovered.
Businesses still using Windows 10 should:
- Check whether each computer can be upgraded to Windows 11
- Replace devices that do not meet Windows 11 requirements
- Use an eligible Extended Security Updates program only as a temporary transition
- Create a planned replacement schedule for older computers
Hunter Office Technology can help businesses source suitable Windows 11 laptops and desktop computers for individual users or larger workplace upgrades.
Use Strong, Unique Passphrases
Reusing the same password across several accounts creates a major risk. If one service is breached, criminals may try the stolen login details against email, banking, social media and other business systems.
Each important account should have a unique password or passphrase.
The Australian Cyber Security Centre recommends passphrases containing four or more random words. A longer passphrase can be easier to remember and harder to guess than a short, complicated password.
A strong passphrase should be:
- Long
- Unique to one account
- Difficult for another person to predict
- Unrelated to the employee’s name, business or family
- Stored securely
Businesses should consider using a reputable password manager. This allows staff to generate and store unique login details without trying to remember every password.
Passwords should never be stored in unsecured spreadsheets, shared documents or notes left beside the computer.
Turn On Multi-Factor Authentication
Multi-factor authentication, commonly called MFA or two-factor authentication, requires an additional form of verification after entering a password.
This might be:
- A code generated by an authentication app
- A notification sent to a trusted device
- A physical security key
- A one-time SMS code
- Fingerprint or facial recognition
MFA provides another barrier if a password is stolen.
It should be enabled wherever available, particularly for:
- Business email
- Microsoft 365
- Online banking
- Accounting platforms
- Cloud storage
- Remote access
- Social media accounts
- Website administration
- Domain and hosting accounts
Business email should be one of the highest priorities. Once criminals gain access to an email account, they may impersonate staff, reset other passwords or send fraudulent invoices to customers and suppliers.
Teach Staff to Recognise Phishing
Phishing messages attempt to trick people into revealing information, opening a malicious attachment, visiting a fake website or making a fraudulent payment.
They can arrive through email, text message, social media, phone calls or messaging applications.
Common warning signs include:
- Unexpected password-reset messages
- Urgent requests for payments or gift cards
- Changed supplier bank details
- Unusual invoices or attachments
- Messages claiming an account will be closed immediately
- Links that do not match the organisation’s real website
- Requests to bypass normal approval processes
- Slightly altered email addresses or domain names
- Unexpected QR codes
- Poor or unusually formal wording
Modern phishing emails can look professional and may use information gathered from websites or social media.
Staff should be encouraged to slow down and verify unusual requests. If a supplier sends new bank details, call them using a previously known phone number—not a number included in the suspicious email.
Businesses should create an environment where employees can report suspicious messages without embarrassment. A quickly reported mistake is much easier to contain than one hidden because a staff member fears being blamed.
Back Up Important Business Data
Backups help businesses recover from ransomware, hardware failure, accidental deletion, theft and other incidents.
Important information may include:
- Customer and supplier records
- Accounting files
- Business documents
- Email data
- Quotes and invoices
- Project files
- Databases
- Staff records
- Website content
A cloud synchronisation service is not always a complete backup. If files are deleted, encrypted or overwritten, those changes may also synchronise.
Businesses should keep protected backups that are separated from normal user access. Backups should run automatically and be tested regularly to confirm the information can actually be restored.
A backup that has never been tested should not be assumed to work.
Limit Staff Access
Employees should only have access to the information and systems required for their work.
Giving every employee administrator access increases the potential damage caused by a compromised account, malicious software or accidental change.
Businesses should:
- Give each employee an individual account
- Avoid shared passwords
- Limit administrator privileges
- Review access when an employee changes roles
- Disable accounts promptly when staff leave
- Secure remote access
- Regularly review who can access financial and customer data
Separate accounts also make it easier to identify who made a change and to remove access without disrupting other employees.
Protect Business Email and Payment Processes
Email compromise is particularly dangerous because criminals can impersonate trusted staff, suppliers or customers.
Businesses should establish clear procedures for:
- Changing supplier bank details
- Approving large payments
- Sending sensitive information
- Resetting employee passwords
- Granting access to business systems
Important financial changes should require confirmation through a second communication method. For example, a bank-detail change received by email should be confirmed by calling a known contact.
MFA, strong passwords and staff awareness all help, but clear payment procedures provide another important layer of protection.
Create a Basic Cyber Incident Plan
A small business should know what to do before a cyber incident occurs.
The plan does not need to be complicated. It should identify:
- Who employees should contact
- Which systems are most important
- Where backups are stored
- How affected devices will be isolated
- Who can reset accounts and passwords
- Which customers or suppliers may need to be notified
- The business’s external IT contact
- How operations will continue during an outage
If an employee believes a computer is infected, they should stop using it and contact the nominated IT provider. They should not attempt random fixes, delete evidence or continue logging into business accounts from the affected device.
A Simple Cyber Security Checklist
Australian small businesses should begin with these actions:
- Turn on automatic software updates
- Upgrade or replace unsupported Windows 10 computers
- Enable and regularly update antivirus protection
- Use a unique passphrase for every important account
- Store passwords in a reputable password manager
- Enable MFA, especially for email and financial systems
- Train staff to recognise phishing messages
- Verify changed payment details independently
- Back up important information
- Test that backups can be restored
- Remove access when employees leave
- Maintain a basic incident-response plan
These measures cannot remove every risk, but they can make common attacks considerably more difficult and reduce the damage if something goes wrong.
When Should a Small Business Get Professional IT Help?
Basic security habits are a strong starting point, but growing businesses may require more advanced protection.
Professional assistance should be considered when a business needs:
- Managed antivirus and endpoint protection
- Microsoft 365 security configuration
- Business email protection
- Network and firewall management
- Secure remote access
- Cloud backup and disaster recovery
- Security monitoring
- Staff awareness training
- Access and account management
- Incident response planning
Hunter Office Technology can assist with sourcing suitable business computers and workplace hardware. For business IT support, cybersecurity, cloud services, networking, managed IT and backup solutions, we refer customers to our trusted local partner, Elevated IT.
Learn more about our IT and computer support referral services or contact Hunter Office Technology for help finding the right place to start.
Frequently Asked Questions
Is Microsoft Defender enough for a small business?
Microsoft Defender provides useful built-in protection when it is enabled and updated. Businesses with multiple devices or higher security requirements may benefit from centrally managed endpoint protection and professional monitoring.
Can a business keep using Windows 10?
A Windows 10 computer will continue to operate, but standard support ended on 14 October 2025. Businesses should upgrade compatible devices to Windows 11, replace unsupported hardware or use an eligible Extended Security Updates program as a temporary measure.
What is the best password for a business account?
Use a long, unique passphrase made from four or more random words. Do not reuse it on another account, and enable MFA wherever possible.
How can staff check whether an email is genuine?
Check the full sender address, avoid unexpected links and attachments, and independently verify unusual payment or account requests using previously known contact details.
Do small businesses really need cyber security?
Yes. Small businesses hold valuable financial, customer and login information and often rely heavily on a small number of computers and cloud accounts. Even a limited incident can interrupt operations and create significant recovery costs.