Quick answer
Most attacks on Perth businesses are not sophisticated. They exploit out-of-date websites and software, mailboxes without multi-factor authentication, spoofable email domains and untested backups. Fix those four things first, then work towards the Essential Eight at Maturity Level 2, and make sure you know your reporting obligations under the Privacy Act and the Cyber Security Act.
In this guide
I have been building and repairing websites in Perth since 2008, and the pattern has barely changed: most of the breaches I clean up were not clever. They came through something that was simply left undone. This guide is the plain-English version of what I tell clients when they ask where to begin.
The numbers
The Australian Signals Directorate’s Annual Cyber Threat Report for 2024-25 recorded over 84,700 cybercrime reports, about one every six minutes. The average self-reported cost for a small business rose 14 per cent to $56,600, and ASD responded to more than 1,200 cyber security incidents, up 11 per cent (source).
For a small or medium business, $56,600 is often the difference between a hard year and a crisis, and that figure does not include the time, stress and lost trust.
The threats small businesses most often face
- Business email compromise and invoice fraud. A mailbox is taken over or impersonated, and clients or staff are asked to pay into a new bank account.
- Website compromise. An out-of-date CMS or plugin is exploited by automated bots, and the site is used for spam, redirects or phishing pages.
- Credential phishing. Fake Microsoft 365 login pages steal passwords. Without multi-factor authentication, that is all an attacker needs.
- Ransomware. Files and systems are encrypted, and data is often stolen first so the attacker can threaten to leak it.
The first four fixes
- Turn on multi-factor authentication for email, Microsoft 365 or Google, remote access, banking and every admin account.
- Patch promptly, including your website CMS and plugins, not just laptops. Remove software and plugins you no longer use.
- Lock down your email domain with SPF, DKIM and an enforced DMARC policy so nobody can send as you. See our guide to email security and DMARC.
- Back up and test the restore. Keep at least one copy attackers cannot change, and prove you can get it back.
The Essential Eight
The Essential Eight is the Australian Signals Directorate’s recommended baseline: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups. Each is rated from Maturity Level 0 to 3, and ASD recommends Level 2 for most organisations.
It is mandatory for Commonwealth entities, not private businesses, but insurers, government buyers and larger clients increasingly ask about it. An Essential Eight assessment tells you exactly where you stand.
Your legal obligations
If your organisation is covered by the Privacy Act (generally turnover over $3 million, plus some smaller organisations such as health service providers), you must take reasonable steps to protect personal information and notify the OAIC and affected people of an eligible data breach likely to cause serious harm. Since 30 May 2025, businesses with turnover over $3 million must also report ransomware payments to ASD within 72 hours under the Cyber Security Act 2024.
This is general information, not legal advice; check your obligations with your lawyer.
Where to start
Take our free cyber security self-check to see your biggest gaps in about three minutes, or book an Essential Eight assessment. If something is already wrong, go straight to incident response or call 1300 566 652.
Written and reviewed by Noah Greenstone, Founder and Principal Consultant. Last reviewed 22 October 2026.
