Cybersecurity remains a persistent challenge for businesses across Australia.

Cybersecurity remains a persistent challenge for businesses across Australia. Insights from the Australian Cyber Security Centre (ACSC) and other national bodies show that cyber threats and online fraud continue to have a significant impact on both individuals and organisations.

Between July 2024 and June 2025, the ACSC received over 84,700 cybercrime reports -about one every six minutes - with identity-based and other malicious attacks remaining widespread. Cybercrime costs rose sharply, averaging AU $80,850 per business incident and AU $33,000 for individuals. Despite more than 80% of small businesses acknowledging cyber risk, only a minority have formal cybersecurity processes, leaving many exposed to scams, ransomware, and business email compromise.

Overall, cyber incidents cost Australian organisations billions annually, including expenses for investigation, legal response, system recovery, and business interruption—though the true impact is likely higher due to significant underreporting.

Threats on the rise in 2026

Our cyber underwriting and claims experts aren’t seeing entirely new threats. They have noticed that ‘old crimes’ are becoming more sophisticated with new technology, and that this is catching businesses out.

Social engineering, upgraded 

System hacks, where hackers gain unauthorised access to or control of a computer system, remain among the most common cyberattacks. System vulnerabilities are often exploited to enable hackers to steal sensitive information (such as customer data) and sell it on the dark web.

System hacks 

System hacks, where hackers gain unauthorised access or control over a computer system, are still one of the most common cyber-attacks we see. Often, system vulnerabilities are exploited so that hackers can steal important information (like customer data) and sell it on the dark web.

Poor response times

Endpoint Detection and Response (EDR) can sometimes generate false positives, but each alert or potential threat should still be carefully analysed. We’ve noticed that some vendors/External Service Providers (ESPs) or EDR users have not responded to EDR alerts quickly enough, resulting in avoidable breaches. This highlights a growing trend of over-reliance on third-party services, which can leave gaps in protection.

Five tips for protection against cyber attacks

1.  Check Multi-Factor Authentication (MFA) is applied everywhere  

MFA has been around for decades, but many companies have inconsistently applied it. Weak spots could be work-from-home laptops accessing the system or external project management software.

MFA offers an extra layer of security. Even if a hacker gets hold of a password, they’re less likely to be able to access systems and information because they’re unlikely to be able to meet the second authentication requirement.

Companies should ensure MFA is enabled as a mandatory requirement for all system access points. Providing staff with a password manager tool that works for them can help improve MFA compliance.

2. Audit systems regularly 

Businesses should audit their systems regularly and ensure that all software, such as operating systems, firewalls, and routers, is patched and updated.

Third-party providers, such as Managed Service Providers (MSPs), should also be audited to ensure the company continues to receive the best service.

Review the services the MSP offers and understand the liability limitations. While many smaller Australian businesses don’t have a lot of leverage here, asking questions and understanding what services are (and are not) included can go a long way.

The short version: keep providers honest and take a hands-on approach to cyber security. Independent security assessors can assist, such as Delta Depend.

3. Implement and test backups

Ransomware attacks occur frequently and can have a significant impact on an organisation. Having (and testing) backups can minimise the problems caused by data and systems being stolen or disrupted.

Ensure that data and systems are backed up offline, in the cloud and segregated from normal systems. These backups should be current and highly organised so the company can restore lost data easily and cost-effectively and get back to work as soon as possible.

4. Run simulations

Just as organisations run fire and earthquake drills, cyber simulations are a great way to test cyber readiness.

When a cyberattack occurs, companies need to respond quickly to minimise potential damage. Running a simulation provides dedicated time to practice the company’s response in that situation. It is also an opportunity to check that manuals and contact details are up-to-date and practical. Scenarios could include:

· Everyone working from home (using MFA and accessing systems safely from outside the office)

· A system failure requiring backups

· MSP leak results in the theft of clients’ private data

Simulations enable the company to become battle-hardened against cyberattacks.

5. Cyber security insurance

Point five is, of course, cyber security insurance. Insurance shouldn’t be a company’s first line of defence, but it is a key part of an organisation’s cybersecurity system. Delta’s cyber liability insurance includes access to benefits such as 24/7 rapid response from IT security experts and access to our panel of risk management partners.

While cybersecurity threats aren't new, they are becoming more sophisticated and more costly for companies. By staying aware of the latest risks and tactics and taking regular preventive measures, businesses can reduce the risk and costs associated with cyberattacks.

The content of this document is illustrative and has been prepared without considering the insured’s objectives, financial situation or needs. Any coverage offered by Delta is subject to terms and conditions contained in and attaching to the policy. Please consider the appropriateness of the information, and importantly, review the policy wording with a broker before considering the product.

References:
1 Australian Cyber Security Centre Annual Threat Report summary
https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2024-2025 `
2 Small business cybersecurity preparedness data - ASBFEO media release on cyber risk
https://www.asbfeo.gov.au/media-centre/media-releases/awareness-not-enough-and-fatalistic-attitude-risks-will-only-make