Australian small businesses face growing cyber threats but often lack the experience and resources to recover from attacks, which can end up costing them more, a federal inquiry has been told.
An inquiry into cyber security for small to medium-sized businesses and organisations is evaluating their cyber preparedness, and the adequacy and accessibility of guidance offered by the government.
Part of the inquiry’s focus is on cyber insurance, which gives businesses coverage for liability relating to cyber threats, breaches and attacks.
The fresh warnings to bolster cyber security come after recent high-profile breaches, including the global PHP outage and the breach of an OpenAI agent into publicly available Australian government data, with the Australian Cyber Security Centre recording 82,000 attacks in the past financial year.
Cyber threats to small businesses are expected to continue growing, the Insurance Council of Australia’s regulatory and consumer policy general manager Alexandra Hordern said.
“Australia is closer to the start than to the finish of our digitisation journey,” she told a House of Representatives select committee inquiry in Canberra on Monday.
“Small businesses don’t have the resources of larger organisations, so when they are attacked, responding and recovering is harder and costs them relatively more.”
QBE Insurance’s global head of cyber Serene Davis gave evidence on Monday that cyber disruptions were becoming increasingly complex and often went unreported.
“For a small business with limited capacity to absorb disruption, the impact can be quite severe,” she said.
“Many don’t have dedicated cybersecurity teams or ready access to specialist expertise, and they’re managing cyber risk along alongside all the other demands of running a business.”
Ms Davis said QBE market research estimated about 20 per cent of small or medium-sized Australian businesses had cyber insurance, compared with 70 to 75 per cent of large organisations.
But education, awareness and guidance as preventative measures were just as important as insurance in helping businesses be proactive, Ms Davis said.
This was echoed by Ms Hordern, who said while cyber insurance take-up among small businesses was low and should be encouraged, it was no “panacea”.
A submission by the Cyber Readiness Institute emphasised that most cyber incidents affecting small or medium-sized business stemmed from “predictable, preventable” human errors rather than sophisticated attacks.
The US-based non-profit institute, which aims to provide small or medium businesses with free resources to improve resilience to cyber threats, is set to give evidence on Monday afternoon.
Though its own research, the institute found that owners are aware of cyber risks, but lack understanding of what sufficient security looks like relative to their business size.
Australian Associated Press is the beating heart of Australian news. AAP is Australia’s only independent national newswire and has been delivering accurate, reliable and fast news content to the media industry, government and corporate sector for 85 years. We keep Australia informed.
