The Short Answer
The Report Supports Practical Preparation—Not A Prediction Of Your Loss
ASD's Annual Cyber Threat Report 2024–25 states that the average self-reported financial cost per cybercrime report for small businesses was approximately $56,600, up 14% from the prior year. It is an average of reported incidents, not a forecast for every business. The report also identifies email compromise without financial loss, business email compromise fraud and identity fraud among the leading business reports, supporting priority work on accounts, email, updates, backups and response readiness.
What Matters Most
- Use the cost statistic as context, not a scare-based guarantee about individual exposure.
- Protect email and administrative accounts with MFA and disciplined access.
- Maintain supported systems and reduce unnecessary internet-facing services.
- Prepare payment verification, backup and incident contacts before an event.
01
Read The Numbers In Context
ASD received more than 84,700 cybercrime reports in the financial year, an average of one every six minutes. It states that cybercrime remains underreported, while averages can be affected by the mix and size of reported losses.
A business should not multiply an average by an imagined probability to manufacture ROI. Use its own revenue dependency, payment process, data and downtime tolerance to set priorities.
| Measure | Reported Figure |
|---|---|
| Cybercrime reports | More than 84,700 |
| Average frequency | One report every six minutes |
| Small-business average reported cost | Approximately $56,600 |
| Change from previous year | Up 14% |
02
Prioritise Common Business Failure Paths
Email and identity deserve early attention because they connect communication, password resets, invoices and cloud services. Use MFA, remove stale accounts, restrict administration and teach staff to verify unusual payment or bank-detail changes through a known second channel.
Patch public services and retire unsupported systems. Protect backups from everyday credentials and practise how the business would contact its bank, insurer, IT provider and authorities.
- MFA for email, cloud administration and remote access.
- Separate administration from ordinary daily accounts.
- Independent verification for changed payment details.
- Supported and patched public websites and devices.
- Protected backups with restore testing.
- Written incident contacts and decision authority.
03
Invest In Controls The Team Can Maintain
A control that is configured once and forgotten can quietly stop working. Assign owners for failed backups, security alerts, user changes, patches and supplier access. Review exceptions and record accepted risks.
Ultra IT can establish a practical security and backup baseline for Sunshine Coast and Gympie businesses, then maintain it through support or a managed service rather than presenting security as a one-off product.
Common Questions
Clear Answers Before You Decide
Does Every Small-Business Cyber Incident Cost $56,600?
No. The figure is an average self-reported financial cost per small-business cybercrime report in ASD's 2024–25 data, not a typical invoice or prediction.
What Cyber Control Should A Small Business Start With?
Inventory critical accounts and services, then prioritise MFA, supported updates, administrator separation, payment verification and tested backups according to impact.
Where Should A Cybercrime Be Reported In Australia?
Use ReportCyber for cybercrime reporting and call 000 for immediate danger. Contact banks and relevant providers quickly where accounts or payments may be affected.
Sources And Review Notes
This guide combines Ultra IT's practical service experience with the current primary sources below. Product availability, pricing and platform guidance can change; check the linked source or ask us to review the current environment before acting.
