Cybersecurity awareness month guide for business

A practical, jargon-free cybersecurity guide for Australian SMBs — real threats, real habits, and what actually reduces risk.

Every October, Cybersecurity Awareness Month rolls around and, with it, a flood of generic advice:
“use strong passwords,” “be careful what you click.” True, but not exactly actionable. Australian
businesses — particularly small and medium ones — are being targeted constantly, and the
attacks rarely look like the obvious scam emails of a decade ago.

Being targeted doesn’t mean being an obvious target either — attackers increasingly favour smaller
businesses precisely because they assume, often correctly, that defences will be weaker and less actively
monitored than at a large enterprise with a dedicated security team. Size is not the protection it might
feel like.

This guide skips the scare tactics and the jargon. It covers what’s actually happening to Australian
businesses right now, and five specific, practical habits that make a genuine difference — things
your team can start doing this week, not “eventually.”

What’s actually targeting Australian businesses

The Australian Signals Directorate’s annual cyber threat reporting consistently flags a handful of
attack types as the most costly and common for small and medium businesses. Understanding the shape of
these threats makes the defensive habits below make a lot more sense.

Business email compromise (BEC)

This is the one costing Australian businesses the most, on average, per incident. An attacker either
compromises or convincingly impersonates a supplier, executive, or finance contact, then asks for an
invoice to be paid to “updated” bank details, or requests an urgent, unusual payment. There’s often no
malware involved at all — just a well-timed, well-written email and someone in accounts payable
under pressure to get things done quickly.

Ransomware

Ransomware encrypts a business’s files and demands payment to unlock them. It typically arrives via a
phishing email, a compromised remote access tool, or an unpatched piece of software. The damage isn’t
just the ransom (which Comstel would never recommend paying) — it’s the days or weeks of downtime
while systems are rebuilt.

Phishing & credential theft

Modern phishing emails are polished, well-branded, and often personalised using information scraped
from LinkedIn or a company website. The goal is almost always the same: get you to enter your username
and password into a fake login page that looks identical to the real one.

Remote access & unpatched software

A less-discussed but increasingly common entry point is poorly secured remote access — tools that
let staff or IT providers connect to business systems from outside the office. When these are left with
default or weak passwords, or when the underlying software falls behind on security updates, they become
an open door rather than a convenience. Similarly, software that’s fallen behind on patches —
operating systems, accounting platforms, even the firmware on network equipment — often has known,
publicly documented vulnerabilities that attackers actively scan for. Keeping software updated isn’t
glamorous, but it closes off an entire category of attack that doesn’t require tricking anyone at all.

Five habits that actually reduce risk

1. Slow down on anything involving money or bank details

If an invoice, supplier, or colleague suddenly asks you to pay into “updated” bank details, verify it
by phone — using a number you already have on file, not one from the email itself — before
processing payment. This single habit, applied consistently, stops the large majority of BEC losses.

2. Use a password manager, and stop reusing passwords

Reused passwords are still one of the most common ways businesses get breached: one weak password on
an unrelated site gets leaked, and the same password unlocks something far more valuable. A password
manager makes using a unique, strong password for every account effortless rather than a chore.

3. Turn on multi-factor authentication (MFA) everywhere it’s offered

MFA — a code from your phone in addition to your password — stops the vast majority of
account takeover attempts, even when a password has been stolen or guessed. If it’s available on your
email, banking, or cloud accounting software and it isn’t switched on, that’s the single highest-impact
fix available this month.

4. Know what a real IT request looks like — and what it doesn’t

Attackers increasingly impersonate IT support, asking staff to “install this update” or “verify your
login here.” Make sure your team knows how your actual IT provider contacts them, and that it’s always
okay to hang up and call back on a known number to confirm.

5. Check whether your credentials are already out there

Large-scale data breaches at completely unrelated companies routinely expose email addresses and
passwords that get reused elsewhere. Dark web monitoring services continuously check whether your
business’s credentials have appeared in a known breach, giving you a chance to change them before
they’re used against you — rather than finding out after the fact.

• 6 minTypical time from a phishing
  click to credential compromise
• Top 3Business email compromise
  ranks among the costliest attack types reported to the ASD
• $45/moStarting price for Comstel’s
  SafeWeb dark web monitoring

A closer look at business email compromise

It’s worth spending a little more time on BEC specifically, because it’s consistently one of the
costliest attack types for Australian businesses and, unlike ransomware, it often involves no technical
compromise at all — just convincing social engineering. A typical scenario: an attacker either
compromises a supplier’s email account or registers a lookalike domain (comstel-ict.com instead of
comstel.com.au, for example), then emails your accounts team from what looks like a legitimate, ongoing
business relationship, requesting payment to “updated” bank details for an upcoming invoice.

Because the request often references real invoice numbers, real amounts, and real context from an
actual business relationship, it doesn’t trigger the same alarm bells as an obviously fake email. The
defence isn’t sophisticated technology — it’s a simple, consistently applied process: any change to
payment details gets verified by phone, using a number already on file, before money moves. Businesses
that apply this rule without exception close off the vast majority of BEC risk, regardless of how
convincing the email itself looks.

What Australian privacy law expects of your business

Beyond the direct financial risk, Australian businesses that experience a data breach involving
personal information may have obligations under the Notifiable Data Breaches scheme, administered by the
Office of the Australian Information Commissioner. Depending on the size and nature of your business, a
breach that’s likely to result in serious harm may need to be reported — both to affected individuals
and to the regulator.

This isn’t intended as legal advice, and specific obligations depend on your business’s circumstances
— but it’s a useful reminder that cybersecurity isn’t purely a technical or financial question. A
breach can carry compliance and reputational consequences well beyond the immediate cost of the incident
itself, which is exactly why prevention tends to be a far better investment than remediation.

Building a culture, not just a checklist

The five habits above will meaningfully reduce risk, but the businesses that stay safest over time
tend to share something less tangible: a culture where it’s normal, not embarrassing, to double-check
something that feels slightly off. Staff who feel comfortable saying “this email looks a bit strange, can
someone check it?” without worrying they’ll look paranoid or slow down a process are a genuine security
asset — often catching things that automated tools miss entirely.

This is worth deliberately encouraging, particularly in smaller teams where everyone wears multiple
hats and there’s pressure to move quickly. A five-minute delay to verify a request is almost never
actually costly. A rushed payment to the wrong account very much is.

What Comstel actually does about this

Comstel ICT is a Bitdefender
partner, deploying enterprise-grade endpoint protection and threat detection across
Australian businesses — the layer that catches malware, blocks malicious sites, and flags suspicious
activity before it becomes an incident. Alongside that, our
SafeWeb Dark Web Monitoring
service (from $45/month) continuously scans for your business’s credentials appearing in known data
breaches, with breach alerts and Chubb insurance cover included.

None of this requires an in-house IT team or a security budget built for an enterprise. It’s built and
priced specifically for Australian small and medium businesses, managed entirely by our North Sydney
team — no overseas call centres, no chatbots first.

What to do if something already feels wrong

If you’re reading this because something already feels off — an unusual login alert, a payment
that doesn’t look right, a computer behaving strangely — the advice changes slightly from
prevention to response. Speed matters more than perfection at this stage. Change any passwords that might
be affected immediately, starting with email and banking. If a payment has already been made to
potentially fraudulent bank details, contact your bank immediately; some payments can still be recalled
or frozen within a short window after the transfer. And contact your IT provider — Comstel’s support
line is 1300 700 600 — to help assess whether the issue is contained or still active.

Resist the urge to immediately power off or wipe an affected device before getting advice; in some
cases that destroys evidence that would otherwise help identify how the breach happened and whether it’s
spread elsewhere in the business.

A note on cyber insurance

Some businesses assume cyber insurance is the safety net that makes the above precautions less
critical. In practice, most cyber insurance policies expect a baseline of reasonable security measures to
already be in place — MFA, managed endpoint protection, and reasonable staff practices among them
— and a claim can be complicated or contested if those basics weren’t there at the time of the
incident. Insurance is a sensible layer of protection, but it works alongside good practice, not instead
of it.

Building this into a normal part of running the business

The businesses that manage cybersecurity best over the long term don’t treat it as a one-off project
that gets “finished” and then forgotten. It’s closer to routine maintenance — reviewed periodically
as the business changes, rather than set up once and never revisited. New starters need accounts
provisioned correctly from day one. Departing staff need access revoked promptly, not “whenever someone
gets around to it.” New software or cloud tools adopted by the business are worth a quick security check
before they’re rolled out broadly, not after.

None of this needs to be complicated or expensive to be effective — consistency matters more than
sophistication. A modest set of habits, applied reliably, beats an impressive-sounding security policy
that nobody actually follows.

Frequently asked questions

We already have antivirus — is that enough?

Antivirus is a good baseline but doesn’t cover everything — particularly business email
compromise, which typically involves no malware at all. Layered protection (endpoint security, MFA,
staff awareness, and monitoring) covers far more ground.

What should I do if I think we’ve already been breached?

Change any potentially affected passwords immediately, enable MFA if it isn’t already on, and contact
your IT provider. Comstel’s support line (1300 700 600) can help assess and contain an active incident.

Is cybersecurity really worth the cost for a small business?

Small businesses are targeted more, not less, because attackers assume weaker defences. The cost of a
single serious incident — in downtime, recovery, and lost customer trust — is almost always
higher than the cost of prevention.

How is dark web monitoring different from antivirus?

Antivirus protects your devices from malware. Dark web monitoring checks whether your credentials
have already been exposed elsewhere on the internet — a completely different, and increasingly
important, layer of protection.

Talk to Comstel ICT

Fill in the form below and a Comstel specialist will be in touch the same business day — or call
1300 070 747.

Error: Contact form not found.