The Threat Landscape Has Shifted in 2026

If you run a business in Australia and haven’t reviewed your cyber security posture in the last twelve months, you are operating with old assumptions. The attackers have moved on and most small to mid-sized operators have not.

Two things changed at the same time. Generative AI tools became cheap and easy to access, and the regulatory environment tightened around how Australian businesses must protect customer data. These are not separate problems. They are reinforcing each other.

A Sydney-based accountant in our network told me recently that her firm had received three voice calls in a single week from someone claiming to be a partner at a client business, asking for an urgent payment redirection. The voice sounded right. The accent was right. It was not the partner. The voice had been cloned from a video the partner had posted on LinkedIn. That is the new baseline.

Industry estimates suggest the volume of AI-assisted phishing attempts targeting Australian SMBs has climbed sharply through 2024 and 2025, and the quality of these attempts has improved even faster. What used to be obvious by the second sentence is now polished, context-aware, and difficult to spot on a phone screen.

What AI Changes for the Attackers

AI did not invent cybercrime. It industrialised it. A few specific shifts matter for Australian operators.

Voice and video cloning is now accessible enough that any attacker with a few minutes of someone’s public video can produce a credible impersonation. We have seen this used against finance teams, payroll staff, and real estate agents in settlement processes. The losses have ranged from a few thousand dollars to over a million in larger cases.

Phishing emails are now generated in the recipient’s writing style and reference real internal projects, often scraped from social media or compromised CRM systems. The grammar tells that used to give them away are mostly gone. The only reliable defence is process and verification, not pattern recognition.

Credential stuffing and brute-force attacks are now run by AI agents that adapt in real time to defensive measures. If you block one IP range, the system rotates. If you slow login attempts, the AI varies the cadence to stay under your thresholds.

Deepfake vendor fraud has hit Australian real estate and legal practices particularly hard. The attacker impersonates a known supplier or counterparty, often using cloned voices, and convinces someone in the business to redirect a legitimate payment. REA Group and several state-based title offices have issued warnings about this pattern in the last year.

The Regulations You Can’t Afford to Miss

Australian regulation around cyber has tightened considerably, and the direction of travel is clear. Even small businesses are caught in the net.

The Privacy Act 1988 and the Australian Privacy Principles apply to most businesses with an annual turnover above AUD 3 million, and to all health service providers regardless of turnover. The Notifiable Data Breaches scheme requires you to notify the Office of the Australian Information Commissioner and affected individuals when a breach is likely to cause serious harm. Penalties have increased and director duties around data protection are now a live issue.

APRA CPS 234 applies if you are an APRA-regulated entity, including most superannuation funds, banks, and insurers, and increasingly their service providers. If you hold data on behalf of an APRA-regulated client, your security posture becomes their problem.

ASIC has been clear that cyber resilience falls under director duties. Several recent enforcement actions have named individual directors. RG 271 and related guidance on internal dispute resolution intersect with how you handle cyber incidents that affect customers.

AHPRA-registered health practices have separate obligations around patient records. The My Health Records system adds another layer for practices that integrate with it.

The SOCI Act applies if you own or operate critical infrastructure assets, which covers more businesses than people realise, including some logistics operators, food distribution, and energy-adjacent services.

Verify with your lawyer or compliance advisor which of these apply to your specific situation. The thresholds and definitions shift, and the cost of getting it wrong is no longer theoretical.

What Your AI Tools Might Be Doing Right Now

Most Australian businesses started using AI in the last two years. Few have audited what those tools are doing with their data.

Xero’s AI features and MYOB’s automation tools are reasonable, but you need to understand what data leaves your tenancy when those features process it. The default settings are not always the most privacy-preserving.

If your team uses ChatGPT, Claude, Copilot, or similar tools with customer data, contracts, or financial information, you have a shadow AI problem. People are uploading sensitive content to public models because the tool is useful, and that data is now in training pipelines or accessible to the provider in ways you may not have approved.

A Melbourne-based law firm I worked with recently discovered that three of its staff had been pasting client matter details into a free AI tool to draft summaries. None had malicious intent. All three were in breach of the firm’s professional obligations under the Legal Profession Uniform Law and the firm’s own privacy policy.

The fix is not to ban AI. The fix is a clear acceptable use policy, approved tools with enterprise agreements, and a register of where AI is being used across the business. For most SMBs this is a one-week project, not a six-month one.

Where Most Australian Small Businesses Are Exposed

Across the businesses we work with, the same gaps show up again and again.

Multi-factor authentication is not on every account that matters. Email, banking, accounting platforms like Xero and MYOB, payroll, and any system holding customer data should require MFA. SMS-based MFA is weak. App-based authenticators or hardware keys are stronger.

Backups exist but have never been tested for restoration. Having a backup is not the same as being able to recover. We typically see businesses find this out during an incident, which is the worst possible time.

No incident response plan. If you get hit at 4pm on a Friday, who do you call, what do you disconnect, and how do you communicate with customers and the regulator. If you cannot answer that in a single page document, you do not have a plan.

Staff training is annual and checkbox-based. The threat changes faster than annual training cycles. Quarterly, short, scenario-based sessions work better than annual compliance modules.

No asset inventory. You cannot protect what you do not know you have. The number of internet-connected systems in a typical 20-person business is consistently higher than the owner expects. Old file shares, forgotten CRM logins, and personal cloud accounts used for work are common blind spots.

Practical Steps You Can Take This Quarter

If you do nothing else this quarter, do these things in order.

Turn on MFA across every system that supports it. Start with email and your accounting platform, then move through banking, payroll, and any system holding customer data.

Write a one-page incident response plan. Who calls whom, who talks to media, who talks to customers, who talks to your lawyer and the OAIC if needed. Print it. Tape it to the wall.

Audit your AI usage. Find out which staff are using which tools, with what data, and under what agreement. Approve a small set of tools, set the rest as off-limits, and put it in writing.

Test your backups. Pick a date, pull a recent backup, and see if you can actually restore it. If the answer is no, fix that before anything else.

Review your cyber insurance. Premiums for Australian SMBs have been rising, and the requirements to obtain or renew cover are stricter. Many policies now require MFA, tested backups, and a written response plan. If you cannot meet those terms, you may find renewal difficult.

Budgeting for Cyber Security in 2026

Pricing has moved, and it helps to have rough numbers when you sit down with your accountant or bookkeeper. The figures below are typical ranges for Australian SMBs and should be treated as a guide only, not a quote.

Endpoint protection with AI-driven threat detection for a 10-person business typically lands between AUD 25 and AUD 80 per user per month, depending on whether you go with a mainstream product or a managed service.

Email security, including anti-phishing and link rewriting, usually runs AUD 5 to AUD 20 per user per month.

Security awareness training platforms typically charge AUD 30 to AUD 60 per user per year, with managed training running higher.

Cyber insurance for a business turning over AUD 2 to AUD 10 million is now commonly in the AUD 2,000 to AUD 8,000 per year range, with premiums varying by industry, data holdings, and security posture.

An incident response retainer with a specialist firm typically sits between AUD 5,000 and AUD 20,000 per year and gives you access to help within hours rather than days. For businesses that cannot absorb a multi-week outage, this is often the most valuable line item.

The Workforce Question

Hiring a full-time security professional is not realistic for most Australian businesses under 50 staff. The talent pool is tight and the salary expectations are high. A capable security manager in Sydney or Melbourne will command AUD 160,000 to AUD 250,000 plus superannuation.

The practical alternative is a managed security service provider, often called an MSSP, who can give you access to a team for a fraction of that cost. The trade-off is less in-house ownership of the problem and the need to choose a provider you trust. Ask any prospective MSSP about their own security certifications, their incident response time, and which clients in your sector they support.

For businesses operating in finance, healthcare, or critical infrastructure, also consider whether you need a designated person responsible for cyber at the executive level. This is increasingly expected by regulators and is becoming a hiring differentiator.

Working With External Help

Most Australian businesses do not need a Big Four security engagement. You need a local provider who knows your sector, can speak plainly, and will turn up when something breaks.

Look for providers who can show you recent work with businesses of your size and in your industry. Ask to speak to two or three current clients. Ask what happens when something goes wrong outside business hours. Ask whether they can support you through an OAIC notification if that becomes necessary.

A good provider will start with a gap assessment, prioritise findings by business risk, and help you build a roadmap that fits your budget over the next twelve to twenty-four months. If the first conversation is a product pitch, walk away.

What Comes Next

AI will keep changing both sides of this problem. Your attackers will keep using it, and so will your defenders, including the tools you are already using inside Xero, MYOB, and your email platform. The job is not to win a technology arms race. It is to put in place the basics that stop the majority of incidents, and to be ready for the ones that get through.

The Australian regulatory environment is not going to soften. Director duties around cyber are real, the OAIC has shown it will act, and customer expectations around how their data is handled continue to rise. A modest, consistent investment in the fundamentals will protect most businesses from most of what they will actually face.

If you are unsure where to start, that is a normal place to be. Most business owners we work with are not security specialists, and they should not have to be. The point is to make a start, document your decisions, and build the habit of reviewing it once a year.

Enterprise DNA works with NZ and AU businesses on this challenge. Get the free Working With Claude field guide — https://enterprisedna.co/resources/working-with-claude?utm_source=edna-landing&utm_medium=blog&utm_campaign=nzau