If you run a small business in Perth, cybersecurity can feel like something only the big end of town needs to worry about. It isn't. The vast majority of breaches we see start with the same handful of basics being missing — and the attackers know exactly which businesses haven't got them sorted.
The good news is that you don't need an enterprise security team or a six-figure budget. You need five things in place, kept up to date, and explained in plain English. Here's what they are and why they matter for a Perth small business in 2026.
1. Multi-factor authentication on email and key apps
This is the single highest-impact thing you can do. Stolen passwords are the starting point for most small business breaches — and a reused password from another breach is usually all it takes. Multi-factor authentication (MFA) means a stolen password alone isn't enough to get in.
At a minimum, turn on MFA for every admin account and for email (Microsoft 365 or Google Workspace). If your accounting software, CRM or practice management platform offers it, turn it on there too.
2. Email filtering for phishing and impersonation
The most common attack we see in Perth is the fake invoice or payment redirection email — someone pretending to be a supplier and asking you to update their bank details. Good email filtering catches a lot of these before they reach an inbox, and the rest are far easier to spot when your team has been shown what to look for.
Modern Microsoft 365 and Google Workspace plans include a level of this, but the defaults are often not enough for a business handling invoices, client funds or patient data. A layer of business-grade filtering on top is worth it.
3. Backup you can actually restore from
A backup you've never tested is not a backup — it's a hope. Ransomware, a failed laptop or a deleted shared folder shouldn't stop your business, but it will if the only copy of your data lives in one place.
For most Perth small businesses, the essentials to back up are Microsoft 365 or Google Workspace (email, OneDrive, SharePoint, Drive), office or cloud servers, and staff laptops. Store it encrypted in an Australian data centre, and test a restore every quarter. Microsoft and Google keep their services running, but backing up your data is your responsibility — deleted or encrypted files may not be recoverable without a separate backup.
4. Device protection and automatic updates
Every computer your staff use should have antivirus, a screen lock, and disk encryption turned on. More importantly, Windows, macOS and your key apps should update automatically. Most ransomware gets in through a known vulnerability that already had a patch available — the computer just hadn't installed it yet.
5. Staff awareness training (and a written summary)
Your staff are your last line of defence, and the most common one to be tested. A short, regular refresher on what a phishing email looks like — and a quick phishing test now and then — makes a real difference. It doesn't need to be formal, it just needs to happen.
When you've put the basics in place, ask for a one-page written summary of what's covered. Your cyber insurer will ask about MFA and backups; your larger clients may ask about your security posture; and you'll want it if you ever have to explain what happened after an incident. Having it ready turns a stressful conversation into a straightforward one.
The Essential Eight, without the overwhelm
The Australian Government's Essential Eight is the baseline set of security controls most businesses are measured against. You don't need to be a government contractor to benefit from it — covering the basics above gets most small businesses a long way toward it, and gives you the right language to answer the questions insurers and clients ask.
We help Perth small businesses put these five things in place at a fixed monthly price, then send you a one-page report showing what's covered and what to fix first. If you're not sure where you stand, a 15-minute security check is the fastest way to find out.
