A federal inquiry into cyber security for small to medium-sized businesses and organisations is evaluating their cyber preparedness, and the adequacy and accessibility of guidance offered by the government.
The fresh warnings to bolster cyber security come after recent high-profile breaches, including the global PHP outage and the breach of an OpenAI agent into publicly available Australian government data, with the Australian Cyber Security Centre recording 82,000 attacks in the past financial year.
The average self-reported cost of cybercrime for small businesses was $55,000 and $141,300 for medium businesses, up 45 per cent from last year, figures from the Australian Signals Directorate annual cyber threat report revealed.
Part of the inquiry's focus is on cyber insurance, which gives businesses coverage for liability relating to cyber threats, breaches and attacks.
Cyber threats to small businesses were expected to continue growing, the Insurance Council of Australia's regulatory and consumer policy general manager Alexandra Hordern said.
"Australia is closer to the start than to the finish of our digitisation journey," she told the inquiry on Monday.
"Small businesses don't have the resources of larger organisations, so when they are attacked, responding and recovering is harder and costs them relatively more."
Sasha Koff, the Cyber Readiness Institute's managing director, said hands-on cyber coaching could help businesses understand risks, and how to use available technology to proactively protect themselves.
"Similar to you or I going to a gym and maybe not knowing how to use all of the proper equipment ... the opportunity for these organisations to have a coach really helps them," she said.
Ms Koff said about 80 per cent of cyber incidents stemmed from human errors rather than sophisticated attacks.
"Even in the day and age where we are now with very sophisticated AI attacks, we still see it significantly come back to human behavioural failures," she said.
AI had seen the rise of increasingly personalised attacks, Ms Koff said, along with a rise in the speed and extent of the attacks.
QBE Insurance's global head of cyber Serene Davis said cyber disruptions were becoming increasingly complex and often went unreported.
"For a small business with limited capacity to absorb disruption, the impact can be quite severe," she said.
"Many don't have dedicated cybersecurity teams or ready access to specialist expertise, and they're managing cyber risk along alongside all the other demands of running a business."
Ms Davis said QBE market research estimated about 20 per cent of small or medium-sized Australian businesses had cyber insurance, compared with 70 to 75 per cent of large organisations.
14°C