“Cyber attacks aren’t slowing down – particularly with AI tools, they’re becoming more automated and opportunistic, and small businesses are increasingly being targeted as ‘low hanging fruit’,” said cyber security expert Karissa Breen.

“While many businesses have basic protections in place, overall security practices aren’t strong enough, leaving gaps attackers can easily exploit.”

Of these small businesses, sole traders were found to be the most at-risk group, with the large majority (79 per cent) reporting having no cyber security response ready, and 38 per cent taking no further action if an incident has previously occurred.

Among businesses that have experienced an attack, nearly a third say the biggest cost is the time and resources required to recover, while 21 percent report productivity losses caused by system outages and 18 percent suffer direct financial damage.

Phishing and email scams account unsurprisingly account for the most incidents at 38 per cent, followed by malware and virus infections, and then hackers impersonating trusted contacts.

“Common vulnerabilities that attackers typically seek out and exploit include reused passwords, browser autofill, and minor password variations,” Breen added.

“Small businesses should adopt strong password hygiene, enforce multi-factor authentication, and invest time in cyber awareness training to reduce these risks.”

Optus commissioned this research alongside the launch of their new program seeking to support small businesses in navigating the cybersecurity space.

The FutureFit program will provide free workshops for small businesses to learn and develop their cyber security skills.

“At Optus, we’re helping by providing personalised, practical plans that cut through the complexity and fit each business’s needs,” said Executive General Manager of Small Businesses at Optus, Emma Jensen.

“Cyber resilience doesn’t have to be hard - it just needs to be intentional.”