On 26 October the Australian Signals Directorate published its Annual Cyber Threat Report 2025-26, its yearly look at the threats facing Australian businesses and households. Its advice is refreshingly practical: basic cyber security practices, such as enabling multi-factor authentication or passkeys, are described as essential to reducing the likelihood of becoming a victim of cybercrime.
That advice matters most for a growing business. More people, more logins, more suppliers and more money moving around, often still running on the habits from when the business was ten people around one table. Growth is exactly when good habits pay off fastest. Here are five.
1. Turn on multi-factor sign-in everywhere that matters
ASD's advice starts here, and for good reason. A stolen password on its own should never be enough to get into your email, your accounting system or your bank. Start with email and finance, then work outward. Where your systems support passkeys, they are even easier for staff than a code on a phone.
2. Let updates happen, and know who is checking
Keeping software up to date sounds dull, and that is exactly why it slips. Set computers, phones and your Microsoft 365 environment to update automatically, then make it someone's job to confirm that they actually did. One quiet laptop that has not restarted in three months is all an attacker needs.
3. Prove your backup with a restore
Most businesses have a backup. Far fewer have tried getting something back from it. Pick one important folder this month and restore it somewhere safe. If that goes smoothly, you have real peace of mind. If it does not, you have found the problem on a quiet Tuesday instead of during a crisis. We wrote more about this in One Copy Is Not a Backup.
4. Ten minutes of training beats a fifty-page policy
Scam emails and messages have become far more convincing, so the old advice to look for spelling mistakes no longer holds. A short, regular conversation works better than an annual slideshow. Teach one habit above all: if a message asks you to pay something, change bank details or sign in urgently, pause and check with a phone call to a number you already know.
5. Give every new starter a front door and every leaver a locked one
Growth means hiring, and hiring means accounts. Write a one-page checklist for joining (which systems, which access, multi-factor set up on day one) and a matching one for leaving (access removed the same day, shared passwords changed). It is a small piece of admin that closes one of the most common gaps we see in growing teams.
None of these steps need a big budget. They need someone to own them, and a growing business usually has nobody whose job that is yet.
Make it easy to speak up
One last habit costs nothing at all. Make sure your team knows that reporting a suspicious email, or admitting they clicked something they should not have, is always the right call and never gets anyone in trouble. A quick report in the first ten minutes is worth far more than a perfect record.
If you would like a second pair of eyes on any of this, that is what we do every day. Our security assessment checks these basics across your business and gives you a short, plain-English list of what is already in good shape and what to tackle first. Or simply give us a call on +61 3 4803 4915 and talk it through with one of our senior engineers.
