"We're too small to be a target" is the single most common — and most costly — assumption we hear from small business owners. In reality, small businesses are attractive targets precisely because attackers assume less protection is in place, and a single successful scam email or compromised password can be enough to cause real damage.
A cybersecurity health check isn't a penetration test built for a bank, and it isn't a scare tactic dressed up as a sales pitch. It's a practical, plain-English look at where your business is actually exposed — and a prioritised list of what to fix first.
What a health check typically covers
- Email security. Is your domain protected against spoofing (SPF/DKIM/DMARC)? Could someone send an invoice "from you" that isn't actually from you?
- Password and access hygiene. Are staff reusing passwords, and is multi-factor authentication turned on for email, banking and any admin logins?
- Website exposure. Is your site and any customer-facing form handling data securely, and is software (CMS, plugins) kept up to date?
- Backups. If a laptop was lost, stolen, or hit with ransomware tomorrow, is there a working, tested backup — or would that be the end of your records?
- Staff awareness. Would your team recognise a convincing phishing email, and do they know what to do if they clicked the wrong thing?
Most small business breaches don't start with a sophisticated hack — they start with a convincing email and a tired employee. The highest-leverage fixes are usually the cheapest ones: MFA, backups and basic staff awareness.
What it doesn't cover
To be upfront: a small business health check is not a full penetration test, not an ISO 27001 audit, and not a guarantee against every possible attack. If you're handling large volumes of financial or health data, or operate in a regulated industry, you may need a more formal audit on top of this. A health check is the sensible first step for most small businesses — not the ceiling.
Want a plain-English read on where you actually stand?
Ask About a Health CheckWhy the Privacy Act makes this more relevant now
Under the Australian Privacy Act, businesses that handle personal information have obligations around how that data is protected and what happens if it's exposed. You don't need to run a large operation to hold personal data that matters — customer names, emails, phone numbers and payment details all count. A basic health check is a reasonable, low-cost way to show you've taken that seriously, rather than finding out the hard way after an incident.
Where to start if you do nothing else this month
- Turn on multi-factor authentication on email and any admin/banking logins
- Confirm your backups actually work by restoring a file from one
- Check your domain's SPF/DKIM/DMARC records are set up correctly
- Have a five-minute conversation with staff about spotting phishing emails
None of the above requires a big budget. It requires about an hour, and it closes off the most common way small businesses actually get hit.