Cyber security for trade businesses

Most trade businesses know they have some cyber risk and have no idea where to start. This page is the short version of what we would tell you if you rang and asked: why you get targeted, the small number of things that actually stop it, and what is not worth your money.

There is nothing to buy on this page. If a builder or an insurer has sent you a form, we can answer it with you for $319. If they want a checked, scored document, that is the Cyber Posture Review.

Why a one-van operation gets targeted

The assumption that attackers only go after big companies is wrong, and it is wrong in a specific way. Nobody is picking your business out of a list. Attacks are automated and indiscriminate, and small businesses get hit precisely because they are assumed to be unprepared. You are not a target because you are valuable. You are a target because you are easy.

What that looks like in practice for a trade business is rarely dramatic. It is an email account compromise that ends in a redirected invoice, the single most common way a trade business loses money to cybercrime. Someone gets into a mailbox, watches quietly for a fortnight, then changes the bank details on an invoice before it reaches your customer. You have done the work and you are not getting paid.

We have written that one up in full, with what we watched land on our own clients, on the Business Email page. It starts in the mailbox, which is why that page rather than this one carries the story.

The other common one is ransomware on the machine that holds the quotes, the job history and the photos. For a one-person operation that means no job cards, no invoicing and no access to anything, often for days, at which point the business has effectively stopped.

The controls that stop most of it

Cyber advice for small business is usually either a marketing scare campaign or a hundred-page framework written for a bank. The useful middle ground is short, and it is genuinely short. Three things.

Multi-factor login on email and accounting. This one control stops the large majority of account compromise attacks. It is free on Google Workspace, Microsoft 365 and Xero, it takes about ten minutes per account, and most small businesses still have not turned it on. If you do nothing else on this page, do this.

A backup somebody has actually restored from. A backup you have never restored from is a theory, and it is the thing that turns a ransomware event from a business-ending week into an annoying afternoon. Your mailbox is backed up nightly on both of our email options, and that is included, not an extra. The computer in the office is the gap, and rather than sell you something for it we have written down exactly what to use and what it costs.

Updates. Phones, laptops, and the router. Automatic updates on, and a decision about the device still running an operating system that stopped getting security fixes two years ago.

Those three cover most of what actually happens to businesses your size. Everything past them is a matter of degree, and for a lot of trade businesses the honest answer is that the degree is not worth paying for.

The frameworks, and which one fits you

The Essential Eight is the Australian Signals Directorate’s framework, and it is the one your insurer’s form or a builder’s questionnaire will name. It is free, it is public, and above $3 million a year in turnover it is the one insurers actually verify rather than take your word for.

It is also written for organisations running a fleet of managed Windows computers. Applied to a business with two iPhones, a MacBook, Xero and ServiceM8, part of it does not land. More importantly, it assumes you have already sorted the basics. Firewalls, antivirus, the passwords things came with, where your files actually live: the Essential Eight takes those as given and concentrates on the hardening beyond them.

So when we assess a business we score against the Essential Eight, because that is what gets asked and verified, and we check a longer list than the Essential Eight covers, because that is where the problems actually are. Nineteen things in total. More on the Cyber Posture Review page.

Does any of this apply to you? Turnover decides

$3 million a year is the line.

Under it, you are exempt from the Privacy Act unless you provide a health service, trade in personal information or hold a Commonwealth contract, and exempt from mandatory breach notification. The rules on tax file numbers apply to any employer, whatever the turnover. Insurers use short forms and generally take your word. The three controls above are still worth doing, because they are what stops you losing money, but nobody is going to audit you.

Over it, the Privacy Act applies in full, the Cyber Security (Ransomware Payment Reporting) Rules 2025 give you 72 hours to report a ransomware payment to the Australian Signals Directorate, and insurers verify the Essential Eight rather than trusting the form. That is a different situation and it is worth getting ahead of.

What changes when you get this right

The attacks that would have worked stop working. Someone with your password still cannot get into your email. Your invoices cannot be quietly altered on the way to a customer. And if something does go wrong, you have a backup you know works, rather than one you hope does.

That is the whole return. It is not exciting, and it is why cyber security for a business your size should be a short conversation and a small bill, not a monthly subscription.

What we do not do, and this one matters

We do not sell security monitoring. No dashboard, no “we keep an eye on things”, no service that promises somebody is watching your systems for intruders. (We do tell you when your email stops working. That is an automatic alert on the mail service, not someone watching for attackers.)

We could sell you one. We are not going to, because a promise to watch is a promise to be awake, and we are one business, not a night shift. A monitoring service you cannot rely on at three in the morning is worse than no monitoring service, because you stopped worrying about it.

There is also less to watch than the industry implies. A one-person business with multi-factor switched on does not generate a stream of security alerts. What actually goes wrong over time is quieter than that: multi-factor turned off because the phone kept nagging, the bookkeeper who left in March and still has a login, the backup that stopped in May and nobody noticed. None of that is caught by watching. It is caught by checking, on a date.

For most trades that is a once-a-year check, booked around the insurance renewal or the builder’s pre-qualification. After a Cyber Posture Review, the yearly re-check is $429, or $649 for the larger setup. If your circumstances call for more, we will tell you what kind of monitoring fits your risk and point you at someone who does it properly. There is nothing in it for us either way.

We also do not sell certification. There are paid cyber certification schemes aimed at small business; we take no commission on any of them and we are not a partner. Their entry tiers are self-attested: a director signs, and nobody independently checks. We have not found an Australian insurer publishing any of them as a premium discount. What insurers actually check above $3 million is the Essential Eight. We will tell you honestly where you stand against it.

Common questions

Is this not overkill for a business my size? The three controls above are not overkill for anyone. Everything past them might be, which is the point of assessing before spending, so you can put money on the things that matter and confidently skip the rest.

What does the law actually require of me? It depends on your turnover and what data you hold. Many small businesses sit below the threshold where the Privacy Act applies in full, but obligations can attach through contracts with larger customers regardless. We will tell you which position you are in rather than implying you are in breach.

I have antivirus. Is that enough? It helps and it is not sufficient on its own. Most successful attacks on small businesses go through email and stolen passwords rather than through a virus on a machine, which is why multi-factor login does more for you than any security product you can buy.

What if we get hit before any of this is in place? Ring us. There is a defined set of first steps and the first hour matters more than the rest of the week. To be clear about what that is: it is a phone call to a person who knows your setup, billed as support time. It is not an incident response retainer and we are not pretending to be one.

Where do I start if I want to do it myself? The government’s free Cyber Health Check is a reasonable first look. Cyber Wardens is a free, government-backed training program for small business and is worth the hour. Neither is evidence of anything to a third party, but if nobody is asking you for evidence, they may be all you need.

Cyber Questionnaire Answer: a builder or an insurer has sent you a form. One call, answered honestly, $319
Cyber Posture Review: the checked, scored document, for when a head contractor or an insurer wants evidence. From $869
Business Email: multi-factor, individual logins and nightly mailbox backup, and where the invoice redirection story is told in full
Backing up my business: what to use and what it costs. We do not sell it
Setup & Support: hours, when you would rather we just did it

Next step

If you want to know where you actually stand rather than being sold a package, book a 20-minute technology conversation. If somebody has handed you a form, start with answering it. If they want a checked document, go to the Cyber Posture Review.