Small Business Cybersecurity

Practical Cybersecurity for Australian Small Businesses

Q: What should I do if my business has been hacked?

Disconnect affected devices, do not pay a ransom without professional advice, and contact GCIT on 1300 369 111 or the Australian Cyber Security Centre. Under the Cyber Security Act 2024, ransomware payments must be reported within 72 hours.

Q: Do I need cyber insurance?

We strongly recommend it. Your premiums depend on your cybersecurity posture. Businesses with strong controls get better premiums and more coverage.

Q: What is the minimum cybersecurity a small business needs?

At minimum: MFA on every account, managed endpoint protection, email security, regular tested backups, and security awareness training. From there, add layers based on your risk profile.

Q: Can GCIT help businesses outside the Gold Coast?

Yes. We support businesses across the Gold Coast, Brisbane, Tweed Heads, and Northern NSW. Most security monitoring is remote.

You don’t need an enterprise budget to protect your business properly. You need a partner that understands what’s actually required, what’s overkill, and what your obligations are under Australian law.

Get a Free Assessment
Call 1300 369 111

Certified. Accredited. Audited.

TAFEcyber Essential Eight Assessor certification

The Reality

Small businesses are the biggest target in Australia

The Australian Signals Directorate received over 94,000 cybercrime reports in the 2023-24 financial year. Small businesses are disproportionately targeted because attackers know they often lack dedicated security resources.

Figures sourced from the ASD Annual Cyber Threat Report 2024-25

94,000+

cybercrime reports received by the ASD in 2023-24, one every six minutes

$49,600

average cost of cybercrime per report for small businesses, up from $46,000 the previous year

$50M

maximum penalty under the Cyber Security Act 2024 for failure to report a ransomware payment within 72 hours

What Australian businesses
are legally required to do

Your obligations have changed

Beyond industry-specific regulation, every Australian business shares a common set of cybersecurity obligations under federal law. Your directors, your insurers, and your customers all depend on how seriously you take them.

Cyber Security Act 2024 · Privacy Act 1988

Mandatory Data Breach Notification.

Businesses with $3M+ turnover must notify the OAIC and affected individuals within 30 days of an eligible data breach.

Australia’s first dedicated cyber security legislation
A Cyber Incident Review Board with powers to investigate
Ransomware payment reporting required within 72 hours

Penalties up to $50M or 30% of adjusted turnover

Corporations Act 2001, s180

Directors’ personal liability and the duty to ensure adequate cybersecurity measures are in place.

Failing to address known risks can mean personal liability for losses and penalties. The Optus and Medibank breaches changed how regulators enforce this, and insurance companies now increase premiums for non-compliant businesses.

Assess your compliance →

What You Actually Need

Cybersecurity doesn’t have to be complicated

We talk to small business owners every week who think cybersecurity means spending tens of thousands on enterprise tools they don’t understand. It doesn’t. Here’s what one of our account managers, Harry Morris, told a prospect recently:

“We align to a framework called the Essential Eight, from the Australian government. We’ll give you a live, interactive view of what cybersecurity you’ve got. And when you go to do your cyber insurance questionnaire, what we’d like to see is that your premiums drop and your coverage increases. That’s where the savings come from having a mature cybersecurity posture.”

Harry Morris, Head of Sales and Account Management, GCIT

Multi-factor authentication+

The single most effective control. We enforce MFA across every account, every app, every time. This alone stops the majority of credential-based attacks. If your current provider hasn’t enforced MFA on every user, that’s the first thing we fix.

Endpoint protection and monitoring+

Microsoft Defender for Endpoint deployed and managed across every device. But we don’t stop at antivirus. We layer Huntress for behavioural detection and ThreatLocker for application control. When a recent client had a user download a malicious script, five separate layers caught it before any damage was done.

Email security+

Advanced threat protection for inbound and outbound email. Phishing, business email compromise, and impersonation attacks are caught before they reach your inbox. We use Avanan for advanced email security alongside Microsoft’s built-in protections.

Backup and disaster recovery+

Automatic, tested backups of your critical data. If the worst happens, whether it’s ransomware, hardware failure, or human error, your data is recoverable. We test restores regularly, not just set and forget. Learn about our backup approach.

Security awareness training+

Your team is your first line of defence. We run regular phishing simulations and training. But here’s the thing one of our sales conversations revealed: many small businesses think they have security awareness training when all they get is “constant reminders to complete a course.” That’s set-and-forget. Real training is active, simulated, and measured.

Patch management+

Keeping software up to date closes the vulnerabilities attackers exploit. We automate operating system and application patching across all managed devices through Microsoft Intune, with testing and staged rollouts to avoid disruption.

The Security Stack

The tools behind the protection

Every GCIT managed service plan includes these tools, deployed, configured, and monitored by our team. You don’t need to buy or manage any of them separately.

Microsoft Defender for Endpoint

Antivirus, threat detection, and automated investigation across every device

Huntress EDR

Behavioural threat detection and managed response by human analysts

ThreatLocker

Application control and ringfencing that blocks unauthorised software

Cisco Umbrella

DNS-layer security that blocks malicious sites before a connection is made

Microsoft Entra ID

Identity and access management with conditional access and MFA enforcement

Avanan (Check Point)

Advanced email security that catches phishing and BEC attacks inline

Essential Eight

Australia’s cybersecurity framework, explained in plain English

The Essential Eight is a set of eight cybersecurity strategies from the Australian Signals Directorate. It’s not a certificate you hang on the wall. It’s a practical framework that tells you: are you doing the basics, and how well?

There are four maturity levels (0 through 3). Most small businesses should be aiming for Maturity Level One as a starting point. If you tender for government work or handle sensitive data, higher levels may be required.

GCIT has accredited Essential Eight assessors through TAFEcyber. We recently helped a client prepare an Essential Eight Maturity Level One compliance report for a tender. Unlike ISO 27001, Essential Eight doesn’t have a formal certificate issued by the ASD. Compliance is demonstrated through a detailed report outlining the controls and how your business addresses them.

The Eight Strategies

Application control

Patch applications

Configure Microsoft Office macro settings

User application hardening

Restrict administrative privileges

Patch operating systems

Multi-factor authentication

Regular backups

Learn about Essential Eight compliance →

Not sure where to start?

Many small business owners worry that reaching out to a cybersecurity provider means being overwhelmed, scared, or sold something they don’t need.

That’s not how we work.

We start with a conversation, not a sales pitch. A free assessment gives you a clear picture of where you stand, what’s working, and what practical steps make the most difference for your business and budget.

Get a Free Assessment

Already have an IT provider but worried about security?

We hear this a lot. One recent prospect told us their current provider’s idea of cybersecurity was “constant reminders to complete a cyber awareness course.” That’s set-and-forget. It’s not cybersecurity.

If you’re not getting proactive reporting on your security posture, regular phishing simulations, or managed endpoint protection, you may be more exposed than you think. We can give you a second opinion.

Book a Security Assessment

Common Questions

Frequently asked questions

How much does cybersecurity cost for a small business?+

Cybersecurity is included in every GCIT managed service plan. Our plans start around $1,500 per month for small teams and scale based on the number of users, devices, and the level of compliance you need. To put it in context, the average cost of a single cybercrime incident for a small business is now $49,600 according to the ASD, and rising every year. Contact us for a tailored quote.

What is the Essential Eight and does my business need it?+

The Essential Eight is a cybersecurity framework from the Australian Signals Directorate. It’s not legally mandated for all businesses, but it’s the benchmark that insurers, auditors, and government procurement teams use to assess your security posture. If you want lower cyber insurance premiums or tender for government contracts, you’ll likely need it. GCIT has accredited Essential Eight assessors through TAFEcyber.

What should I do if my business has been hacked?+

Disconnect affected devices from the network immediately, do not pay a ransom without professional advice. Contact GCIT on 1300 369 111 or the Australian Cyber Security Centre. Under the Cyber Security Act 2024, if you make a ransomware payment, you must report it to the ASD within 72 hours. We provide incident response as part of every managed service plan.

Do I need cyber insurance?+

We strongly recommend it. Cyber insurance covers the costs of incident response, legal fees, notification obligations, and business interruption. But here’s the key: your premiums and coverage depend on your cybersecurity posture. Businesses with strong controls (MFA, endpoint protection, regular patching) get better premiums and more coverage. We work with Pax8 to help clients optimise their cyber insurance.

What is the minimum cybersecurity a small business needs?+

At a minimum: multi-factor authentication on every account, managed endpoint protection on every device, email security with phishing protection, regular tested backups, and security awareness training for your team. That covers the most common attack vectors. From there, you add layers based on your risk profile, industry, and compliance requirements.

Can GCIT help businesses outside the Gold Coast?+

Yes. While our office is in Burleigh Heads, we support businesses across the Gold Coast, Brisbane, Tweed Heads, and Northern NSW. Most security monitoring and management is done remotely, so location doesn’t limit the quality of protection you receive.

Reviewed by Elliot Munro, CISO at GCIT

Protect your business without the complexity

A free assessment takes less than an hour and gives you a clear picture of where your business stands. No scare tactics, no jargon, just practical guidance from a team that’s been doing this for over 10 years.

Get Your Free Assessment

1300 369 111