Small Business Cyber Security Statistics (Australia, 2024–25)
Sourced compilation — every figure linked to its primary source
What does a cyber attack actually cost an Australian small business, and how common are they? This page compiles the current official figures from the Australian Signals Directorate's Annual Cyber Threat Report 2024–25 — the primary national dataset. Figures are quoted as published; nothing here is estimated.
The headline numbers
In 2024–25, ASD received over 84,700 cybercrime reports — an average of one report every 6 minutes.
What an incident costs
The average self-reported cost of cybercrime for a small business rose 14% to $56,600 per report. Across businesses of all sizes, the average self-reported cost per report was $80,850 — up 50% year on year. For a business running on typical SME margins, a mid-five-figure unplanned loss is the difference between a profitable year and a loss-making one.
Why small businesses specifically
Small businesses are targeted precisely because they hold the same valuable things as large ones — money, customer data, supplier payment details — with a fraction of the defences. The Australian Cyber Security Centre's baseline recommendation for closing that gap is the Essential Eight: eight controls (including multi-factor authentication, patching and tested backups) that stop the majority of commodity attacks.
The five-minute check
Run the free Cyber Health Check to see where your business stands against the baseline controls — no email required to see your headline result.
Sources: Australian Signals Directorate, Annual Cyber Threat Report 2024–25; Minister for Defence, report release statement (14 October 2025). Current as at 24 July 2026; re-verified when ASD publishes the 2025–26 report (expected late 2026).
Close the gap before you become a statistic
Valont's Operations Hub implements and monitors the Essential Eight for Australian SMEs.
Book a Discovery Conversation