Stage 1 · The breaking point
The Real Cost of a Cyber Incident to a Perth Small Business in 2026
What the national average actually includes, where your own exposure probably sits, and the handful of things that reliably keep a small business below it.
The figure comes from the Australian Signals Directorate’s Annual Cyber Threat Report, which is built from incidents actually reported to ReportCyber. It’s worth being precise about what that means, because the number gets quoted a lot and explained almost never.
We’re not going to use these numbers to frighten you into a phone call. An average is a blunt instrument, and yours might be nothing like it. What the figure is genuinely useful for is showing where the money goes, because most business owners picture a ransom payment and that’s usually the smallest part of it.
What actually makes up the number
An incident cost is rarely one invoice. It’s four or five, spread over a couple of months.
Downtime
Staff being paid to not work. For a 20 person business, two days of everyone standing around is real money before anyone has touched a keyboard.
Recovery work
Someone rebuilding machines, restoring data, resetting accounts. Usually billed hourly, usually urgent, usually not in anyone’s budget.
Lost business
Orders that didn’t get quoted, jobs that went elsewhere, the customer who called during the outage and never called back.
Notification and legal
If personal information was exposed, working out what you have to tell people, and telling them. This is where legal fees appear.
The ransom, sometimes
Less common than the headlines suggest, and paying it does not reliably get the data back. It’s a line item, not the story.
The premium after
Cyber insurance renewals following a claim get more expensive, and come with more conditions. That cost lands next year.
Why the small business number is the one to watch
Look at the growth rates rather than the totals. Large business costs rose 219% and medium rose 55%, while small business rose 14%. That sounds like good news for smaller businesses, and partly it is.
But there is a second reading. Larger organisations report more, investigate more thoroughly, and know what an incident cost them. A lot of small business incidents never get reported at all, which means the real small business average is probably higher than the figure we have. The 14% is what showed up, not what happened.
The other thing worth saying plainly: $56,600 is close to catastrophic for a business turning over a couple of million, and survivable for one turning over twenty. The number matters less than what proportion of your working capital it represents.
What keeps a business off the average
Here is the genuinely useful part. The controls that prevent most of these incidents are not exotic, expensive or new. They are the same handful of unglamorous things every time.
| Control | What it stops | Effort |
|---|---|---|
| Multi-factor authentication on email | The large majority of account takeovers, which is the most common way in | An afternoon |
| Tested backups | Turns ransomware from an existential event into an annoying week | Set up once, verified monthly |
| Patching that actually happens | Attacks using vulnerabilities that were fixed months ago | Ongoing, best automated |
| Removing old accounts | Former staff logins, shared passwords, the account nobody can name | An hour a quarter |
| Someone watching, 24/7 | The gap between a breach starting and anyone noticing | Needs a service |
The first four can be done by any competent person with access and a free afternoon. The fifth is the one small businesses genuinely can’t do alone, because it means somebody awake at 2am on a Sunday when the unusual login happens.
Where Essentials sits
Being direct, since that’s the point of this blog: Keep You Secure is one of the five Essentials pillars, and it includes multi-layered security with 24/7 monitoring through Huntress, a security operations centre that watches for threats around the clock. It’s part of the flat rate, at $95 per user / month, excludes GST, rather than a separate line item.
Being equally direct about what that isn’t: no service prevents every incident, and anyone telling you otherwise is selling something. What monitoring changes is how long a problem runs before somebody sees it, and that is most of the difference between the recovery costs above and a quiet Tuesday.
We’re also clear about what sits outside the plan. Hardware, Microsoft 365 licensing, project work and after-hours call-outs are billed separately. That’s in the brochure, not the fine print.
What to do with this number
Don’t budget for $56,600. Do the arithmetic that’s actually relevant to you: what two days of full downtime costs your business in wages alone, and whether you could absorb that plus a recovery bill without borrowing.
Then check the five controls in the table. If four of them are already true at your business, you’re in reasonable shape and the fifth is a conversation. If none of them are, that’s the honest starting point, and it is a much more useful thing to know than a national average.
Zetta Essentials
See what’s covered
Multi-layered security with 24/7 Huntress SOC monitoring, included. $95 per user / month, excludes GST.
Acknowledgement of Country
Zetta acknowledges the Whadjuk people of the Noongar nation, the Traditional Custodians of the land on which we live and work, and pays respect to Elders past and present.
