Cyber awareness is your team’s ability to recognise risky behaviour online and act sensibly to avoid it. The US NIST glossary puts it as the ability of a user to recognise and avoid behaviours that could compromise cyber security. In a business, that means a bookkeeper who rings the supplier before changing bank details, and a receptionist who reports a odd email instead of deleting it and hoping.
People also search for “cyber security awareness”. Same thing. Awareness is the human side of security, and honestly, it is the side most small businesses skip.
TL;DR
- Cyber awareness is staff knowing what scams, phishing and dodgy requests look like, and knowing exactly what to do next.
- A one-off induction slideshow does not count. The Australian Government’s security manual expects training to be ongoing.
- Fake invoices and bank detail changes (business email compromise) are the scam we see hurt SMBs most.
- Awareness works best alongside MFA, tested backups and a response plan someone has actually practised.
- You do not need pricey software. The ACSC offers free tools, and a 30-minute drill beats a glossy course nobody remembers.
Table of Contents
- What cyber awareness actually covers
- Why it matters for a business your size
- What most businesses get wrong
- Where the data and reality do not match
- What we see in practice
- How to build cyber awareness without a big budget
- Perspective: why we think awareness gets oversold and undersold
- Awareness is also a privacy matter
- How we can help
- FAQ
- Sources
What cyber awareness actually covers
Think of it as three things: knowing the threats, knowing the habits that block them, and knowing what to do when something looks wrong.
The threats. Phishing emails and texts, fake invoices, ransomware, and business email compromise (BEC), where a criminal poses as a supplier, boss or customer to redirect money. In the ASD’s Annual Cyber Threat Report 2024-2025, 19% of self-reported business cybercrime was email compromise with no financial loss, and another 15% was BEC fraud that did cost money.
The habits. Using multi-factor authentication (MFA), not reusing passwords, installing updates, and checking payment requests through a channel you already trust, not the details in the email.
The response. Who to call, what to unplug, who tells the boss. This is the part people forget, and it is the part that decides whether an incident is a bad afternoon or a bad month.
Why it matters for a business your size
Attackers go after people because people are easier than firewalls. The ASD says cybercriminals exploit the human factor because it is often the most vulnerable way in.
The cost is not abstract either. The same report puts the average self-reported cost of cybercrime at $56,571 for small businesses in FY2024-25 (up 14%) and $97,166 for medium businesses (up 55%). For a 20-person firm, that is a serious hit to a year’s profit.
There is also a legal angle. The OAIC advises that improving staff awareness of cyber security issues and threats is part of preventing data breaches, and that privacy and security should sit in the business culture, not be treated as a side job for IT. If you hold client personal information (accountants, medical practices, law firms, recruiters), a staff mistake can become a notifiable breach.
What most businesses get wrong
We work with Brisbane businesses of roughly 10 to 50 staff, and the same mistakes keep turning up.
They treat it as an induction task
New starter gets a 40-minute video in week one. Tick. Then nobody mentions security again until someone loses money. We see this a lot.
The ASD’s cyber security principles list ongoing cyber security awareness training as a core expectation, and the ACSC small business guide calls employees with good practices your first line of defence. First line of defence does not mean once-a-career.
They think having IT support covers it
Someone looks after the computers, so the owner assumes the people side is handled. It is not. Your IT provider can lock down the network, but it cannot stop an accounts officer paying a fake invoice that arrived from a hijacked supplier mailbox.
The ACSC’s alert on BEC scams describes the pattern: fraudulent emails posing as a legitimate business and asking for bank account details to be changed for future invoice payments. The trade names change. The trick does not.
They skip the boring controls and buy the shiny stuff
We walk into businesses with no MFA on Microsoft 365, backups nobody has ever restored, and a firewall nobody has looked at in years. Meanwhile they have paid for a phishing simulation tool. Honestly, that is backwards. Awareness cannot rescue a setup where one stolen password opens everything.
They assume everyone is covered
The OAIC notes that training should include new starters, contractors and temporary staff. The casual who covers reception for a fortnight, or the contractor with a shared mailbox login, is often the one nobody trained.
Where the data and reality do not match
Surveys say most owners know cyber security matters. In practice, we find the gap is between thinking you are prepared and being prepared.
Here are the ones we hit most often:
- “We are backed up.” Then we ask when anyone last restored a file from that backup. Silence. Sometimes the backup has been failing for months and the alert email went to someone who left.
- “Staff know not to click links.” Then we run a quick check and find half the team would happily enter their Microsoft password on a convincing login page. Telling people not to click is not training. Showing them what a fake login looks like is.
- “We have an incident plan.” It is a document in a folder. Nobody knows where the folder is. When the internet drops and a ransom note appears on a screen, staff do not know whom to ring or whether to switch the machine off.
- “Our team would report it.” Only if reporting is easy and nobody gets embarrassed. We have seen staff sit on a mistake for a day because they were scared of being in trouble. That day is when the damage happens.
The last point is cultural, and it is the one owners can fix fastest. Thank people who report a suspicious email, even when it turns out to be harmless.
What we see in practice
A scenario we see in various forms: an accounts person gets an email that looks like it came from a regular supplier. New bank details, urgent, please update before Friday’s run. The email thread even looks genuine, because the criminal is sitting inside the supplier’s compromised mailbox. The payment goes out. The real supplier chases two weeks later.
Another one: a staff member gets an email saying their subscription has renewed and to call a number if they did not authorise it. They call. The “support” person asks them to install a remote access tool to fix it. Now a stranger is on their PC.
In both cases there was no clever hacking. Nobody broke a firewall. Someone was rushed, trusted the wrong thing, and had no habit of stopping to verify.
The fix is boring and it works: any change to bank details gets a phone call to a number you already hold, never the one in the email. Write it into your payment process. Make it a rule nobody can override, including the boss.
How to build cyber awareness without a big budget
You do not need enterprise training software. Here is what we would do for a 25-person business.
- Turn on MFA everywhere first. Microsoft 365, banking, accounting software, remote access. The Australian Government says basics like MFA, strong passwords and updates matter most, and it takes far less effort than training everyone to be perfect. If you want a plain-English take, see our post on the one MFA fix we push.
- Write down three or four rules, not forty. Verify payment changes by phone. Report anything odd to one named person. Never approve an MFA prompt you did not trigger. Lock your screen.
- Run short sessions, often. Fifteen minutes at a team meeting each month, using a real email someone received, beats an annual two-hour course. Our four awareness tips for SMEs go through what has worked for clients.
- Make it role-based. Accounts need BEC training. Reception needs phone and visitor scams. Managers need to know how executive impersonation works. The ASD pushes tailored, role-relevant education over generic content.
- Include everyone. Casuals, contractors, new starters and the owner. Especially the owner, who is the most impersonated person in the building.
- Practise the response. This is where most plans fall over.
Run a drill with Exercise in a Box
The ASD’s Exercise in a Box is free, and you can run it in your own time as many times as you like. Pick a ransomware scenario, get the team in a room, and see what happens.
You will learn quickly whether people know who to call, whether anyone has the IT provider’s after-hours number, and who is allowed to make decisions. We have watched teams discover in 20 minutes that nobody could find the admin password for the backup system. Far better to find that out in a meeting room than in the middle of an attack.
Perspective: why we think awareness gets oversold and undersold
We have strong views on this, so here they are.
Awareness gets oversold when vendors promise that a training platform will “fix” human risk. It will not. People get tired, distracted and rushed. Someone will click eventually, so your setup has to survive that click. That means MFA, sensible permissions, email filtering, endpoint protection and backups you have actually restored.
It gets undersold when owners dismiss it as a soft, fluffy extra. A well-trained accounts officer who picks up the phone and checks a bank detail change is worth more than most security products we could sell you. No tool replaces that habit.
Our honest order of priority for a business of 10 to 50 people: first MFA and backups, then a response plan you have tested, then regular short awareness sessions, then simulations if you want to measure progress. Most businesses do it in reverse, or do none of it.
One more thing. Do not make people feel stupid. The scams are good. Some of the best-crafted fake invoices we have seen would fool us on a busy Friday afternoon. A culture where people report quickly beats a culture where people hide mistakes.
— Matt
Awareness is also a privacy matter
If your business handles personal information, awareness is part of looking after it. The OAIC’s guide to securing personal information expects you to know what personal information you hold and where it is kept. Staff cannot protect data they do not know exists.
The reputational side matters too. A scam that goes through your name hurts customer trust long after the money is sorted, and managing your online reputation becomes part of the clean-up. Better to avoid the incident in the first place.
How we can help
If you would like someone to look at this with you, we manage Microsoft 365, security, backups and networking for Brisbane businesses. We can check the unglamorous basics, like MFA coverage and whether your backups restore, and help set up staff awareness that fits how your team really works. Have a look at our cyber security services or get in touch for a chat about where your business stands. For a checklist to work through yourself first, our cyber hygiene checklist for SMEs is a good start.
FAQ
What is cyber awareness in simple terms?
It is knowing how online threats work and adjusting your everyday behaviour to avoid them. For a business, it means staff can spot phishing, fake invoices and suspicious requests, and know who to tell. It is a habit, not a certificate.
What is the difference between cyber awareness and cyber security?
Cyber security is the whole job of protecting systems and data: technology, processes and people. Awareness is the people part. You need both, because good technology still gets bypassed by a convincing email, and good staff still need technical controls behind them.
How often should staff have cyber awareness training?
Ongoing, not once. The ASD’s security principles list ongoing awareness training as a core expectation. In practice we suggest short monthly or quarterly sessions plus a proper induction for every new starter, contractor and casual.
Do small businesses really need it?
Yes. The ASD’s figures show average self-reported costs of $56,571 for small businesses and $97,166 for medium businesses in FY2024-25. Small teams often have fewer checks in place, so one person’s mistake goes further.
Where do I report a cyber incident in Australia?
Report it through ReportCyber, or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371), as the ASD’s annual report encourages. Also ring your bank straight away if money has moved.
Sources
- NIST Computer Security Resource Center: Awareness
- ASD Annual Cyber Threat Report 2024-2025
- OAIC: Preventing data breaches, advice from the ACSC
- OAIC: Guide to securing personal information
- ASD: Cyber security principles
- ACSC alert: Cybercriminals targeting construction companies with email scams
- ASD: Exercise in a Box
