A small business, defined here as ten employees or fewer, cannot deploy an enterprise cybersecurity stack. The advice it receives, from federal and state agencies, has often assumed otherwise. That has, over the past two years, begun to change.

What the new advice looks like

Three interventions, deployed in combination, cover roughly 80 per cent of the practical risk exposure for a small business. Multi-factor authentication on every important account. A managed backup service. A patched, current operating system with automatic updates enabled.

The advice used to be more complex. It also, in the field, produced worse outcomes. The revised guidance from the Australian Cyber Security Centre, published in November, reflects a decade of learning.

The remaining exposures

Phishing remains the single most successful attack vector against small business. Training, brief and repeated, is the most cost-effective countermeasure. Not perfect. But better than the alternatives at the price point small businesses can bear.