What Does Cyber Security Actually Cost a Small Business in Australia?

Ask what cyber security costs and you will usually get a discovery call instead of a number. That is not always evasion. The honest version is that "cyber security" describes everything from turning on multi-factor authentication, which is free, to a monitored detection service that costs more than a staff member.

But you still need to budget, so here is the straight version: what the pieces cost in Australia in 2026, what actually moves the number, and what to do first if you cannot do everything.

The short answer

Most Australian small businesses land in one of three bands:

For a ten person business, that is roughly $3,600 to $8,400 a year at the baseline, and $10,800 to $21,600 for the monitored tier. One-off project work sits on top of that.

Those bands are the market, not a quote. Any provider should be able to explain which tier they are proposing and why.

The uncomfortable part: the best controls are nearly free

This is where most security conversations should start, and rarely do, because there is nothing to sell.

The single highest-impact control is multi-factor authentication on email and remote access. If you run Microsoft 365 or Google Workspace, you are already licensed for it. The cost is the afternoon it takes to roll out and the fortnight of people grumbling about it.

The same is true for most of the rest of the early work:

• Removing admin rights from everyday accounts costs configuration time, not licences
• Automatic patching is a setting you already have, and mostly a discipline problem rather than a spending one
• Testing your backups costs an hour and tells you whether the last two years of backup spend actually bought you anything

We wrote about which controls matter and in what order in the Essential Eight explained for small businesses. The order matters more than the budget.

If a provider's first proposal is a product rather than a configuration review, be sceptical. Nobody has ever been breached because they lacked a dashboard.

Where the money actually goes

Once the free wins are done, real spending starts. Roughly in the order most businesses encounter it:

Device management: $8 to $20 per device per month

Central control over laptops and phones: enforcing encryption, pushing patches, restricting admin rights, and wiping a device that walks out the door. Below about ten machines you can survive without it. Above that, doing it manually stops being realistic, which is why device management usually arrives first.

Backup and recovery: $10 to $30 per user per month

Worth being specific here, because this is the line item people most often think they already have. Microsoft 365 and Google Workspace are not backups. They replicate your mistakes faithfully, including a deletion or an encryption event. Proper backup means a separate copy, retained, that you have actually restored from at least once.

Email security: $5 to $12 per user per month

Most incidents still start with an email. Filtering beyond what your mail platform does by default is one of the better value purchases on this list.

Monitoring and response: $40 to $100 per user per month

This is the biggest jump, and the one to be most careful about. You are paying for someone to watch logs and act at 2am. It is genuinely valuable, and genuinely unnecessary for a six person business that has not yet turned on multi-factor authentication.

Assessment and project work: $2,000 to $15,000 one-off

A structured assessment against a framework, producing a ranked gap list you own. At the lower end that is an Essential Eight gap assessment for a small environment. At the upper end it is remediation work: identity cleanup, network segmentation, and rebuilding the IT infrastructure that the security posture sits on.

What drives your number up

Two businesses with the same headcount can be quoted very differently. Usually it is one of these:

• Compliance obligations. Tendering for government work, holding health records, or handling payment data changes the requirement from "sensible" to "evidenced". Evidence is what costs money, because someone has to produce and maintain it.
• Legacy systems. One application that only runs on an unsupported operating system can cost more to isolate than everything else combined.
• Remote and BYOD. Staff devices you do not own are harder to secure than a room full of company laptops.
• Headcount growth. Per-user pricing means your bill grows with hiring, which is worth modelling before you sign a three year term.
• Cyber insurance requirements. Insurers increasingly require specific controls before they will write a policy, and premiums reflect what you have in place. This works in your favour: some of the spend pays for itself in premium reduction.

What it costs to skip it

The honest framing here is risk, not fear.

Most small businesses that get breached are not targeted. They are found by automated scanning that sweeps the entire internet looking for a machine missing patches or an account without multi-factor authentication. Being small is not cover, because nothing chose you.

The costs that follow an incident are rarely the ransom. They are the week of downtime, the staff time spent rebuilding, the clients who ask uncomfortable questions, and the tender you cannot bid for because you now have to disclose an incident. The Australian Signals Directorate publishes an annual cyber threat report with real figures on this, and it is worth reading from the source rather than from a vendor's marketing page.

If your budget is tight

Do these first. They cost close to nothing and remove most of the realistic risk:

1. Multi-factor authentication on email and remote access. Today, not next quarter.
2. Restore something from backup and time it. If you cannot, you do not have backups, you have hope.
3. Remove admin rights from day-to-day accounts and give administrators a separate account for admin work.
4. Turn on automatic patching and then verify it is actually running rather than trusting the setting.
5. Write down who to call. An incident at 6pm on a Friday is not the time to work out who has the passwords.

That list costs a few hours and takes a genuinely exposed business to a reasonably defended one. Everything in the paid tiers is worth more once these are done, and worth considerably less before.

Reading a quote properly

A few things worth checking:

• Per user or per device? A business where everyone has a laptop and a phone can pay twice what it expected.
• Is the assessment yours? You should keep the gap list and be able to hand it to another provider. If the findings live only in their portal, you are renting your own risk register.
• What is the response time, in writing? "24/7 monitoring" without a contracted response time is a dashboard nobody is watching.
• What happens at renewal? Introductory pricing that steps up in year two is common and fine, as long as you knew.
• Is anything here solving a problem you have? The most expensive security spending is on controls that address a risk you were never carrying.

The short version

Foundations are close to free and matter most. A managed baseline runs $30 to $70 per user per month and is the right tier for most small businesses. Monitored detection roughly doubles that and is worth it once the basics are genuinely in place, not before.

Spend in that order. A business with multi-factor authentication, tested backups and current patching, and nothing else, is in better shape than one paying for detection while running unpatched machines and shared admin accounts.

Want to know what your environment actually needs? Get in touch and we will assess you against the Essential Eight and give you a ranked gap list with realistic costs against each item. You keep the report whether or not you do the work with us. You can also read more about our cyber security services, the IT infrastructure work that usually sits underneath it, and device management for the machines your team actually uses.

Keep reading