Geo Focus: Asia , Geo-Specific , Security Operations

Australia's Cost-of-Living Crisis Squeezes Security Spending

Declining consumer spending and a looming cost-of-living crisis in Australia have forced a majority of small businesses to cut cybersecurity spending and devote available funds to revenue generation efforts such as customer acquisition, client relationships and growth.

See Also: 2023 State of the Phish: Asia-Pacific

Small businesses across Australia have struggled to recover fully in the aftermath of COVID-19, due to interest rate hikes, rising insurance costs, energy costs, real estate costs, labor shortages, increasing wage entitlements and domestic supply chain pressures.

The Council of Small Business Organizations Australia, commonly known as COSBOA, said Australian small businesses generated AU$856.8 billion in revenue in 2021-22 and employ 6.8 million Australians, but cost pressures could hurt their continued survival and expose them to risks such as cyberattacks.

"Small businesses are increasingly aware of the growing risks of cyberattacks, likely due to highly publicized data breaches in the media and increasing personal threats," COSBOA said in its Small Business Perspective Report 2023. "Despite improved awareness, half of small business owners feel that addressing cybersecurity is too hard, cost-prohibitive and complicated to maintain."

The report says that most small businesses find comprehensive cyber insurance to be prohibitively expensive, lack knowledge about cyberthreats and what to do to prevent attacks, and fear that cyberattacks could disrupt entire supply chains.

Mastercard revealed similar concerns from small businesses in a survey published Monday, saying that though 309,000 small businesses faced cyberattacks, many small businesses are staffed too thinly to adequately cover cybersecurity.

The survey found that 63% of Australian small businesses are actively trying to scale down business costs amid the cost-of-living crisis, and cybersecurity investments frequently face the chopping block. A majority of small businesses are now investing in customer acquisition, client relationships and growth and citing cybersecurity as a low priority.

"There are so many priorities when it comes to running a small business. Cybersecurity is definitely a consideration; however, it isn't necessarily top of mind day to day, especially as the rest of our operating costs continue to increase," a Sydney-based small business owner told surveyors.

Since nearly half of small businesses find cybersecurity products and services too expensive to adopt, business owners are looking for simplicity and clarity. Mastercard found that "66% of small business owners say they would make more of an effort to put security features in place if they were aware of all the cybersecurity risks, while 68% feel they would benefit from simple cybersecurity resources to get them started."

The Australian government in its 2023-24 federal budget provided AU$23.4 million to help small businesses become more resilient against cybercrime, and 60% of that funding will target small and medium businesses. A significant portion of the money funds the government's Cyber Wardens program, a COSBOA-run initiative to equip small businesses with foundational skills they need to enhance cyber safety.

"Currently, cyberthreats and scams targeting small businesses cost the Australian economy an estimated AU$29 billion a year. The program will create up to 60,000 Cyber Wardens in small businesses within three years, building small business cyber resilience," COSBOA said.

Minister for Small Business Julie Collins said the government has invested an additional AU$18.6 million "to help support small businesses adapt and build resilience through digital technology through the latest round of digital solutions."

"The average cost per cybercrime attack is around $39,000 per small business, causing significant financial and reputational damage," she said. "Australia's small businesses are already facing cost pressures, so a cybercrime attack would be a huge blow."

Collins added that Australia aims to be the most cyber-secure nation in the world by 2030, and it cannot achieve the goal without securing small businesses. "The Albanese government is making sure small businesses are at the center of our efforts to protect Australia from growing cyberthreats," she said, adding that the government is also strengthening data privacy laws to ensure small businesses have greater resilience against data breaches and can secure data and personal information.