Cyber Risk in Australia: What it means for your business

February 2025
Cyber threats are evolving—mitigate your business risk with expert insights and cyber insurance from DKG Insurance Brokers.
Cyber risk extends beyond IT—it’s a critical business risk that affects directors, officers, employees and daily operations. As cyber threats evolve, Australian businesses are facing rising financial losses, operational disruptions and reputational damage, making cyber risk management a critical priority.
The Rising Cost of Cybercrime
Cyber threats impact every aspect of business operations, from financial loss to regulatory fines and reputational damage. The Australian Cyber Security Centre (ACSC) received over 87,400 cybercrime reports in 2023-24. Medium-sized businesses faced average self-reported costs of $62,800 per incident, while small businesses reported losses averaging $49,600 per incident.
Cyber Risk Beyond System Restoration
Cyber risk extends beyond restoring data and systems. The Office of the Australian Information Commissioner (OAIC) mandates disclosure for qualifying cyber-attacks, emphasising the need for robust risk treatment to safeguard business integrity and directors’ fiduciary duties amid rising threats. A cyber insurance policy provides access to an insurer-approved panel of cyber loss experts, from brand protection and legal advisors to loss adjusters, while covering costs for forensic investigations, legal fees, PR and regulatory fines, ensuring business continuity.
Key Cyber Threats
- Ransomware Attacks – Malicious software encrypts business data and demands payment for decryption. The ACSC reported that 11% of all incidents responded to in 2023/24 included ransomware, a 3% increase from the previous year.
- Phishing and Email Fraud – Business email compromise (BEC) remains one of the top cyber threats, where attackers pose as executives or suppliers to steal money or sensitive information.
- Supply Chain Vulnerabilities – Cybercriminals exploit weaknesses in third-party vendors to gain access to a business’s data.
- Data Breaches and Privacy Risks – Companies that fail to protect customer data face regulatory fines under the Privacy Act and risk long-term reputational damage.
Luke Kelly, Managing Director of DKG Insurance Brokers, warns, “Cyber risk is no longer something businesses can ignore. The consequences of a cyber attack can be catastrophic—not just financially, but in terms of reputation and trust. That’s why cyber insurance is now an essential part of a business’s risk management framework.”
Why Directors and Officers Must Take Action
Cyber risk is both an operational and a legal concern. Directors and officers have a responsibility to understand and manage cyber risks as part of their broader governance obligations. The Cyber and Infrastructure Security Centre (CISC) emphasises that corporate leaders must proactively address cyber security threats to protect business integrity and resilience. Failure to do so can result in regulatory scrutiny and potential liability under corporate governance laws.
Employees: The First Line of Defence
Employees play a key role in cyber resilience, as cybercriminals frequently exploit human vulnerabilities through phishing and social engineering attacks. The ACSC advises that strong cyber hygiene and regular employee training are critical in reducing cyber risk.
Carien Ahdar, Senior Financial & Professional Risks Insurance Broker at DKG, highlights, “Cyber security isn’t just about technology—it’s about people. Educating employees to identify and respond to cyber threats is one of the most cost-effective ways to reduce risk. A well-trained workforce is your best defence.”
Employee cyber security best practices include:
- Multi-Factor Authentication (MFA) – Strengthens logins with an extra security layer.
- Phishing Awareness Training – Helps employees identify and report suspicious emails.
- Regular Software Updates – Ensures businesses stay protected against evolving threats.
- Access Control Policies – Limits employee access to sensitive business information.
Cyber Insurance: Your Business Safety Net
While prevention is critical, businesses must also prepare for worst-case scenarios. Cyber insurance provides financial and operational protection to help businesses recover quickly from cyber incidents.
DKG’s Cyber Insurance solutions cover:
- Financial losses due to cybercrime, fraud, or ransomware.
- Legal costs associated with regulatory fines and lawsuits.
- Business interruption losses caused by operational downtime.
- Data recovery and forensic investigations following a breach.
- Crisis management support, including PR and brand protection.
Ahdar adds, “Cyber threats continue to evolve and businesses must stay ahead. A strong cyber security framework, combined with awareness and the right insurance coverage, helps organisations build resilience and recover quickly from incidents.”
Protect your business today. Please reach out to our team on 1800 252 926 or emails us at insurance@dkg.com.au to discuss tailored cyber risk solutions that fit your industry and risk profile.