Cyber Pulse Check: on Australian small business cyber safety
The Challenge
How are Australia's small businesses really tracking on cyber security, and is a culture of cyber safety taking hold? Cyber Wardens needed to measure small business attitudes, organisational culture, technical skills and everyday habits, then track them year on year. Small businesses are the backbone of the economy but remain prime targets of cyber crime, with human error behind most breaches, and the threats keep evolving, now supercharged by AI. Behaviour change is slow, so a one-off snapshot would not show whether awareness is turning into action. The idea was a regular 'pulse check': a repeatable, weighted national survey that measures the same things each year against a fixed 2023 benchmark.
Our REsponse
89 Degrees East ran a multi-year national survey of Australian small business owners and employees, delivered as an online survey through a commercial opt-in research panel (Pureprofile), with quota management for gender, age and location. A 2023 benchmark was followed by annual waves in 2024 (1,559 participants: 536 owners and 1,023 employees) and 2025 (1,576 participants: 529 owners and 1,047 employees). A consistent weighting framework, based on the market structure of Australian SMEs by employment size (ASBFEO), was applied across all three years for reliable year-on-year comparison. The research also maps businesses to five cyber maturity segments, from 'Unaware and Inactive' through to 'Ready and Resilient'.
The survey reached 1,559 participants in 2024 and 1,576 in 2025, covering both small business owners and employees, weighted to the market structure of Australian SMEs. Findings are published in annual public reports that Cyber Wardens uses to target its free training and support.
Over three years, the use of unique passwords or passphrases more than doubled, from 30% to 67%. The share of businesses that were 'Unaware and Inactive' fell 12% in a single year. By 2025, 84% had experienced a cyber incident and only 46% felt protected from emerging threats, giving Cyber Wardens a clear, evidence-based map of where to target its free training and support.
Behaviour change takes time, and you can only manage what you measure. Three years of tracking show cyber safety slowly being embedded into the culture of Australian small business: more owners and employees are using strong passwords, talking about cyber security and treating it as a whole-of-team responsibility. But concern still outpaces action, and threats like AI are moving faster than many businesses can keep up with. As a repeatable measure, the Pulse Check shows leaders where progress is real, where risk is concentrated, and which industries need targeted help.
Insights
Public reports:
- 2024 Building a Culture of Cyber Safety in Australian Small Businesses (Year 1). Baseline research into cyber security attitudes and behaviours, basic cyber safety practices, five small business segments, and the barriers and drivers influencing action.
- 2025 Small Business Cyber Security Pulse Check Report (Year 2). 12 key findings across three themes: growing exposure and concern, risks from AI and operating online, and encouraging cyber-safety improvements.
- 2026 Small Business Cyber Security Pulse Check Report (Year 3, final year). 20 key findings across five themes, from the growing threat of AI to industry-by-industry differences in cyber awareness.
