The average data breach costs an Australian business USD 2.55 million, according to IBM's 2025 Cost of a Data Breach report. A year of security awareness training for a 50-person team costs a small fraction of one percent of that. This article puts real numbers on both sides so you can size the gap yourself.
TL;DR
- IBM's 2025 report puts the average Australian breach at USD 2.55 million; the global average is USD 4.44 million.
- Verizon's 2025 DBIR found the human element - error, misuse or social engineering - is involved in about 60% of breaches.
- Untrained workforces run a 33.1% phishing click rate; after 12 months of consistent training it falls to 4.1% (KnowBe4, 2025).
- The cheapest intervention targets the biggest cause: security awareness training priced against the cost of one incident.
Why this matters
Budget conversations about training usually stall because training is priced against nothing. Comparing it to the cost of the incidents it prevents makes the decision concrete. IBM's 2025 Cost of a Data Breach report measured the global average breach at USD 4.44 million - down 9% year over year for the first time in five years - with Australia at USD 2.55 million. Those are averages across mid-size and large organisations; for a small business the absolute number is smaller, but the survival impact is larger, because there is no balance sheet to absorb it.
Where the money goes in a breach
IBM breaks breach cost into four buckets, and the two biggest are the ones small businesses never budget for:
- Detection and escalation - forensics, audits, crisis management, legal review
- Lost business - customer churn, downtime, reputation repair
- Notification - every affected individual and, in Australia, the OAIC under the Notifiable Data Breaches scheme
- Post-breach response - helpdesk, credit monitoring, remediation
The ACSC's Annual Cyber Threat Report and the OAIC's Notifiable Data Breaches statistics both show that the majority of reported breaches in Australia involve human factors - phishing, misdirected email, wrong settings. Verizon's 2025 DBIR puts the human element at roughly 60% of breaches globally. That is the share of your breach risk that training directly addresses.
What training actually costs
A modern awareness program is priced per user per month, delivered in 3-5 minute modules, with phishing simulations included. For a 50-person team the annual cost is typically in the low thousands of dollars - less than one hour of a single incident responder's time at breach rates. The question is not the subscription price; it is whether the click rate moves.
KnowBe4's 2025 Phishing by Industry Benchmarking Report - 67.7 million simulated phishing tests across 14.5 million users - measured the average organisation's phish-prone rate at 33.1% before training, dropping about 40% within 90 days and to 4.1% after 12 months. That is an 86% reduction in the workforce's susceptibility to the attack type behind most breaches.
The honest counter-argument
Two caveats keep this comparison honest:
- Training does not stop everything. Verizon's researchers note that click rates on their own simulations were largely unaffected by training alone - the measurable gains come from training combined with simulations, coaching and reporting culture, not a once-a-year video.
- Averages are not your number. Your exposure depends on the data you hold, your sector and your suppliers. A gap assessment is how you replace the national average with your own baseline.
How to run the comparison for your business
- Estimate your breach exposure: customer records held, regulatory notification obligations, downtime cost per day. Even a conservative floor beats zero.
- Measure your current phish-prone rate with a baseline phishing simulation. If it is near the 33% untrained benchmark, that is one in three staff clicking a real attack.
- Price a 12-month training and simulation program - for most SMBs this is hundreds to a few thousand dollars per month.
- Compare against the Australian average breach cost of USD 2.55 million, scaled honestly to your size.
FAQ
How much does the average data breach cost in Australia in 2026? IBM's 2025 Cost of a Data Breach report puts the Australian average at USD 2.55 million, with the global average at USD 4.44 million.
Is security awareness training worth it for small businesses? Yes - it targets the human element involved in about 60% of breaches (Verizon DBIR 2025), and benchmark data shows an 86% drop in phishing susceptibility after 12 months of consistent training and simulations.
How fast does training reduce phishing click rates? Benchmarks show roughly a 40% reduction within 90 days and an 86% reduction after 12 months of continuous training plus simulations.
What is the single cheapest way to reduce breach risk? Start with MFA everywhere, then run monthly micro-training with phishing simulations and measure the click rate quarterly - the two controls with the best cost-to-impact ratio for SMBs.