A phishing attack costs an Australian small business an average of $56,571 per report in 2024-25, up 14% on the prior year, according to the ASD Annual Cyber Threat Report 2024-25. And the clean-up bill is only part of it: downtime, follow-on invoice fraud, lost client trust and weeks of management time often push the true cost well past that average.
TL;DR
- The average self-reported cost of cybercrime for an Australian small business was $56,571 per report in 2024-25, up 14% year on year (ASD Annual Cyber Threat Report 2024-25).
- The human element plays a role in about 60% of breaches (Verizon 2025 DBIR), and phishing is the most common way attackers get their first foothold.
- Direct costs - response, rebuilds, downtime - are matched or beaten by hidden costs: compromised mailboxes used to invoice your clients, insurance premium rises and management time.
- Prevention is priced in single dollars per employee per month; recovery is priced in tens of thousands.
Why this matters
Email compromise remains one of the most common attack types reported to authorities, and small businesses are not collateral damage - they are targeted. A large company's mail filter and security team stop most lures; the same lure often reaches a small team's inbox untouched. Attackers know a ten-person business has no in-house security staff and a thinner cash buffer, which makes them both easier to breach and more likely to pay quickly.
Verizon's 2025 DBIR puts the human element in roughly 60% of breaches. For a small business the first human misstep is usually a click: a fake invoice, a parcel notification, a password expiry. Everything that follows - the cost, the downtime, the awkward client calls - starts there.
The direct costs
When a click turns into a compromise, the immediate bill usually includes:
- Incident response and IT recovery. Rebuilding affected devices, resetting every credential the attacker may have seen, restoring mailboxes and data. If you do not have retained IT security help, engaging it mid-incident is the most expensive way to buy it.
- Downtime. Systems offline or untrusted for hours to days. For a services business, that is unbilled staff time on top of the recovery cost.
- Account takeover clean-up. Attacker rules and forwarding set up inside a compromised mailbox take time to find and remove properly - a rushed clean-up leaves the attacker a back door.
- Ransom and extortion, if it escalates. Not every phishing incident ends in ransomware, but the ones that do dominate the top end of the cost distribution.
The hidden costs
The direct bill is often the smaller half. After a phishing compromise, small businesses routinely absorb:
- Follow-on invoice fraud. The attacker does not just read your mailbox - they use it. A compromised mailbox can send your clients realistic invoices with changed bank details, and some clients pay before anyone notices. Recovering misdirected funds is slow, uncertain and sometimes impossible.
- Regulatory and notification obligations. If personal information is exposed, Australia's Notifiable Data Breaches scheme may require notifying affected individuals - a cost in legal time and in trust.
- Client trust. Small businesses live on references. The honest notification call to your largest client is a conversation nobody budgets for.
- Insurance consequences. Premiums rise after a claim, and insurers increasingly ask about training and multi-factor authentication before offering cover at all.
- Management time. Founders and office managers lose weeks to the aftermath - every hour is unbilled and unrecoverable.
Why small businesses pay more per head
Per employee, a phishing incident costs a small business more than an equivalent one at a large firm. There is no in-house security team to contain it early, no redundant systems to fall back on, and no legal department to handle notifications. Detection is also slower: a large organisation notices odd mail rules in days, a small business often finds out when a client asks why the invoice details changed. Every week of undetected access adds cost.
What the average does not capture
Two things matter when you read that $56,571 figure. First, it is an average across reports - many incidents cost less, and business email compromise cases involving paid fraudulent invoices regularly cost far more. Second, it is self-reported, so it tends to capture the obvious bills and miss the trust and time costs entirely.
The useful reading is the trend, not the decimal: the average rose 14% in a year while the volume of reports stayed high. The cost of doing nothing is not static - it is growing.
What prevention costs
Prevention is priced on a different scale entirely. Published security awareness platforms charge per seat per month, in single dollars for most team sizes - compare that against a five-figure recovery. KnowBe4's 2026 Phishing by Industry Benchmarking Report measured a global baseline where 33.2% of employees would engage with a phishing email before training, falling to 4.2% after twelve months of continuous training and testing. That gap is the preventable share of the cost above.
A programme that gets you there has four parts:
- Monthly training with short, current lessons rather than an annual marathon.
- Phishing simulations that test real behaviour - no credential harvesting, and every click becomes a lesson. A phishing simulation programme is the only way to know what your team would actually do.
- Per-person reporting so overdue courses and repeat clickers are visible without spreadsheets - human risk reporting turns the whole programme into one risk score per learner per month.
- Evidence for insurers and clients - completion records and phishing trends answer the security questions that now appear on insurance renewals and in tenders.
For a ten-person team the annual prevention bill typically comes to a few hundred dollars per seat per year, which the comparison guide breaks down platform by platform. Set against the $56,571 average incident cost, the maths is not close.
Making the budget case internally
If you need to convince a director or an owner: do not lead with threat statistics, lead with the ratio. Prevention costs a known, small, per-seat number; one incident costs an unknown but five-figure number, on average, and rising. Then offer the measurement: a baseline simulation shows the current click rate, and every month after shows it falling. A budget defended by its own data survives budget rounds.
FAQ
How much does the average phishing attack cost a small business? The ASD Annual Cyber Threat Report 2024-25 puts the average self-reported cybercrime cost for an Australian small business at $56,571 per report, up 14% year on year. Business email compromise cases with paid fraudulent invoices can exceed that substantially.
What is the most expensive part of a phishing incident? Usually not the clean-up. The hidden costs - follow-on invoice fraud from the compromised mailbox, client trust, insurance consequences and weeks of management time - often exceed the direct recovery bill.
Does cyber insurance cover phishing losses? Policies often respond, but premiums rise after a claim and insurers increasingly require evidence of controls such as training and multi-factor authentication before providing cover. A documented training programme is both a condition and a discount lever.
How can we find out our own phishing risk before spending? Run a baseline phishing simulation before any training. It measures the current click and report rates, and it is the before picture that every later number is compared against.
Is awareness training really cheaper than an incident? Yes, by orders of magnitude: per-seat training is priced in single dollars per month, while the average small-business incident now exceeds $56,000. The full programme - training, simulations and reporting - is still a rounding error against one avoided incident.