Medium Businesses’ Average Cyber Cost Jumped 45% to $141,300 While Small Firms Sat at $55,400. The Curve Bends Exactly Where Your Brokerage Is Growing

The ASD’s seventh annual threat report landed this week. The figure brokers should read is not the 82,000 reports in the headline — it is the shape of the cost curve underneath, which leaps at the mid-tier and then flattens.

1. What the report actually reported

Taking the corroborated figures first, so the base is clear. ASD’s Australian Cyber Security Centre responded to more than 1,500 cyber security incidents over the year, an increase of more than 20 per cent. It issued more than 4,400 notifications to Australian organisations about potentially malicious activity, up almost 80 per cent. The average self-reported cost of cybercrime to business rose 16 per cent to $93,500 per report. Individuals reported around $33,000 per report, roughly unchanged.

Ransomware was broadly flat, with the ACSC responding to 139 ransomware incidents. Publicly reported common vulnerabilities and exposures rose 30 per cent over the year. SOCRadar’s analysis of the report counts 1,524 incidents in total and 98 data breach incidents, which it puts up 66 per cent — a figure we have seen in that one analysis rather than across multiple outlets, so treat it as that outlet’s reading.

On sector distribution, the Australian Cyber Security Magazine’s summary has federal government agencies accounting for 32 per cent of reported incidents and state and local government 16 per cent. Health care and social assistance was the most frequently reporting non-government sector at 7 per cent. Professional, scientific and technical services and financial and insurance services each sat at 6 per cent. Again, that breakdown comes from one outlet’s reading of the report rather than from several, and brokers appear in those sector buckets only indirectly.

2. Why the mid-tier leap is a broking problem specifically

The report publishes the cost averages. It does not explain the shape of them, and nothing below is the ASD’s finding — it is an interpretation worth pressure-testing against your own business.

The plausible reading is that the mid-tier is where a business has acquired the attack surface of a larger organisation without yet acquiring its controls. A solo operator has one inbox, one laptop, one set of logins and a very short mental list of who can see what. A large lender has an information security function, enforced device management, formal access reviews and an incident response plan that someone has actually rehearsed. The middle has neither. It has grown headcount, inboxes, shared drives, contractors and systems faster than it has grown process — and the large-business cost falling while the mid-tier’s rose by 45 per cent is at least consistent with the idea that mature controls reduce what an incident eventually costs.

Map that onto a growing brokerage and the transition is uncomfortably recognisable. It usually looks like this: a principal broker who used to do everything hires a loan processor. Then a part-time para-broker. Then an offshore administration contractor. Within eighteen months the business has four or five email accounts, a CRM, a document collection tool, a cloud drive that still contains client folders from 2022, a shared password list in a spreadsheet “just for now”, and a settlement workflow in which at least two people can email a client about funds.

Nobody in that business has done anything wrong. The business has simply stopped being the kind of business whose security was adequately handled by one person being careful.

3. What a brokerage actually holds

Here is where the broker channel’s exposure genuinely differs from a comparable small professional services firm, and it is worth being blunt about it.

A brokerage holds, for every client file, something close to the densest set of personal and financial information in the entire lending chain. Driver licence and passport scans. Payslips. Full transaction-level bank statements, often for several accounts over several months. Tax returns and notices of assessment. Rental ledgers. Credit reports. Separation and family law documents on some files. Medical context on hardship files. Business financials and ATO portals for self-employed clients. Often the same again for a guarantor, who may be an elderly parent with no relationship with the brokerage at all.

A lender holds much of this too, behind an information security function with a budget. An accountant holds the tax piece. A real estate agent holds almost none of it. The brokerage holds the whole bundle, assembled, indexed by client name, and sitting in an environment maintained by whoever is least busy that week.

That concentration is also why the operational risk is not only a data risk. The channel’s other exposure is payment redirection around settlement — the moment when a client is expecting instructions about money and will act quickly on an email that looks like it came from you. Cyber Daily’s write-up of the report notes that in the previous year’s report, email compromise without financial loss accounted for 19 per cent of business reports and business email compromise with financial loss for 15 per cent, which together it describes as roughly a third of business reports. Those are prior-year figures reported by one outlet, not this year’s headline numbers, but they point at where the money actually goes missing in small professional firms.

4. The compliance dimension, stated carefully

It is tempting to reach for a regulatory hook here, and this is exactly the point at which broker commentary tends to overstate. So, plainly: brokers operate under privacy obligations in relation to the client information they hold, and credit licensees carry general conduct obligations under the National Consumer Credit Protection Act 2009 that go to how a licensed business is run and resourced. ASIC’s Best Interest Duty guidance in RG 273 sits over the recommendation you make, and a file you can no longer produce or trust is a file you cannot evidence a recommendation from.

What any of that specifically requires of your business — which obligations bite, what counts as adequate, what you would have to notify and to whom, and within what timeframe — is not something to take from an industry article, including this one. It depends on your licensing arrangement, your turnover, your contracts with your aggregator and your lenders, and the facts of any incident. Those questions go to your licensee’s compliance team and, where the stakes warrant it, to your own legal adviser. The useful framing for a broker this week is commercial rather than legal: an incident in a growing brokerage now carries an average reported cost of a size that would absorb a meaningful share of a year’s gross commission, and the report’s own figures say that cost is rising fastest for businesses at your size.

5. What to review this week

The ASD’s long-standing baseline guidance is the Essential Eight: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening, and regular backups. It was written for organisations with IT functions, and a four-person brokerage will not implement all eight to a formal maturity level. It is still the right checklist to borrow from, because the first three and the last cover most of what actually goes wrong in a small firm.

A realistic pass for a brokerage, in rough order of return on effort:

• Multi-factor authentication on every mailbox, without exception. Including the generic info@ address, including the admin contractor, including the principal. Mailbox access is the single most common doorway to both data loss and payment redirection.
• List every system that holds client documents, then name an owner for each. Most brokerages discover two or three they had forgotten: an old document portal, a personal cloud drive used during a busy month, a former staff member’s account that was never disabled.
• Run an access review. Who can open client files today? Include departed staff, contractors, your own family members on a shared device, and anyone whose access was granted for a single task two years ago.
• Kill the shared password spreadsheet. A password manager is a small monthly cost and removes an entire category of exposure.
• Test a restore, not a backup. Almost every brokerage has backups. Far fewer have ever confirmed they can actually recover a client file from one. Pick a file and try it.
• Write the payment-instruction rule down and tell clients about it. Decide the rule — for example, that account details are never changed by email and will always be confirmed by a call to a number the client already has — and put it in your engagement communications. This is a client-facing differentiator as much as a control.
• Decide, now, who you call first. Your aggregator or licensee’s compliance contact, your IT support, your insurer. Writing three names and numbers on one page is a twenty-minute task that is nearly impossible to do well at 9pm on a Friday.
• Check what your professional indemnity and cyber cover actually responds to. Many brokers hold PI and assume it covers an incident of this kind. That is a question for your broker-insurance adviser, not an assumption.

6. The client conversation this opens

There is a commercial upside here that most brokers leave on the table. Clients are being asked to hand over more sensitive documentation than at any point in the channel’s history, and they are increasingly aware of it. Being able to answer “what happens to my bank statements and who can see them?” with a specific, confident, one-minute answer is a trust signal that very few competitors offer, and it costs nothing once the underlying work is done.

The same is true with referral partners. Accountants and financial advisers, who sit under their own professional obligations, are increasingly careful about who they send client information to. A brokerage that can describe its document handling in concrete terms is an easier referral to justify than one that cannot.

7. What to watch next

Three things. First, whether the mid-tier cost figure keeps rising in next year’s report, which would confirm the shape rather than a single year’s volatility. Second, AI-assisted attacks, which multiple outlets report as a central theme of the ASD’s commentary this year. The report’s separate finding that publicly reported vulnerabilities rose 30 per cent is the number to watch alongside it, because the window between a flaw becoming public and someone exploiting it is exactly what a small firm’s informal patching habits quietly depend on. Third, whether aggregators begin asking harder questions about member firms’ document handling, since the aggregator carries reputational exposure for incidents inside its network.

8. The practical significance

This report is not a reason for a brokerage to panic, and it is not an argument for buying security software this afternoon. It is a well-sourced piece of evidence that the cost of getting this wrong rises steeply at a specific stage of business growth, and that the stage in question is the one most brokerages are either in or heading towards.

The firms that handle it well will not be the ones that spent the most. They will be the ones that noticed, somewhere between the second and the fifth staff member, that the security arrangements which worked when one careful person did everything had quietly stopped being arrangements at all. An hour with the list above, this week, is the whole of the response that most brokerages need to make.