A new year, a new set of cybersecurity challenges. Based on what I’m seeing in the market, here are my predictions for what 2026 holds for Australian small businesses.

Some of these are continuations of existing trends. Some are emerging threats. All of them should inform your security planning for the year ahead.

The Threat Landscape

Prediction 1: AI-powered phishing becomes the norm

We saw AI-enhanced phishing in 2025, but it was still somewhat novel. In 2026, expect it to become standard. Attackers will use AI to:

• Generate grammatically perfect, highly personalised phishing content
• Clone voices for phone-based scams
• Create convincing video deepfakes for high-value targets
• Automate reconnaissance and targeting at scale

The implication: relying on “spot the bad grammar” won’t work anymore. Defence needs to shift to technical controls and verification processes.

Prediction 2: SMB-targeted ransomware increases further

Ransomware operators have figured out that hitting many small targets is more profitable than hitting a few big ones. Expect:

• More automated attacks targeting SMB-specific vulnerabilities
• Lower ransom demands (designed to be payable)
• Faster attack cycles (less time between access and encryption)
• Continued targeting of specific industries: healthcare, legal, accounting

The implication: ransomware resilience - good backups, incident response plans, proper access controls - is essential regardless of size.

Prediction 3: Supply chain attacks become systematic

Attackers will increasingly treat SMBs as stepping stones to larger targets. If you have access to larger clients’ systems:

• You will be targeted
• Your clients will start asking tougher security questions
• Compromise of your systems could breach your clients

The implication: your security posture affects your business relationships, not just your own risk.

The Regulatory Environment

Prediction 4: Privacy Act reforms take effect

The long-awaited Privacy Act changes are expected to roll out in 2026. Key impacts:

• Broader coverage (more SMBs affected)
• Higher penalties for breaches
• Stronger individual rights (access, correction, erasure)
• More prescriptive security requirements

The implication: if you’ve been relying on the small business exemption, review whether you’ll still be exempt and prepare for compliance.

Prediction 5: Essential Eight becomes more expected

While not legally mandatory for most SMBs, Essential Eight will become increasingly expected by:

• Government clients and suppliers
• Larger private sector clients
• Cyber insurers
• Industry bodies

The implication: even if you’re not required to implement Essential Eight, market forces will push you toward it.

Prediction 6: Cyber insurance requirements tighten again

Insurers will continue raising the bar:

• MFA will be absolute non-negotiable
• EDR (not just antivirus) will become standard requirement
• Backup verification will be expected
• Premiums will continue rising for businesses that don’t meet requirements

The implication: security investment pays off in insurance terms, not just risk reduction.

The Technology Shifts

Prediction 7: AI security tools become SMB-accessible

The AI security capabilities that were enterprise-only in 2025 will start reaching small business:

• Automated alert investigation
• Natural language security queries
• Better phishing detection
• Anomaly detection that actually works at SMB scale

The implication: improved security without requiring additional staff, though you’ll need to configure and trust these tools appropriately.

Prediction 8: Passwordless authentication grows

Passkeys and other passwordless options will become more common:

• Major platforms will push passwordless as default
• Hardware security keys will become more mainstream
• Traditional passwords will increasingly be seen as legacy

The implication: start preparing for a passwordless future, even if you’re not ready to deploy today.

Prediction 9: Zero trust becomes practical for SMB

Zero trust principles - never trust, always verify - will become more accessible:

• Cloud-based zero trust solutions reaching SMB price points
• Better integration with existing Microsoft/Google environments
• Practical implementation guides rather than enterprise-focused complexity

The implication: zero trust isn’t just for enterprises anymore. Consider it as you evolve your security architecture.

Your Business

Prediction 10: Security becomes a competitive differentiator

Businesses that can demonstrate good security posture will have advantages:

• Winning contracts that require security attestation
• Lower insurance premiums
• Better protection against increasingly frequent attacks
• Trust from clients handling their data

The implication: security spending is a business investment, not just a cost.

Prediction 11: The security talent shortage continues

There won’t suddenly be more security professionals available:

• Competition for talent will remain intense
• Costs for in-house security staff will stay high
• Managed security services will grow as an alternative
• Automation will help but not solve the problem

The implication: plan for getting security expertise through services rather than hiring, unless you’re large enough to compete.

Prediction 12: Security fatigue is a real risk

After years of constant warnings, businesses might tune out:

• “Another breach in the news, whatever”
• “We haven’t been attacked yet, why spend money?”
• “I’m tired of security being a problem”

The implication: maintaining vigilance and sustained investment requires deliberate effort. Don’t let fatigue undermine progress.

What to Do About It

Based on these predictions, here’s what I’d prioritise for 2026:

Q1:

• Review your Essential Eight maturity
• Ensure MFA is universal
• Update your incident response plan
• Check your insurance coverage and requirements

Q2:

• Assess AI security features in your existing tools
• Review vendor and supply chain security
• Prepare for Privacy Act changes
• Test your backups

Q3:

• Explore passwordless options
• Evaluate zero trust approaches
• Review and update security training
• Consider security as part of business planning

Q4:

• Annual security assessment
• Budget planning for 2027
• Review the year’s incidents and near-misses
• Update policies and procedures

The Bottom Line

2026 will bring new threats, new requirements, and new opportunities. The businesses that invest steadily in security fundamentals will be better positioned than those that react to each new crisis.

Security isn’t something you achieve and then stop. It’s an ongoing practice that adapts to changing threats and requirements.

My prediction for businesses that take that seriously: fewer incidents, better insurance terms, more client trust, and less crisis-mode stress.

That’s worth planning for.

Here’s to a more secure 2026.