Advice Firms Face Rising Cybersecurity Costs Amid Breaches
With cybersecurity a hot topic, Money Management spoke with a cyber expert on how much advice firms should spend to protect their businesses. October is Cyber Security Action Month and this year’s theme set by the National Office of Cybersecurity is “Take a second. Stay secure”. This year’s theme emphasizes the importance of daily, mindful choices to enhance online security, such as pausing before clicking links or creating strong passwords.
The office highlights that cybersecurity doesn’t have to be complex. Simple, consistent actions can significantly reduce risks, making it accessible for individuals and businesses alike to improve their defenses.
Recent breaches and penalties
This year, the Federal Court imposed civil penalties for cybersecurity failures, fining FIIG Securities $2.5 million for failing to protect client data over four years. This marked the first time the court penalized a firm under general AFS licensee obligations, signaling increased regulatory scrutiny. Generation Life also suffered a breach, with an unauthorized party accessing their system via a third-party provider, showing the vulnerabilities in third-party integrations.
To get a view of how firms can protect themselves from cyber-risk, Money Management talked to Graham Chee, managing director at BCyber, which deals with advisers and credit licensees. Chee provided insights into the costs and strategies firms should consider to mitigate cyber risks effectively.
Cybersecurity costs for small firms
Chee notes that for small firms with under 20 staff, cybersecurity costs range from $8,000 to $20,000 annually, covering essentials like backup, endpoint protection, and ransomware defense. Cyber insurance premiums for small Australian businesses typically fall between $1,000 and $3,500 per year for $1 million in coverage, according to a 2026 pricing guide. However, premiums can rise sharply after a breach, making prevention critical.
The cost of a breach far exceeds preventive measures. The Australian Cyber Security Centre received over 84,700 cybercrime reports in 2024-25, about one every six minutes. The average self-reported cost of cybercrime for small businesses was $56,600, up 14% from the previous year. Across all businesses, the self-reported average cost was $80,850, up 50%.
For financial advice firms, Chee highlights the risk of using AI alongside consolidated client data. AI accelerates processes but also centralizes sensitive information, making it a prime target for cybercriminals. The financial services industry’s reliance on consolidated data for informed advice decisions creates an attractive profile for malicious actors.
The use of multiple AI tools poses a risk of unauthorized disclosure or shadow files, where firms cannot produce records. Chee recommends using one approved tool on a business account with identifiers removed to minimize these risks. This approach ensures better control and accountability over sensitive data.
