In June 2026, the cyber security agencies of Australia, Canada, New Zealand, the UK and the US (the Five Eyes) published a joint statement, "The AI shift in cyber risk: why leaders must act now". The message for a Perth small business is simple: attackers are using AI to move faster, so the basics (quick patching, strong sign-in controls, retiring old systems and tested backups) matter more than they did a year ago, and the owner, not just the IT person, needs to own them.
What the agencies actually said
The statement, published by the Australian Cyber Security Centre (ACSC) alongside its partners, argues that AI lowers the barrier for malicious actors and increases both the speed and the complexity of attacks. It treats cyber risk as a core business risk and a leadership responsibility, not a technical side issue.
The practical actions it points to are not exotic:
- Shrink your attack surface (fewer exposed systems and services).
- Patch faster.
- Retire legacy systems.
- Tighten identity and access controls.
- Assume a breach will happen and plan for fast containment.
You can read the full statement on the ACSC website.
What this means for a small business
You are unlikely to be personally targeted by a sophisticated AI-driven campaign. The more realistic problem is that scanning for weaknesses, writing convincing phishing emails and probing for exposed logins is now cheaper and quicker for everyone, including low-skill criminals. The window between a flaw being published and it being exploited keeps shrinking.
In plain terms: the gap between "we will get to that update next month" and "someone has already tried it on us" is smaller than it used to be.
Five things worth doing this quarter
1. Shorten your patching cycle
Set a rule that critical security updates for Windows, Microsoft 365 apps, firewalls and remote-access gear are applied within days, not months. Internet-facing devices such as firewalls and VPN appliances come first. If nobody in your business is responsible for this, that is the gap to close.
2. Retire what is out of support
Unsupported software no longer receives security fixes. Check for old Windows versions, ageing servers and routers nobody has updated in years. Our guide to Windows 11 24H2 reaching end of support shows how this catches businesses out.
3. Lock down sign-ins
Turn on multi-factor authentication for every staff account, email first. Remove accounts for people who have left. Limit admin rights to the few people who genuinely need them. Most small business breaches still begin with a stolen or guessed password.
4. Treat unusual requests with suspicion
AI makes fake emails, voice calls and invoices more believable. Agree a simple rule: any request to change bank details or send payment is confirmed by phoning a number you already have on file, never one supplied in the message.
5. Test your backups and your plan
Assume something will eventually go wrong. Know who you would call, how you would isolate affected computers, and how long a restore would take. A backup you have never restored is a hope, not a plan. Our backup and disaster recovery service covers regular restore tests.
Where to start if you are short on time
Pick the two items that would hurt most if they failed. For most Perth offices that is email sign-in security and backups. Fix those first, then work down the list.
If you would like a hand, our IT security solutions team can review your current position and give you a short, prioritised list. For ongoing patching and monitoring, see our managed IT services, or get in touch. We are a Perth-based team and have been looking after local businesses since 1997.