2025’s national theme is building our cyber safe culture, which boils down to doing the basics well. For brokers, that means reducing the chance a criminal can use your email, your device or your processes to infiltrate your inbox, steal your data, copy documents, or impersonate you with clients.
Reduce cyber risks this Cyber Security Awareness Month
Small businesses are squarely in attackers’ sights because they move valuable personal and financial data every day and the broking industry is especially attractive. Even a “minor” incident can be catastrophic: lockedup files the day before settlement, invoice redirection that sends client funds to a mule account, or an exposed mailbox that leaks years of driver licences and payslips.
The good news? Most attacks still rely on human error. A rushed click, a reused password, a device left unpatched. That means small changes make a big difference.
The three fundamentals to lock in
- Update everything. Turn on automatic updates for your operating system, browser and apps. Patching (installing software updates) fix known holes that criminals actively exploit.
- Use strong, unique passphrases with one number and one symbol. Think three random words (e.g. suncaravanriver1985). Store them in a password manager so you never reuse the same one twice. And never share passwords outside of the password manager!
- Turn on multifactor authentication (MFA) everywhere. Email, bank, broker tools, AI tools — if it offers MFA, enable it and prefer appbased codes over SMS.
Focus areas
To help you build momentum, work through one focus area each week:
- Event logging: ask your IT partner to confirm your email, devices and cloud apps of logging signins and unusual activity — and that someone actually reviews alerts.
- Legacy tech: plan to replace anything that’s endoflife (e.g. old Windows or server versions) and segment or lock down what you can’t retire yet.
- Supplychain risk: list the vendors or referral partners who touch client data (document collection, CRM, marketing tools). Make sure they support MFA, provide audit logs and have a clear breachnotification process.
- Quantum readiness: you don’t need a PhD, just make a start: keep an inventory of systems that use encryption (browsers, VPN, email gateways) and ask suppliers about their roadmaps.
For Connective members
Remember that Cyber Security Awareness Training in collaboration with our security partner, Mimecast, is available and free via Mercury Nexus. Learn how to spot vulnerabilities and implement safeguards, empowering you to enhance personal and organisational security in an ever-evolving cyber landscape.
Mimecast has provided a really great way to think (and remember) about this, visualising the “Imposters Surround Us” into memorable characters for common attack types:
Charlie (phishing emails)
Finn (impersonation and deepfakes)
Chad (malicious links in collaboration tools)
Riley (unauthorised AI tools)
The point is simple: attackers target people, not just systems.
For members and non-members
For non-members, the key is to continuing to stay up to date with cyber security measures, and be informed. Here are some trusted, free resources to keep your cyber knowledge current:
- Australian Cyber Security Centre – Small Business Guides: Step-by-step checklists and practical tips for protecting your business.
- Scamwatch: Real-time alerts about the scams currently circulating in Australia.
- Office of the Australian Information Commissioner (OAIC): Plain-English resources on privacy responsibilities and handling breaches.
Cyber security isn’t about being perfect - it’s about being prepared. The more you learn, the more confident you’ll feel handling threats calmly and quickly.
A five step playbook if something feels wrong
- Pause. Don’t click, reply, forward or pay.
- Verify outofband. Call the sender/client on a known number. For any changes, demand voice verification from one or two people.
- Change passwords for any affected accounts and make sure MFA is on.
- Get help. Loop in your IT support, your Compliance Support Manager and any partners.
- Record and prevent. Note what happened, then add a control so it’s harder next time (e.g. an allowlist for certain things and/or a second approval required list for others).
Controls to adopt this month
- Email protection with impersonation and attachment scanning.
- MFA on everything you and your team sign into.
- Password manager rolled out.
- Shared mailbox rules review (look for sneaky autoforward rules). When in doubt, don't click!
- Client comms templates that explain your verification steps (so attackers can’t pressure clients to rush).
Where to get help
If you suspect an incident, call the Australian Cyber Security Hotline on 1300 CYBER1 and report early. For members, head back to the Cyber Security Hub for quick guides and to contact your Connective support team.
This article does not necessarily reflect the opinion of the publisher or supplier. It is intended to provide general news and information only. While every care has been taken to ensure the accuracy of the information it contains, neither the publishers, supplier, authors nor their employees, can be held liable for any inaccuracies, errors or omission. All information is current as at publication release and the publishers or suppliers take no responsibility for any factors that may change thereafter.
