October is Cyber Security Awareness Month in Australia - a great excuse to sharpen a few simple habits that keep client money, identity information and your business reputation safe.
This year (2025)’s national theme is building our cyber safe culture, which boils down to doing the basics well. For brokers, that means reducing the chance a criminal can use your email, your device or your processes to infiltrate your inbox, steal your data, copy documents, or impersonate you with clients.
Reduce cyber risks this Cyber Security Awareness Month
Small businesses are squarely in attackers’ sights because they move valuable personal and financial data every day and the broking industry is especially attractive. Even a “minor” incident can be catastrophic: lockedup files the day before settlement, invoice redirection that sends client funds to a mule account, or an exposed mailbox that leaks years of driver licences and payslips.
The good news? Most attacks still rely on human error. A rushed click, a reused password, a device left unpatched. That means small changes make a big difference.
The three fundamentals to lock in
- Update everything. Turn on automatic updates for your operating system, browser and apps. Patching (installing software updates) fix known holes that criminals actively exploit.
- Use strong, unique passphrases with one number and one symbol. Think three random words (e.g. suncaravanriver1985). Store them in a password manager so you never reuse the same one twice. And never share passwords outside of the password manager!
- Turn on multifactor authentication (MFA) everywhere. Email, bank, broker tools, AI tools — if it offers MFA, enable it and prefer appbased codes over SMS.
Weekly focus areas this October
To help you build momentum, work through one focus area each week:
- Event logging: ask your IT partner to confirm your email, devices and cloud apps of logging signins and unusual activity — and that someone actually reviews alerts.
- Legacy tech: plan to replace anything that’s endoflife (e.g. old Windows or server versions) and segment or lock down what you can’t retire yet.
- Supplychain risk: list the vendors or referral partners who touch client data (document collection, CRM, marketing tools). Make sure they support MFA, provide audit logs and have a clear breachnotification process.
- Quantum readiness: you don’t need a PhD, just make a start: keep an inventory of systems that use encryption (browsers, VPN, email gateways) and ask suppliers about their roadmaps.
Educate yourself further during Cyber Month
Remember that Cyber Security Awareness Training in collaboration with our security partner, Mimecast, is available and free via Mercury Nexus. Learn how to spot vulnerabilities and implement safeguards, empowering you to enhance personal and organisational security in an ever-evolving cyber landscape.
Mimecast has provided a really great way to think (and remember) about this, visualising the “Imposters Surround Us” into memorable characters for common attack types:
Charlie (phishing emails)
Finn (impersonation and deepfakes)
Chad (malicious links in collaboration tools)
Riley (unauthorised AI tools)
The point is simple: attackers target people, not just systems.
A fivestep playbook if something feels wrong
- Pause. Don’t click, reply, forward or pay.
- Verify outofband. Call the sender/client on a known number. For any changes, demand voice verification from one or two people.
- Change passwords for any affected accounts and make sure MFA is on.
- Get help. Loop in your IT support, your Connective Compliance Support Manager and any partners.
- Record and prevent. Note what happened, then add a control so it’s harder next time (e.g. an allowlist for certain things and/or a second approval required list for others).
Controls to adopt this month
- Email protection with impersonation and attachment scanning.
- MFA on everything you and your team sign into.
- Password manager rolled out.
- Shared mailbox rules review (look for sneaky autoforward rules). When in doubt, don't click!
- Client comms templates that explain your verification steps (so attackers can’t pressure clients to rush).
Where to get help
If you suspect an incident, call the Australian Cyber Security Hotline on 1300 CYBER1 and report early. Then head back to the Cyber Security Hub for quick guides and to contact your Connective support team.
Keep it simple, keep it steady and by the end of October you’ll have measurably lowered your risk.
