A new report by Cyber Wardens reveals the Aussie small businesses most at risk of cyber attack, with the hospitality sector in the firing line.

The 2026 Small Business Cyber Security Pulse Check Report suggests that while Aussie business owners are becoming increasingly aware of the threats presented by bad actors, they need more support to strengthen their battle lines.

COSBOA’s incoming CEO, Skye Cappuccio, said there remains a disconnect between concern and action across small businesses.

“Small businesses are becoming more cyber savvy, but there’s still a dangerous gap in basic safety measures that are leaving small businesses exposed,” Cappuccio said

Cyber security an uneven playing field

2026 marks the third and final year of the research project, which tracks small business cyber security behaviors and attitudes.

The report identifies key opportunities to support vulnerable sectors such as hospitality, which is the slowest to adopt cyber-safe practices.

The survey of 1570 small business owners and employees in a cross-section of industries indicates that a stronger cyber safety culture has developed over the past three years, but more needs to be done to keep small businesses safe.

The study found cyber awareness varies between industries, with almost eight out of ten businesses (79 per cent) surveyed fearing they would not recover from an attack.

Hospitality most at risk

The study found only about 1 in 2 (47 per cent) of hospitality businesses, including accommodation and food services providers, are using unique passwords or passphrases.

Among those using protection, the approach to security seemed haphazard. While 37 per cent of hospitality businesses had cloud-based backup systems in place, only one-in-three protected their business emails with multi-factor authentication (MFA).

The research suggests there are plenty of healthy discussions around cyber security, and despite the low figures, there is improvement in the sector with the use of unique passwords or passphrases more than doubled over the past three years.

Nonetheless, Cappuccio warns businesses need to become more proactive when it comes to security risks.

“These findings are a wake-up call to act – and underscore that our work in building the cyber resilience of small businesses is far from over.

“Cyber criminals are becoming more cunning and sophisticated by the day, fuelled by technologies like AI, but too many small businesses remain reactive.

Businesses targeted for data and payments

Carpuccio warned it can take only seconds for a cybercriminal to access a business and the results could be devastating.

“Our message is simple: don’t be a sitting duck for cyber crime,” she said.

The revelations of low cyber safety levels among hospitality businesses and accommodation providers highlight an opportunity to raise much-needed awareness among owners and their staff.

“The findings are particularly concerning as hospitality is one of the top users of digital and platform-based payment options, which face higher technical risks such as account takeovers,” the report says.

Among the biggest cyber threats to hospitality businesses include data breaches, phishing emails, ransomware and business email compromise (BEC).

Travel businesses also in the crosshairs

As the travel sector becomes increasingly digitised, Cappuccio said it’s also becoming an attractive cyber target to criminals chasing passport and payment details.

“As these industries continue to embrace digital tools, cyber resilience is no longer optional,” Cappuccio said.

“Protecting customer and traveller data and keeping businesses running safely is essential for the long-term health of these sectors. The good news is that most cyber attacks targeting hospitality and other businesses are preventable.

Cappuccio says adopting basic cyber hygiene, training staff and encouraging awareness is the first step to reduce risk without requiring any major spend.

Australian Restaurant and Cafe Association CEO Wes Lambert said the findings sent an important message to operators.

“The latest Cyber Wardens research highlights that hospitality businesses would benefit from additional support to boost their cyber resilience, especially as owners juggle the daily demands of keeping their businesses afloat,” he said.

“They may not realise just how vulnerable they are to cyber crime, but cafes and restaurants hold valuable customer information – from names and email addresses to booking histories. Casual staffing, shared logins and fast-paced environments all increase the risk of cyber attacks, which is why free programs like Cyber Wardens can make all the difference.”

Professional services well protected

If you’re wondering which sectors have their security in place, it should come as no surprise that the professional, scientific and tech businesses are among the safest, with strong cyber security in place. Unfortunately, the same cannot be said for health care which is falling behind in fundamental cyber safety.

AI is also raising the risk factors for some businesses yet less than one in five  (18 per cent) have put any safeguards in place.

All this, despite the report finding Cyber crime remains a top-three threat for all small businesses, many of whom say they would struggle to survive an attack.

The report can be downloaded here.

Want more? Get our newsletter delivered straight to your inbox! Follow Business Builders on Facebook, Twitter, Instagram, and LinkedIn.