Ransomware protection for an Australian business comes down to three things: make it hard for attackers to get in, limit how far they can spread if they do, and make sure you can recover without paying. In practice that means the Essential Eight basics (patching, multi-factor authentication, restricted admin rights, application control and tested offline backups), an incident response plan that covers the 72-hour ransomware payment reporting rule, and independent testing to prove those controls actually work. Antivirus on its own isn't a ransomware strategy.
This guide explains how ransomware attacks on Australian businesses usually unfold, the controls that matter most, what the Cyber Security Act 2024 now requires if you pay, and how to check your defences before a criminal does. It's written for Australian SMB owners, IT managers and the MSPs who look after them.
How big is the ransomware threat for Australian businesses?
Ransomware remains the most disruptive cybercrime threat facing Australian organisations, according to the Australian Signals Directorate (ASD). It doesn't happen as often as email compromise or fraud, but when it lands it can stop a business from operating at all.
The numbers from ASD's Annual Cyber Threat Report 2024–25 put it in perspective:
- ▸ASD responded to 138 ransomware incidents in FY2024–25, and 39% of them were discovered because ASD contacted the victim to warn it of possible malicious activity
- ▸Ransomware featured in 11% of all incidents ASD responded to, consistent with the previous year
- ▸Among the most serious incidents (categorised C3 and above), ransomware was involved in 34%
- ▸The average self-reported cost of cybercrime per report was $56,600 for small businesses and $97,200 for medium businesses
Ransomware also drives data breaches. Modern ransomware groups usually steal data before they encrypt it, then threaten to publish it. The OAIC received 1,205 data breach notifications in calendar year 2025, the highest since the Notifiable Data Breaches scheme began in 2018, with 716 attributed to malicious or criminal activity. Health service providers were the most affected sector.
That 39% figure is worth pausing on. In a large share of cases, the victim didn't know it had been compromised until the government told it. Detection is part of protection.
How does a ransomware attack actually happen?
Most ransomware attacks follow the same pattern: initial access, privilege escalation, spreading across the network, data theft, and finally encryption and extortion. Encryption is the last step, not the first, which means there are several chances to stop the attack before it does damage.
1. Getting in
Attackers typically gain a foothold through:
- ▸Stolen or weak credentials: passwords bought from data breach dumps or info-stealer logs, used against remote access, VPNs or Microsoft 365 without MFA
- ▸Unpatched internet-facing systems: firewalls, VPN appliances, remote desktop gateways and file transfer tools with known vulnerabilities
- ▸Phishing: emails that deliver malware or harvest credentials
- ▸Exposed remote desktop (RDP): still a common entry point for opportunistic groups
ASD's threat report notes that compromised assets, networks or infrastructure (50%) and compromised accounts or credentials (42%) were the most common features of serious incidents, ahead of ransomware itself. That tells you where most attacks start.
2. Escalating privileges and spreading
Once inside, attackers look for administrator credentials. Flat networks, shared local admin passwords, over-privileged service accounts and weak Active Directory configurations let them move from one workstation to the whole domain, often within hours. Our guide to Active Directory penetration testing covers the common paths.
3. Stealing data and destroying backups
Before encrypting anything, most groups copy out sensitive data and hunt for backups. If your backups are reachable with the same domain admin account the attacker just stole, they'll delete or encrypt them too.
4. Encryption and extortion
Only then do they deploy the ransomware and leave a ransom note, usually with a threat to leak the stolen data if you don't pay. By this point, your options are limited to restoring from clean backups, negotiating, or rebuilding.
Which controls give the best ransomware protection?
The Essential Eight is the best-documented starting point for Australian businesses, because almost every strategy in it maps directly to a stage of a ransomware attack. ASD's own advice on the most serious ransomware incidents was to back up important data in a secure and proven way, keep operating systems and applications up to date, use antivirus software and implement application control.
| Attack stage | Controls that stop or limit it |
|---|---|
| Getting in | Multi-factor authentication, patching applications, patching operating systems, user application hardening |
| Running malicious code | Application control, restricting Microsoft Office macros, user application hardening |
| Escalating privileges | Restricting administrative privileges, patching operating systems, phishing-resistant MFA for admins |
| Spreading across the network | Restricting administrative privileges, network segmentation, unique local admin passwords |
| Destroying recovery options | Regular backups that are isolated, tested and protected from privileged accounts |
Multi-factor authentication everywhere that matters
Enforce MFA on email, remote access, VPNs, cloud admin portals and any system holding sensitive data. Use phishing-resistant MFA (such as passkeys or security keys) for administrators where you can. Stolen passwords are useless without the second factor.
Patch internet-facing systems fast
Edge devices are a favourite entry point. Know every system you expose to the internet, patch critical vulnerabilities on them quickly, and replace devices the vendor no longer supports. The Essential Eight maturity model sets specific patching timeframes by maturity level.
Restrict administrative privileges
Separate admin accounts from everyday accounts, don't let admins browse the web or read email with privileged accounts, and remove local admin rights from standard users. This is often the single biggest difference between one infected laptop and a fully encrypted network.
Application control and macro restrictions
Application control stops unapproved executables, scripts and installers from running. Combined with blocking macros from the internet, it shuts down a large share of commodity malware delivery.
Backups you can actually restore
Backups are your last line of defence, so treat them as a security control, not an IT chore:
- ▸Follow a sensible backup pattern with at least one copy that's offline or immutable
- ▸Make sure backups can't be modified or deleted by normal privileged accounts (the Essential Eight requires this from Maturity Level Two)
- ▸Back up configuration and applications, not just files
- ▸Test restoration regularly. A backup you've never restored is a hope, not a plan
Logging and detection
ASD urges organisations to implement best-practice logging. Centralised logs and alerting on unusual admin activity give you a chance to catch an attacker during the escalation and spreading stages, well before encryption.
What about ASD Essentials?
On 15 October 2026, ASD launched ASD Essentials as the evolution of the Essential Eight, and both frameworks remain live during a transition period. The ransomware controls above carry over, so don't pause your uplift. Our guide to Essential Eight changes and ASD Essentials explains what changed. If you're choosing a target maturity level, see Essential Eight Maturity Level 1 vs Level 2.
Do you have to report a ransomware payment in Australia?
Yes, if your business has an annual turnover of more than $3 million or you're a responsible entity for a critical infrastructure asset under the SOCI Act. You must report any ransomware or cyber extortion payment to ASD within 72 hours of making it, or of becoming aware it was made on your behalf. The obligation sits in Part 3 of the Cyber Security Act 2024 and has applied since 30 May 2025.
Key points from the Department of Home Affairs ransomware payment reporting factsheet and the Cyber Security (Ransomware Payment Reporting) Rules 2025:
- ▸Who: businesses carrying on business in Australia with turnover above $3 million in the previous financial year (pro-rated if you traded for only part of the year), plus SOCI responsible entities
- ▸What triggers it: making a payment, directly or through a third party. A demand you don't pay doesn't have to be reported, though voluntary reporting to ASD is encouraged
- ▸When: within 72 hours of the payment, or of becoming aware of it
- ▸How: using the reporting form on cyber.gov.au
- ▸Penalty: a civil penalty of 60 penalty units can apply for failing to report. The education-first phase ended on 31 December 2025, and from 1 January 2026 Home Affairs moved to a compliance and enforcement focus
- ▸Protection: information in the report is protected under section 29 of the Act and can only be used for limited permitted purposes
ASD's advice remains that you should not pay. Paying doesn't guarantee you'll get your data back or that it won't be leaked, and it can mark you as a target for another attack.
Ransomware usually triggers other obligations too
A ransomware attack that exposes personal information may also be an eligible data breach under the Privacy Act's NDB scheme, which has its own assessment and notification requirements. APRA-regulated entities have CPS 234 notification duties, and SOCI entities have separate cyber incident reporting obligations. Our guides to Privacy Act cyber security requirements and SOCI Act cyber security requirements cover both. Put all of them in one incident response plan so nobody has to work it out at 2am.
How do you know if your ransomware defences actually work?
You test them. A policy that says "MFA is enforced" and a tenant where MFA is actually enforced for every account are two different things. Independent testing is how you find the gap before an attacker does.
There are three levels of testing, and they answer different questions:
| Test | What it tells you | Aussie Pentest price |
|---|---|---|
| Automated security assessment | Whether obvious internet-facing weaknesses (exposed services, known vulnerabilities, misconfigurations) are visible from outside | $80 to $2,000 AUD, 24 to 72 hour SLA |
| Essential Eight assessment | Whether the controls that stop ransomware are implemented and effective, with a maturity score and remediation roadmap | $4,950 + GST for up to 50 seats |
| Human-led penetration test | Whether a skilled attacker can actually get in, escalate to admin and reach your data and backups | From $5,000 + GST (external), from $12,000 + GST (external, internal and web apps), from $20,000 + GST (full scale) |
What a ransomware-focused pentest should look at
If ransomware is your main worry, scope the penetration test around the attack chain, not just a vulnerability list:
- ▸External: exposed remote access, VPN and firewall vulnerabilities, credential attacks against Microsoft 365 and other login portals
- ▸Internal: what an attacker could do from a single compromised workstation, including lateral movement and privilege escalation to domain admin
- ▸Active Directory: Kerberoasting, weak service accounts, shared local admin passwords and misconfigured permissions
- ▸Backups: whether backup consoles and repositories are reachable from the compromised position, and with which credentials
- ▸Detection: whether your monitoring or MSP noticed the testing at all
An internal and external penetration test is usually the most useful format for ransomware readiness, because the damage happens inside the network. Every critical finding in our reports comes with proof-of-concept evidence, because if we can't prove it, it doesn't ship.
If you're not ready for a full engagement, an automated security assessment is a fast, low-cost way to see what you're exposing to the internet. Just be clear it's not a penetration test: it won't show how far an attacker could get once inside.
What should be in a ransomware response plan?
A ransomware response plan should tell your team who decides what, who to call, how to contain the attack, how to restore, and which reporting deadlines apply, before an incident starts. Write it down, keep a copy offline, and rehearse it.
At a minimum, cover:
- Roles and decision rights: who can authorise shutting systems down, engaging incident responders, contacting insurers and making any payment decision
- Contacts: your MSP, incident response provider, cyber insurer, lawyer, bank and the ASD Australian Cyber Security Hotline (1300 CYBER1)
- Containment steps: isolating affected machines, disabling compromised accounts and protecting backups
- Recovery: restore order for critical systems, with realistic time estimates based on actual restore tests
- Reporting: the 72-hour ransomware payment report (if it applies), NDB assessment and notification, and any APRA, SOCI or contractual notifications
- Communications: what you tell staff, customers and suppliers, and who approves it
Call your cyber insurer early. Many policies have specific notification requirements and panel providers, and our guide to cyber insurance and penetration testing covers what Australian insurers commonly ask for at renewal.
A note on scope: Aussie Pentest tests and assesses your defences. We're not an incident response provider, so make sure your plan names one before you need it.
Who should own ransomware risk in a small business?
The business owner or board owns the risk, even when an MSP runs the technology. Your MSP implements controls, but someone needs to check that the controls match the risk, track remediation and report progress in plain English.
That's where independent oversight helps. Your MSP can't objectively tell you how secure you are, in the same way you wouldn't ask a builder to sign off their own work. Validate what your MSP built, rather than replacing them. For ongoing oversight, a vCISO retainer ($2,500 to $6,500 per month) provides advisory and risk tracking, not implementation and not incident response. MSPs who want to offer independent testing to their own clients can use our white-label penetration testing under their own brand.
Frequently asked questions
Can a small business really be targeted by ransomware?
Yes. Many ransomware groups are opportunistic and scan for any vulnerable system or reused password, regardless of company size. Smaller businesses are often easier targets because they have fewer controls and less monitoring, and ASD reports an average cybercrime cost of $56,600 per report for small businesses.
Is antivirus enough to stop ransomware?
No. Antivirus helps, but attackers often disable it after gaining admin access or use legitimate tools that antivirus won't flag. You need layered controls: MFA, patching, restricted admin rights, application control and tested backups.
Should we pay the ransom?
ASD advises against paying. Payment doesn't guarantee recovery or that stolen data won't be leaked, and it may encourage further attacks. If you do pay and your turnover exceeds $3 million, you must report the payment to ASD within 72 hours.
How often should we test our ransomware defences?
At least annually, and after major changes such as a cloud migration, new remote access setup or merger. Test backup restoration more often. Our guide to how often to get a penetration test sets out sensible cadences.
Does an Essential Eight assessment cover ransomware?
Largely, yes. Most Essential Eight strategies target the techniques ransomware groups use, so an assessment tells you how mature those defences are. It doesn't simulate a full attack, so pair it with a penetration test if you need proof an attacker can't reach your data and backups.
Bottom line
Ransomware is a business continuity problem, not just an IT problem. The controls that stop it are well known: MFA, fast patching of internet-facing systems, restricted admin rights, application control, logging, and isolated backups you've actually restored. What most businesses lack is evidence that those controls work as intended, plus a plan that covers the new 72-hour payment reporting rule.
Aussie Pentest helps Australian businesses prove their ransomware defences with fixed-fee, independent testing: automated security assessments from $80, Essential Eight assessments for $4,950 + GST, and human-led penetration testing from $5,000 + GST. See full pricing, or book a 1-on-1 call and we'll recommend the smallest scope that tells you whether a ransomware crew could get from one laptop to your backups.
Sources
- ▸ASD: Annual Cyber Threat Report 2024–25
- ▸ASD: Essential Eight Maturity Model
- ▸Department of Home Affairs: Ransomware payment reporting factsheet
- ▸Federal Register of Legislation: Cyber Security (Ransomware Payment Reporting) Rules 2025
- ▸OAIC: Data breach notifications increase to all-time high in 2025
- ▸Aussie Pentest: Pricing
This article is general information only, not legal, compliance or insurance advice. Reporting obligations depend on your turnover, sector and contracts, so confirm what applies to you with a qualified adviser. Prices are current as of October 2026, and ASD, Home Affairs and OAIC sources were checked on 26 October 2026. Aussie Pentest is not an incident response provider and does not certify Essential Eight compliance. Our reports support your evidence but don't guarantee acceptance by an insurer, client or assessor. Only test systems you have written authority to assess.