You can move a small business to phishing-resistant authentication in about 30 days. Audit your accounts in week one, pilot passkeys or security keys with your highest-risk users in week two, roll out to everyone in week three, and enforce the new rules in week four. Most small businesses already have some form of multi-factor authentication (MFA). The catch is that not all MFA stops a modern phishing attack. This guide shows you how to close that gap without grinding your team to a halt. Why this matters for Australian businesses Cybercrime isn't a distant risk. ASD received over 84,700 cybercrime reports in 2024–25, roughly one every six minutes. For small businesses, the average self-reported cost per report climbed 14% to $56,600. That's a serious hit for a business with a handful of staff and one bank account. Identity is the weak point. Business email compromise is among the top cybercrime types affecting Australian businesses. Most of these attacks begin when someone...