Australia's Free Small Business Cyber Program Has Closed

Australia's free cyber safety net for small business switched off last month

On 11 September, Cyber Wardens — the only free, national cyber-safety training built for Australian small business — stopped taking anyone new. $23.4 million of taxpayer money over three years, 36,878 owners and staff trained, and the 2026–27 federal budget renewed none of it. The timing is the problem. The scaffolding came down just as AI made the attacks aimed at you cheaper, faster and far more convincing.

Here's the number that should hold your attention. Even as scam reports to Scamwatch fell 20.8% last year, the average loss per report climbed 30.4%, to $1,762, according to BizCover's analysis of Scamwatch data. Fewer attempts, bigger hits — the signature of targeted, AI-assisted impersonation rather than the old spray-and-pray.

What actually happened

Cyber Wardens was run by the Council of Small Business Organisations Australia (COSBOA), with Commonwealth Bank and Telstra as founding partners. It launched in late 2023 on a $23.4 million Treasury grant and did one thing well: short, plain-English, free training that owners and staff would actually finish. Treasury funding ran out on 31 July 2026, COSBOA stopped delivering the program on 11 September, and the budget offered no replacement. It reached 36,878 graduates against a target of up to 60,000.

The gap it was built to close is still open — and the government knows it. A House of Representatives committee is now investigating the cyber maturity of small and medium businesses and whether government support is adequate, due to report by 31 March 2027. Read that plainly: the inquiry into the gap will outlive the program that was meant to fix it.

Why this is an AI problem, not just a cyber one

Treat this as a security story and you'll file it under "deal with it later". Treat it as an AI-adoption story and it moves up the list. We wrote in July that Australian SMEs rushed into AI and left their cyber defences behind — 61% using AI, 46% with no or minimal security, per the OECD. Cyber Wardens was the public answer to exactly that gap. It's gone, and the gap is now yours.

The connection is direct. Every AI tool you switch on is a new door into your business: a phone agent reads your customer list and calendar, a bookkeeping feature touches every transaction, a quoting tool holds your pricing. The free program taught the basics that keep those doors locked. Without it, the baseline hygiene that makes AI safe to adopt is a do-it-yourself job — and the firms that treat that as a reason to stall will keep falling behind the ones that spend a weekend on it and then adopt with confidence. If you're not sure where your own exposure sits before you add the next tool, map it here.

The threat side is getting sharper at the same time. AI turns a clumsy phishing email into a fluent one and a stranger into the voice of your supplier. The fraud that lands hardest on small business is still the one no law will refund — payment redirection, which cost Australian businesses $166.8 million last year — because you authorised the transfer yourself.

What to do now the training's gone

Three moves, none of them expensive, all of them yours now. First, write the rules before the tools: a one-page policy on what staff may and may not paste into public AI tools — the free template we pointed to still exists. Second, lock the money door: never change a supplier's or an employee's bank details on the strength of an email or a call alone — ring back on a number you already had, and put a second approver on any large payment. Third, keep the free help that didn't close. The government's CyberSmart resources and the Australian Signals Directorate's small-business guidance are still there and still free. Cyber Wardens proved that short and practical works; use what remains of it.

The safety net didn't fail. It was defunded. The work it did is small, and it's the same work that lets you adopt AI without flinching — which makes it worth doing properly, not just doing.