Nearly 7 in 10 Australian small businesses now use artificial intelligence regularly. Very few have written down what it's allowed to do without asking a person first.
Two of this month's stories came from outside the businesses they hit. The Australian Cyber Security Centre issued a high alert on management software that IT providers use to run their clients' computers.
Somebody else made every one of those decisions. The question this edition keeps returning to is who in your firm is deciding, and who is only approving.
AI privacy defaults, the end of text message sign-in codes, and free government support for businesses under 20 staff
How private is AI? It depends which version you're logged into
Consumer versions of the major AI tools may use what you type to train future models. Business and enterprise versions generally don't, and the difference usually comes down to which account someone signed in with.
Three things decide whether your AI conversations stay private, and the product your firm chose is only one of them. The others are the tier your staff signed in with, and the privacy settings on that account.
Consumer tiers of the major assistants generally treat your conversations as material the provider may learn from, with an opt-out sitting in a settings menu. Business, team and enterprise tiers generally exclude customer content from model training by default, and back that with a contract instead of a setting.
Each provider sets these defaults in its own terms, and several have changed them more than once in the past two years. A policy written 18 months ago may describe a product that has since changed behaviour, so those terms need rereading.
The Office of the Australian Information Commissioner (OAIC) has published guidance on commercially available AI products. Its position is direct: do not put personal information, and especially sensitive information, into publicly available AI tools.
That guidance also sets out the work to do before you adopt anything. Start by checking whether your intended use matches the purpose the information was collected for.
Then find out who can see what goes in, and what comes out.
Read the provider's terms as well. The question to answer is whether it gains rights to use your data for itself.
Australia doesn't currently have a standalone AI Act. The government has confirmed it will not proceed at this time with its earlier proposal for mandatory AI guardrails.
It applies existing laws and regulators instead, supported by national guidance and AI safety work.
For a law or accounting practice, that puts the weight on your own judgement. Your obligation to protect client information hasn't changed, and there's no AI-specific safe harbour to point at if it goes wrong.
What to do next
Confirm which tier of each AI tool your staff are signed into.
Move business use off consumer accounts and onto a business or enterprise tier.
Read the OAIC guidance before your next tool decision.
Document the client information that must never go into an external AI tool.
Recheck each provider's terms whenever it announces a change.
Microsoft is retiring text message sign-in codes in February 2027
From 1 September 2026, Microsoft began automatically enabling passkeys for staff who rely on text message or voice codes. Microsoft-provided delivery of those codes ends on 1 February 2027, so you need to move people to a phishing-resistant method or arrange an alternative.
A passkey replaces your password with a credential held on a device and unlocked by a fingerprint, face or PIN. There's nothing to type, so there's nothing for an attacker to phish or reuse.
Microsoft has confirmed that on 1 September 2026 it began automatically enabling passkeys for Entra ID users set up for text message or voice authentication. Entra ID is the identity system sitting behind Microsoft 365.
Those users are now prompted to register a passkey. Nothing breaks yet.
The date that matters more is 1 February 2027, when Microsoft stops delivering those codes itself. Any user whose only second step is a text message gets blocked at sign-in until they register a passkey.
Microsoft's documentation is blunt about the enforcement: there is no opt-out, and it applies to all tenants. A temporary deferral runs between September and February, and it expires.
There is one alternative path. Organisations in regulated industries, or with a genuine operational need for text messages, can bring their own telecom provider.
Those providers become available through the Microsoft Security Store from 30 October 2026.
Multi-factor authentication (MFA) adds a second step beyond your password. Text messages have been the easiest version of that to switch on, which is why so many businesses use them.
That convenience now has a deadline attached.
Handling this in October costs an hour. Handling it in February costs a morning.
What to do next
Ask your IT provider which staff use text message or voice codes as their only second step.
Enable passkeys as an authentication method in your Microsoft tenant.
Prompt your staff to register before February.
Confirm staff on shared or reception devices have a workable method.
Decide before October whether you have a genuine need for a third-party telecom provider.
There's free government cyber support for businesses under 20 staff
The Small Business Cyber Resilience Service gives businesses with 19 or fewer staff free one-to-one help, both to lift their security and to recover from an incident. It's Commonwealth funded and delivered by IDCARE.
The Small Business Cyber Resilience Service is delivered by IDCARE, the national identity and cyber support service. It's free to sole traders and businesses with 19 or fewer full-time equivalent staff, anywhere in Australia.
You get a person who'll work through a plan with you, and who'll help you through the recovery if something has already happened. There's a phone number, and someone answers it.
The service covers recommendations built around your business, practical recovery guidance, case management, and referrals where a matter needs a specialist. Case management includes access to mental health support, and most technical guidance doesn't mention that at all.
Call 1800 595 170 on weekdays, or lodge a request through the IDCARE website.
What to do next
Save 1800 595 170 somewhere you'd find it under pressure.
Book a session now rather than waiting for an incident to justify one.
Give the number to whoever would take the first call if something went wrong.
Check the eligibility detail on the business.gov.au page if your headcount is near 20.
AI moving from tool to colleague, an alert aimed at your IT provider, the Windows 10 deadline, and a quiet saving on invoices
AI is becoming a colleague, and most firms haven't decided what it's allowed to do alone
Australian small business AI use has climbed from 40% to 69% in two years. The firms getting real value decided in advance which work AI may draft, which it may advise on, and which it may finish without anyone checking.
Research from Intuit QuickBooks surveyed 3,790 Australian small business owners and operators between July 2024 and January 2026. It found 69% now use AI regularly, up from 40% in July 2024.
More than a quarter use it daily, and 79% report productivity gains.
The same survey found what's holding businesses back. Privacy and security was the primary barrier for 39% of them.
Capability isn't the only thing that changed. More AI tools can now plan and finish a task rather than simply answer a question, which makes them behave more like staff than software.
Professor Mary-Anne Williams of the UNSW Business School has written on this shift. Her framing is the most useful one available to a small firm.
"Human-AI collaboration succeeds with careful design," she writes, "not by accident."
Her diagnosis is that organisations run three different things together and then wonder where accountability went. There's AI that drafts, AI that advises and AI that executes, and each needs a different level of human oversight.
Blur those modes and responsibility drifts quietly towards the system. A recommendation starts to feel authoritative, and the person who should be deciding becomes the person who approves.
Governance is lagging behind adoption almost everywhere. An April 2026 OutSystems survey of nearly 1,900 IT leaders worldwide found 94% were worried that AI sprawl was adding complexity and security risk.
Only 12% had put central management in place.
Your exposure as a professional services firm is specific. An AI tool that drafts client correspondence, summarises a matter or reconciles an account is handling privileged or financial information.
Who checked that work before it left the building is a question your professional body would ask.
Four decisions, in this order
Drafting
It writes, you approve. Lowest risk, and where most firms should start.
Advising
It recommends, you decide. Needs someone in the habit of checking.
Executing
It acts without being asked each time. Needs a named owner and a written boundary.
Access
Give an agent its own identity and permissions, or it quietly inherits a staff member's.
Professor Williams also names the warning sign. Once your staff stop overriding the AI altogether, nobody is checking it any more.
What to do next
Write down which tasks AI may draft, which it may advise on, and which it may finish unsupervised.
Name one person accountable for each AI tool in regular use.
Give any tool that acts on its own its own login.
Tell your staff plainly that disagreeing with an AI output is expected.
Check how often anyone has overridden an AI recommendation this month.
The ACSC alert that's really a question for your IT provider
The Australian Cyber Security Centre issued a high alert on 19 August on N-able N-central, a platform many IT providers use to run their clients' computers. It has seen the flaws exploited in Australia, and a patch existed weeks before the alert.
Remote monitoring and management software is how a modern IT provider does the job. One team applies updates, installs software and fixes faults across many client businesses without visiting each office.
To do that, it holds administrative access to every computer it manages. That access is the whole point of the software, which is exactly why the software itself has to stay current.
On 19 August 2026 the Australian Cyber Security Centre (ACSC) published a high alert on a remote management platform being actively exploited in Australia. The two authentication bypass flaws are CVE-2026-18556 and CVE-2026-18577, both rated 8.2 out of 10 for severity.
Both allow access without valid credentials. The vendor released patches on 1 August and a further hotfix on 6 August.
The fix existed before the warning did. Any provider still exposed on 19 August had a fortnight to apply it.
Unapplied patches are now the leading way in, according to Verizon's 2026 Data Breach Investigations Report, which covers breaches globally. It found vulnerability exploitation was the top route into a breach at 31%, ahead of stolen credentials at 13%.
Verizon also looked at how well known flaws actually get fixed. Only 26% of critical vulnerabilities on the United States government's known-exploited list were fully patched during 2025, down from 38%.
The N-able alert is the same pattern with an Australian address on it. A fix was published, and the ACSC was still watching Australian businesses get hit through the gap.
If you outsource your IT, none of this argues against outsourcing. Your provider's own systems form part of your attack surface, meaning every route an attacker could use to reach you.
A good provider answers a direct question about that without hesitating.
What to do next
Ask your IT provider whether they use N-able N-central and whether the August hotfix is applied.
Get that confirmation in writing.
Find out how they heard about the alert and how fast they acted.
Check whether their management platform is reachable from the public internet.
Report a suspected compromise to the ACSC on 1300 CYBER1.
Windows 10: the decision you need to make before October 2026
Windows 10 support ended in October 2025. The paid extension covering it runs at US$61 per device for year one, US$122 for year two and US$244 for year three, and year two starts in October.
Support for Windows 10 ended on 14 October 2025. Microsoft has sold Extended Security Updates since then, so businesses could keep getting security patches while they replaced or upgraded machines.
Microsoft's pricing, accurate at September 2026, is built to make delay expensive. It runs at US$61 per device for year one, US$122 for year two and US$244 for year three.
Microsoft caps the programme at three years from the October 2025 end of support. Two details make the arithmetic worse than it looks.
Cover is cumulative, so buying in year two means paying for year one as well. You also can't buy it for part of a year.
October is when the first increase lands. A firm with 20 machines still on Windows 10 paid about US$1,220 for year one, and year two takes that to US$2,440.
The commercial risks build quietly alongside the cost. Software vendors keep dropping support for unsupported operating systems, and insurers increasingly ask whether the systems holding your data still get vendor patches.
Compliance is where this deserves the most weight. The Privacy Act asks you to take reasonable steps to protect personal information.
A machine that's no longer getting vendor security updates is hard to present as a reasonable step.
What to do next
Ask your IT provider for a list of every machine still running Windows 10.
Compare the Extended Security Updates cost against replacing those machines.
Set a date for the last machine to be migrated and put it in the budget.
Check whether your practice management software still supports Windows 10.
Confirm your insurer has no condition about vendor-supported software.
E-invoicing takes an email out of your payment process
E-invoicing passes an invoice straight between two accounting systems instead of emailing a PDF. It saves handling time, and it takes away the emailed attachment that payment-redirection scams exploit.
An e-invoice travels as structured data from your accounting system into your customer's. Nobody retypes it or keys it into a payables queue.
That removed handling is where the saving comes from, and reporting by CFOtech puts it at up to $20 an invoice against an emailed PDF. For a practice invoicing weekly, that adds up over a year.
There's a security benefit that gets less attention. Many payment-redirection scams exploit emailed invoices and the payment details inside them.
The Australian Taxation Office points to e-invoicing as a way to disrupt exactly that. An invoice that never travels as an attachment is much harder to tamper with.
Adoption is voluntary for the private sector at present. The ATO publishes the list of enabled government entities, which now covers most federal agencies alongside hundreds of state, territory and local government organisations.
From 1 January 2027, New Zealand government agencies must progressively require large suppliers to send e-invoices, through new contracts, renewals and retenders. It's a procurement rule rather than a blanket mandate, and it arrives gradually.
There's a second angle if you run an accounting practice. Your clients will start asking about this, and having an answer is worth something.
What to do next
Ask your accounting software provider whether e-invoicing is already in your plan.
Register through your software or the ATO's guidance.
Check whether your three largest customers can receive e-invoices.
Treat it as a control against invoice fraud as well as a saving.
Security as a procurement condition, and a new complaint pathway taking shape
Third-party security is becoming a condition of winning work
Nearly half of all breaches now involve a third party, and supply chain breaches rose 60% in a year. Buyers have noticed, and showing your security posture is turning into a requirement for winning contracts.
Verizon's 2026 Data Breach Investigations Report, published in May 2026, found third-party breaches now feature in 48% of all breaches globally. Breaches involving an organisation's supply chain rose 60% year on year.
August produced a clean local example. Quest, the aparthotel chain running more than 120 properties, identified a breach on 17 August.
The cause was a vulnerability at a third-party service provider Quest declined to name.
Exposed records covered guest names, contact details and dates of birth, some dating from before June 2025. Quest's guests never chose that supplier and had no way to assess it.
Your clients are in the same position with the systems you use to serve them.
What this means for your business
This is turning into a commercial question. The Commonwealth Procurement Rules require government buyers to manage cyber security risk in their procurements, to put security terms into contracts, and to check that suppliers actually operate those controls. A firm that can answer a security questionnaire quickly and credibly has an advantage over one that treats each request as a fire drill.
Your practical starting point is a list of every third party that holds or can reach your client data, with a note against each of what you actually know about its security. Most firms find that list runs longer than expected, and that several entries come back blank.
The scam complaint pathway being built for 2027
From 1 September 2026, banks, telecommunications providers and designated digital platforms covered by the framework had to join the external complaints scheme. The obligations that matter to a business hit by a scam start on 31 March 2027.
The Scams Prevention Framework requires regulated sectors to prevent, detect, disrupt, report and respond to scams. It arrives in stages.
Stage one passed on 1 September 2026, when entities providing a regulated service had to join the Australian Financial Complaints Authority (AFCA) scheme. Most obligations, and AFCA's power to consider scam complaints, start on 31 March 2027.
What this means for your business
Most professional services firms aren't regulated by this framework, and stand to benefit from it, because the obligations land on the banks and telecommunications providers you deal with. Be clear on what that March date means, because it cuts both ways: a scam that hits your business this month can never become a Scams Prevention Framework complaint, however it was handled.
Keeping a record of every scam attempt is still worth doing, and it costs nothing. Note the date, the amount and which provider was involved, because those notes support a bank dispute or an insurance claim today and an AFCA complaint later.
The compliance information in this edition is general information and not legal advice.
What Jam Cyber is up to
AI uplift training, now running with clients
Every AI topic in this edition lands on the same point. The tools are capable and adoption is climbing, and what's missing is knowing how to use them deliberately.
That's the gap we've spent this year working on. We've partnered with Konvey to run an AI uplift training programme, and it's running with clients now.
The program will be available to Jam Cyber clients and to Australian professional services firms.
If you'd like to find out whether your business is the right fit for the program, visit Konvey.com.au or you can talk to the Jam Cyber sales team.
You don't control most of the technology your firm runs on. Your IT provider chose its management platform, your suppliers chose their systems, and Microsoft chose when text message codes stop working.
What you do control is who decides. The risk in a month like this one is that the person who should be deciding quietly becomes the person who approves.
Three questions are enough to start. Does your provider patch its own tools, which AI tier are your staff signed into, and which of your machines are still on Windows 10?
If you'd like an objective view of where your business stands, get in touch with the Jam Cyber team.
Ready to take the next step?
Let's talk about where your business stands
No jargon, no hard sell. Just a clear, honest picture of your cyber security and IT, and what to do about it.
More than 20 years protecting Australian businesses
Not a single fully protected client has been breached since 2017
Jam Cyber Brief
September 2026 Edition
Nearly 7 in 10 Australian small businesses now use artificial intelligence regularly. Very few have written down what it's allowed to do without asking a person first.
Two of this month's stories came from outside the businesses they hit. The Australian Cyber Security Centre issued a high alert on management software that IT providers use to run their clients' computers.
An Australian hotel chain was breached through a third-party supplier its guests never chose.
There's good news too. Microsoft has started moving business accounts to phishing-resistant sign-in, which means a login an attacker can't steal by tricking your staff.
A free government cyber support service also exists for businesses with fewer than 20 staff.
Somebody else made every one of those decisions. The question this edition keeps returning to is who in your firm is deciding, and who is only approving.
In this edition
New and worth knowing
AI privacy defaults, the end of text message sign-in codes, and free government support for businesses under 20 staff
How private is AI? It depends which version you're logged into
Three things decide whether your AI conversations stay private, and the product your firm chose is only one of them. The others are the tier your staff signed in with, and the privacy settings on that account.
Consumer tiers of the major assistants generally treat your conversations as material the provider may learn from, with an opt-out sitting in a settings menu. Business, team and enterprise tiers generally exclude customer content from model training by default, and back that with a contract instead of a setting.
Each provider sets these defaults in its own terms, and several have changed them more than once in the past two years. A policy written 18 months ago may describe a product that has since changed behaviour, so those terms need rereading.
The Office of the Australian Information Commissioner (OAIC) has published guidance on commercially available AI products. Its position is direct: do not put personal information, and especially sensitive information, into publicly available AI tools.
That guidance also sets out the work to do before you adopt anything. Start by checking whether your intended use matches the purpose the information was collected for.
Then find out who can see what goes in, and what comes out.
Read the provider's terms as well. The question to answer is whether it gains rights to use your data for itself.
Australia doesn't currently have a standalone AI Act. The government has confirmed it will not proceed at this time with its earlier proposal for mandatory AI guardrails.
It applies existing laws and regulators instead, supported by national guidance and AI safety work.
For a law or accounting practice, that puts the weight on your own judgement. Your obligation to protect client information hasn't changed, and there's no AI-specific safe harbour to point at if it goes wrong.
What to do next
Microsoft is retiring text message sign-in codes in February 2027
A passkey replaces your password with a credential held on a device and unlocked by a fingerprint, face or PIN. There's nothing to type, so there's nothing for an attacker to phish or reuse.
Microsoft has confirmed that on 1 September 2026 it began automatically enabling passkeys for Entra ID users set up for text message or voice authentication. Entra ID is the identity system sitting behind Microsoft 365.
Those users are now prompted to register a passkey. Nothing breaks yet.
The date that matters more is 1 February 2027, when Microsoft stops delivering those codes itself. Any user whose only second step is a text message gets blocked at sign-in until they register a passkey.
Microsoft's documentation is blunt about the enforcement: there is no opt-out, and it applies to all tenants. A temporary deferral runs between September and February, and it expires.
There is one alternative path. Organisations in regulated industries, or with a genuine operational need for text messages, can bring their own telecom provider.
Those providers become available through the Microsoft Security Store from 30 October 2026.
Multi-factor authentication (MFA) adds a second step beyond your password. Text messages have been the easiest version of that to switch on, which is why so many businesses use them.
That convenience now has a deadline attached.
Handling this in October costs an hour. Handling it in February costs a morning.
What to do next
There's free government cyber support for businesses under 20 staff
The Small Business Cyber Resilience Service is delivered by IDCARE, the national identity and cyber support service. It's free to sole traders and businesses with 19 or fewer full-time equivalent staff, anywhere in Australia.
You get a person who'll work through a plan with you, and who'll help you through the recovery if something has already happened. There's a phone number, and someone answers it.
The service covers recommendations built around your business, practical recovery guidance, case management, and referrals where a matter needs a specialist. Case management includes access to mental health support, and most technical guidance doesn't mention that at all.
Call 1800 595 170 on weekdays, or lodge a request through the IDCARE website.
What to do next
Technology and running your business
AI moving from tool to colleague, an alert aimed at your IT provider, the Windows 10 deadline, and a quiet saving on invoices
AI is becoming a colleague, and most firms haven't decided what it's allowed to do alone
Research from Intuit QuickBooks surveyed 3,790 Australian small business owners and operators between July 2024 and January 2026. It found 69% now use AI regularly, up from 40% in July 2024.
More than a quarter use it daily, and 79% report productivity gains.
The same survey found what's holding businesses back. Privacy and security was the primary barrier for 39% of them.
Capability isn't the only thing that changed. More AI tools can now plan and finish a task rather than simply answer a question, which makes them behave more like staff than software.
Professor Mary-Anne Williams of the UNSW Business School has written on this shift. Her framing is the most useful one available to a small firm.
"Human-AI collaboration succeeds with careful design," she writes, "not by accident."
Her diagnosis is that organisations run three different things together and then wonder where accountability went. There's AI that drafts, AI that advises and AI that executes, and each needs a different level of human oversight.
Blur those modes and responsibility drifts quietly towards the system. A recommendation starts to feel authoritative, and the person who should be deciding becomes the person who approves.
Governance is lagging behind adoption almost everywhere. An April 2026 OutSystems survey of nearly 1,900 IT leaders worldwide found 94% were worried that AI sprawl was adding complexity and security risk.
Only 12% had put central management in place.
Your exposure as a professional services firm is specific. An AI tool that drafts client correspondence, summarises a matter or reconciles an account is handling privileged or financial information.
Who checked that work before it left the building is a question your professional body would ask.
Four decisions, in this order
Drafting
It writes, you approve. Lowest risk, and where most firms should start.
Advising
It recommends, you decide. Needs someone in the habit of checking.
Executing
It acts without being asked each time. Needs a named owner and a written boundary.
Access
Give an agent its own identity and permissions, or it quietly inherits a staff member's.
Professor Williams also names the warning sign. Once your staff stop overriding the AI altogether, nobody is checking it any more.
What to do next
The ACSC alert that's really a question for your IT provider
Remote monitoring and management software is how a modern IT provider does the job. One team applies updates, installs software and fixes faults across many client businesses without visiting each office.
To do that, it holds administrative access to every computer it manages. That access is the whole point of the software, which is exactly why the software itself has to stay current.
On 19 August 2026 the Australian Cyber Security Centre (ACSC) published a high alert on a remote management platform being actively exploited in Australia. The two authentication bypass flaws are CVE-2026-18556 and CVE-2026-18577, both rated 8.2 out of 10 for severity.
Both allow access without valid credentials. The vendor released patches on 1 August and a further hotfix on 6 August.
The fix existed before the warning did. Any provider still exposed on 19 August had a fortnight to apply it.
Unapplied patches are now the leading way in, according to Verizon's 2026 Data Breach Investigations Report, which covers breaches globally. It found vulnerability exploitation was the top route into a breach at 31%, ahead of stolen credentials at 13%.
Verizon also looked at how well known flaws actually get fixed. Only 26% of critical vulnerabilities on the United States government's known-exploited list were fully patched during 2025, down from 38%.
The N-able alert is the same pattern with an Australian address on it. A fix was published, and the ACSC was still watching Australian businesses get hit through the gap.
If you outsource your IT, none of this argues against outsourcing. Your provider's own systems form part of your attack surface, meaning every route an attacker could use to reach you.
A good provider answers a direct question about that without hesitating.
What to do next
Windows 10: the decision you need to make before October 2026
Support for Windows 10 ended on 14 October 2025. Microsoft has sold Extended Security Updates since then, so businesses could keep getting security patches while they replaced or upgraded machines.
Microsoft's pricing, accurate at September 2026, is built to make delay expensive. It runs at US$61 per device for year one, US$122 for year two and US$244 for year three.
Microsoft caps the programme at three years from the October 2025 end of support. Two details make the arithmetic worse than it looks.
Cover is cumulative, so buying in year two means paying for year one as well. You also can't buy it for part of a year.
October is when the first increase lands. A firm with 20 machines still on Windows 10 paid about US$1,220 for year one, and year two takes that to US$2,440.
The commercial risks build quietly alongside the cost. Software vendors keep dropping support for unsupported operating systems, and insurers increasingly ask whether the systems holding your data still get vendor patches.
Compliance is where this deserves the most weight. The Privacy Act asks you to take reasonable steps to protect personal information.
A machine that's no longer getting vendor security updates is hard to present as a reasonable step.
What to do next
E-invoicing takes an email out of your payment process
An e-invoice travels as structured data from your accounting system into your customer's. Nobody retypes it or keys it into a payables queue.
That removed handling is where the saving comes from, and reporting by CFOtech puts it at up to $20 an invoice against an emailed PDF. For a practice invoicing weekly, that adds up over a year.
There's a security benefit that gets less attention. Many payment-redirection scams exploit emailed invoices and the payment details inside them.
The Australian Taxation Office points to e-invoicing as a way to disrupt exactly that. An invoice that never travels as an attachment is much harder to tamper with.
Adoption is voluntary for the private sector at present. The ATO publishes the list of enabled government entities, which now covers most federal agencies alongside hundreds of state, territory and local government organisations.
From 1 January 2027, New Zealand government agencies must progressively require large suppliers to send e-invoices, through new contracts, renewals and retenders. It's a procurement rule rather than a blanket mandate, and it arrives gradually.
There's a second angle if you run an accounting practice. Your clients will start asking about this, and having an answer is worth something.
What to do next
Keep on the radar
Security as a procurement condition, and a new complaint pathway taking shape
Third-party security is becoming a condition of winning work
Verizon's 2026 Data Breach Investigations Report, published in May 2026, found third-party breaches now feature in 48% of all breaches globally. Breaches involving an organisation's supply chain rose 60% year on year.
August produced a clean local example. Quest, the aparthotel chain running more than 120 properties, identified a breach on 17 August.
The cause was a vulnerability at a third-party service provider Quest declined to name.
Exposed records covered guest names, contact details and dates of birth, some dating from before June 2025. Quest's guests never chose that supplier and had no way to assess it.
Your clients are in the same position with the systems you use to serve them.
What this means for your business
This is turning into a commercial question. The Commonwealth Procurement Rules require government buyers to manage cyber security risk in their procurements, to put security terms into contracts, and to check that suppliers actually operate those controls. A firm that can answer a security questionnaire quickly and credibly has an advantage over one that treats each request as a fire drill.
Your practical starting point is a list of every third party that holds or can reach your client data, with a note against each of what you actually know about its security. Most firms find that list runs longer than expected, and that several entries come back blank.
The scam complaint pathway being built for 2027
The Scams Prevention Framework requires regulated sectors to prevent, detect, disrupt, report and respond to scams. It arrives in stages.
Stage one passed on 1 September 2026, when entities providing a regulated service had to join the Australian Financial Complaints Authority (AFCA) scheme. Most obligations, and AFCA's power to consider scam complaints, start on 31 March 2027.
What this means for your business
Most professional services firms aren't regulated by this framework, and stand to benefit from it, because the obligations land on the banks and telecommunications providers you deal with. Be clear on what that March date means, because it cuts both ways: a scam that hits your business this month can never become a Scams Prevention Framework complaint, however it was handled.
Keeping a record of every scam attempt is still worth doing, and it costs nothing. Note the date, the amount and which provider was involved, because those notes support a bank dispute or an insurance claim today and an AFCA complaint later.
The compliance information in this edition is general information and not legal advice.
What Jam Cyber is up to
AI uplift training, now running with clients
Every AI topic in this edition lands on the same point. The tools are capable and adoption is climbing, and what's missing is knowing how to use them deliberately.
That's the gap we've spent this year working on. We've partnered with Konvey to run an AI uplift training programme, and it's running with clients now.
The program will be available to Jam Cyber clients and to Australian professional services firms.
If you'd like to find out whether your business is the right fit for the program, visit Konvey.com.au or you can talk to the Jam Cyber sales team.
See if your business is a fit →
Final thoughts
You don't control most of the technology your firm runs on. Your IT provider chose its management platform, your suppliers chose their systems, and Microsoft chose when text message codes stop working.
What you do control is who decides. The risk in a month like this one is that the person who should be deciding quietly becomes the person who approves.
Three questions are enough to start. Does your provider patch its own tools, which AI tier are your staff signed into, and which of your machines are still on Windows 10?
If you'd like an objective view of where your business stands, get in touch with the Jam Cyber team.
Ready to take the next step?
Let's talk about where your business stands
No jargon, no hard sell. Just a clear, honest picture of your cyber security and IT, and what to do about it.
Recent Posts
Categories