Phishing’s share of the intrusions handled by Microsoft’s incident responders more than tripled in 2026. Email fraud now makes up most SME cyber claims at one specialist cyber insurer, yet it is commonly subject to tight sublimits, exclusions or optional add-ons under local cyber policies.
Microsoft’s 2026 Digital Defense Report found phishing accounted for 23% of initial access in its incident response cases, up from 7% a year earlier. Only the exploitation of public-facing applications, at 24%, ranked higher.
Australia placed 11th worldwide for cyber activity that affected Microsoft customers in the first half of 2026, with 1.5% of the global total. The report also states that small and medium-sized businesses remain at high risk of cybercrime, from ransomware to business contact impersonation.
Cowbell’s Australian general manager, Gerry Power, said many SMEs “still believe they are too small to be targeted”. The Australian Institute of Criminology found 25% of SME owners it surveyed had their business affected by cybercrime in the previous 12 months, while the share of respondents holding cyber insurance fell from 4.6% in 2024 to 3.7% in 2025.
Read more: Cyber insurance uptake falls as online risks remain widespread
Cover has become cheaper over the same period. Cyber premiums fell about 10% through 2025, according to EBM Insurance and Risk, and APRA data puts cyber gross written premium at $32 million in the March 2026 quarter, less than 0.2% of total industry premium.
Emergence’s Cyber Claims Data Report 2026 shows business email compromise (BEC) made up 55% of claims under its SME policies in Australia and New Zealand so far this year, against an average of 44% between 2023 and 2025. The average cost of a BEC attack has risen 22% so far in 2026.
A common pattern starts with a supplier email about changed bank details. “The emails that cost our clients money don’t look like scams any more,” said Emergence’s chief operating officer, Tim Barratt, who noted that a call to a known number is still one of the simplest checks available.
National figures follow the same direction. The National Anti-Scam Centre recorded $166.8 million in payment redirection losses in 2025, up from $152.6 million in 2024, and a further $97.6 million lost to phishing scams.
Microsoft’s data shows how quickly one breach spreads. More than 52% of intrusions involving a compromised account led to further credential theft.
Funds transfer fraud sublimits are often set as low as $100,000 or $250,000 on a $1 million cyber policy. Many Australian wordings exclude business email compromise or invoice fraud when no system was breached, and social engineering cover is often sold only as an add-on.
At an industry roundtable, CFC’s Michael Lewis said 75% of the incidents his firm sees start with a malicious click, a fake payment approval or shared credentials. Cowbell’s Anthony Wall advised brokers to check that computer crime wordings cover reverse social engineering, invoice manipulation and lost third-party funds, not social engineering fraud alone.
Some insurers are writing the cover in explicitly. Many management liability insurers have excluded cyber-related exposures, but Arch Insurance Australia’s Management Liability Plus, listed on Ebix Australia’s Sunrise Exchange in August, includes affirmative social engineering cover.
Read next: Arch takes affirmative cyber position as management liability platform race grows
Coalition’s Deepfake Response Endorsement became available on eligible cyber policies through Upcover’s platform in February. It gives policyholders access to deepfake forensic analysis, legal support to remove fraudulent content and crisis communications assistance.
Since May 2025, businesses with turnover of $3 million or more must report ransomware and cyber extortion payments to the Australian Signals Directorate within 72 hours. The Department of Home Affairs moved to active enforcement on January 1, 2026, with civil penalties of up to $19,800.
Mark Anderson, Microsoft’s national security officer for Australia and New Zealand, said risks that were theoretical a year ago have now materialised.
“We’re seeing AI embedded into malicious software, AI systems becoming targets in their own right, and the first real-world cases of attacks run largely by AI agents. Australia is part of that story,” he said.
The report names compromised identities as a common route into larger attacks, alongside more interconnected attacks and AI-driven gains in speed and scale.
Microsoft also found that the time from vulnerability discovery to weaponisation can fall below 24 hours, while incidents are increasingly moving across several systems and organisations.
“For Australia, that means getting three things right. First, make phishing-resistant authentication the norm, including greater adoption of passkeys,” Anderson said.
His other priorities are using AI in defence to respond at machine speed and building two-way information sharing between government and industry.
“No single organisation sees the whole picture. Our resilience as a nation will depend on how effectively we connect what each of us can see,” he said.
