Hexacon 2026: The iPhone 18 Pro Jailbreak and One-Click Demos Explained
An untethered iOS 27.0.1 jailbreak and one-tap PDF exploits shown on stage in Paris: what was proven, what wasn't, and how to protect your iPhone.
Read article →CYBERSECURITY
Cybersecurity: 6 Important Points for Australians in 2026
Published 1 June 2023 · Updated 25 October 2026
Cybersecurity is talked about constantly, yet many households and small businesses still lack the basic habits that stop most attacks. Our phones, cloud accounts and work systems are all connected, which gives criminals more ways in. The good news hasn't changed either: most attacks are preventable, and the measures that prevent them are mostly free.
We first published these six points in 2024. This version is updated for 2026, with current Australian figures and advice from the Australian Signals Directorate (ASD) and Scamwatch.
Why it matters: the threat in numbers
Australia's cyber agency, ASD's Australian Cyber Security Centre (ACSC), received more than 84,700 cybercrime reports in 2024–25, about one every six minutes, according to its Annual Cyber Threat Report 2024–25. For small businesses, the average self-reported cost per report rose 14% to about $56,600.
Scams add to that. The National Anti-Scam Centre reported in March 2026 that Australians lost $2.18 billion to scams in 2025, up 7.8% on the year before. Investment scams caused the largest losses ($837.7 million), followed by payment redirection scams ($166.8 million), where criminals pose as a supplier and change the bank details on an invoice.
Small size isn't protection. Attackers use automated tools, and increasingly AI, to target thousands of people and businesses at once, looking for whoever hasn't covered the basics.
1. Replace passwords with passkeys, and turn on MFA everywhere
Stolen or guessed logins are still one of the most common ways in. If a criminal gets into your email, they can reset the password on almost everything else.
- Use passkeys wherever they're offered. A passkey replaces your password with a key stored on your phone or computer, unlocked with your fingerprint, face or PIN. ASD now describes passkeys as phishing-resistant multi-factor authentication, because there's nothing to type into a fake website. Google, Apple and Microsoft accounts all support them, as do a growing number of other services.
- Turn on multi-factor authentication (MFA) for every account that doesn't offer passkeys, starting with email, banking, cloud storage and social media. An authenticator app is stronger than SMS codes, which can be intercepted through SIM swap scams.
- Use a password manager for everything else, so every password is long, random and unique.
For small businesses: make MFA mandatory for every staff email and cloud account, especially administrator accounts. It's one of three starting measures in ASD's small business guidance, along with updates and backups.
2. Keep everything updated
Most successful attacks use security holes that already have a fix. Updates close them.
- Turn on automatic updates for your phone, computer, browser and apps.
- Restart when prompted: many updates don't take effect until you do.
- Don't forget routers, printers, security cameras and other internet-connected devices.
- Replace devices that no longer get security updates. For example, Microsoft ended standard support for Windows 10 in October 2025, and older phones eventually stop receiving patches. A device that can't be patched stays vulnerable forever.
When buying a phone, check how long the manufacturer promises updates. Recent Google Pixel and Apple iPhone models are supported for many years; many budget phones are not.
3. Treat unexpected messages as suspicious, especially now that AI writes them
Human error remains the weak point, however good the technology. Phishing and social engineering work because they target people, and even careful, well-trained people make mistakes.
AI has made those attacks more convincing. Scam messages no longer give themselves away through poor spelling, and voices and video can be faked. When releasing the 2025 scam figures, the ACCC's Deputy Chair warned that scammers "can create fake voices" and "fake videos that appear very convincing". Our article on AI-powered cyberattacks in 2026 covers what has actually happened.
The defences are habits:
- Don't click links in unexpected texts or emails, even if they appear to come from your bank, myGov, Australia Post or the ATO. Go to the app or type the address yourself.
- Verify any request for money or account details through a separate channel. Call back on a number you already have, not one in the message.
- Agree a code word with family for urgent "it's me, I've lost my phone" calls and messages.
- For businesses: confirm any change to supplier bank details by phone before paying, and require two people to approve large or unusual payments.
- Report it. In Australia, report scams to Scamwatch and cybercrime to ReportCyber. If you've lost money, contact your bank immediately.
Regular, short training and simulated phishing tests help build a workforce that pauses before clicking.
4. Secure your phone, because it's the key to everything
Your phone holds your email, banking, messages, passkeys and the codes that protect your other accounts. That makes it one of the most valuable targets, yet it's often the least protected device people own.
- Use a 6-digit PIN or longer, plus biometrics. Avoid patterns and 4-digit PINs.
- Turn on built-in theft protection. On iPhone, Stolen Device Protection (iOS 17.3 and later) requires Face ID or Touch ID for sensitive actions when you're away from familiar places, and adds a one-hour delay before key changes such as your Apple Account password. On Android 16 and later, Google's Advanced Protection turns on a bundle of protections with one switch, including theft detection, an automatic restart after 72 hours locked, and blocking of apps from unknown sources.
- Only install apps from official stores, and review app permissions regularly.
- Add a PIN or password to your mobile account with your telco to make SIM swap fraud harder. Our SIM swap guide explains how.
- For high-risk users, Apple's Lockdown Mode sharply reduces the attack surface on iPhone.
For small businesses: a mobile device management (MDM) tool lets you enforce passcodes and encryption and wipe a lost work phone remotely. If MDM isn't practical, standardise on phones with strong built-in security and long update support.
Our phone privacy checklist goes through these settings step by step. For people who need more, a phone running GrapheneOS adds features such as a duress PIN that wipes the device, automatic reboots that return a locked phone to its most protected state, and tighter app permissions. Our Privacy First 10a comes with GrapheneOS already installed and set up.
5. Back up, and make sure you can restore
Backups are what turn a disaster into an inconvenience: ransomware, a stolen laptop, a failed drive or an accidental deletion. ASD's guidance comes down to a few points:
- Back up regularly, based on how much work you could afford to lose. For a business, that often means daily.
- Keep at least one copy offline or disconnected, so ransomware on your computer can't reach it. ASD has long recommended the 3-2-1 approach: three copies of your data, on two different types of storage, with one copy off-site.
- Test restoring your files, not just backing them up. A backup you've never restored is a hope, not a plan.
- Turn on your phone's cloud or computer backup, and protect that account with a passkey or MFA.
For businesses: since 30 May 2025, businesses with an annual turnover above $3 million must report any ransomware or cyber extortion payment to the government within 72 hours, under the Cyber Security Act 2024. Good, tested backups are what let you avoid having to pay at all.
6. Collect and keep less data
Data is valuable, and that's exactly why holding it is a responsibility. Information you don't have can't be stolen, leaked or misused.
For businesses:
- Only collect what you need. If you don't need a customer's date of birth or a copy of their licence, don't ask for it.
- Delete what you no longer need, on a schedule.
- Limit who can access customer and financial data.
- Know your obligations. Under the Privacy Act 1988, many businesses must protect personal information and notify affected people and the Office of the Australian Information Commissioner of eligible data breaches. Most businesses with turnover under $3 million are exempt, but some, such as health service providers, are covered regardless of size. Customers increasingly expect good data handling either way.
For individuals:
- Share less. Use a separate email address for shopping and newsletters, and don't hand over your phone number or date of birth unless it's genuinely needed.
- Close old accounts you no longer use.
- Use privacy-focused tools, such as end-to-end encrypted messaging, a privacy-respecting browser and, on untrusted networks, a reputable VPN.
The less of your data there is in the world, the less any single breach can hurt you.
The cost of doing nothing
Neglecting cybersecurity usually costs far more than protecting against it: downtime, lost data, legal obligations and, hardest of all, lost trust, which can take years to rebuild. For individuals, it can mean drained accounts and months of fixing identity theft.
None of the six points above needs a large budget, and together they stop most of the attacks Australians report.
Frequently asked questions
What are the most important cybersecurity steps for an individual?
Use passkeys or multi-factor authentication on your email and banking, turn on automatic updates, be suspicious of unexpected messages asking for money or details, secure your phone with a strong PIN and built-in theft protection, and keep a tested backup of anything you can't afford to lose.
What should a small business in Australia do first?
ASD recommends three starting measures for small businesses: turn on multi-factor authentication, keep software updated, and back up important data regularly. Then confirm any change to supplier bank details by phone, and limit who can access customer data.
Are passkeys safer than passwords?
Yes. A passkey can't be typed into a fake website, guessed or reused, and it's unlocked with your fingerprint, face or device PIN. ASD describes passkeys as a form of phishing-resistant multi-factor authentication.
How has AI changed scams?
AI makes scams cheaper and more convincing: messages are better written, and voices and videos can be faked. The best defence is to verify any unexpected request through a separate channel, such as calling a number you already know.
Where do I report a scam or cyberattack in Australia?
Report scams to Scamwatch and cybercrime to ReportCyber on cyber.gov.au. If you've lost money or shared bank details, contact your bank straight away. IDCARE offers free support if your identity has been misused.
Keep reading
AI-Powered Cyberattacks in 2026: What's Actually Happened
AI-run hacking campaigns, voice-clone fraud and AI browsers tricked by hidden instructions: the documented incidents, and the defences that still work.
Read article →
What Is Pegasus Spyware? How It Works and How to Check Your Phone
How NSO Group's spyware gets in without a tap, who it has targeted, where the court cases stand, and how to check your iPhone or Android.
Read article →