Outgunned but not outmanoeuvred: How SMEs win the cyber war

SMEs operate in a hostile global cyber threat environment, and most leaders are aware of it. What they often lack is a clear and practical path forward that fits within constrained budgets, stretched IT teams and competing business priorities. In many cases, that "team" is a single IT generalist called DAVE (Defence Activities Vastly Exceeding Capacity), who is overextended.

In FY2024–25, the ASD received 87,400 cybercrime reports, equating to one every six minutes. The average cost of a single incident is 56,600 for small businesses and 97,200 for SMEs. Despite this, 87% of SMEs have no formal cyber security strategy. The core issue sits within leadership and system design, requiring a structured organisational response.

The session positions cybersecurity as a management discipline. Drawing on major Australian breaches, it examines why these events occurred. Each case highlights breakdowns in governance, visibility and organisational alignment.

The OPTIMA Framework: A Practical Lens for Leaders

The centrepiece is OPTIMA, a six-element framework designed for SME cyber-resilience. It works alongside established cybersecurity standards and supports organisations that must meet regulatory or contractual obligations.

OPTIMA helps to identify the organisational elements needed to deliver on these standards. It addresses a critical leadership question: where to begin and what is currently limiting progress.

The framework evaluates six interdependent elements: Oversight, People, Time, Insights, Money and Alignment. It introduces the Principle of the Shifting Constraint. At any point, one element acts as the primary bottleneck on resilience. Identifying it enables focused improvement. Resolving it shifts attention to the next constraint, creating a continuous cycle of reassessment and refinement. The approach operates as a dynamic system.

Brought to Life Through a Real-World Case Study

The framework is applied to a realistic SME scenario: a 500-FTE national energy services provider operating across 14 sites, with distributed staff and contractual obligations under the SOCI Act.

The session walks through an OPTIMA diagnostic in real time. It identifies the organisation’s primary constraint, develops a 90-day remediation roadmap and demonstrates how targeted investment can move the organisation from SOCI non-compliant status to Essential Eight and SMB-1001 readiness.

Why This Matters Right Now

Australia’s Cyber Security Act 2024 and the reformed Privacy Act have reshaped the risk environment for SMEs. Organisations supplying Critical Infrastructure Entities face clear expectations for cyber resilience and board-level accountability.

Leaders need a structured approach that aligns investment with measurable outcomes. The presentation provides that approach in a form that both technical and non-technical leaders can apply.

The Audience Will Leave With

• A diagnostic tool they can apply to their own organisation.
• Board-ready language for positioning cyber risk as business risk.
• Confidence that resilience is achievable within realistic budgets.

"Outgunned and Not Outmanoeuvred: How SMEs Win the Cyber War" is not a vendor pitch but presents a structured, evidence-based case for SME cyber-resilience. It shows that clear thinking and disciplined execution are the keys to achieving security outcomes.