When most people think about cyber risk, they imagine shadowy hackers, sophisticated malware, or headline-grabbing data breaches.
The reality is far less dramatic — and far more uncomfortable.

The biggest cyber risk facing small and medium enterprises, including professional services and law firms, isn’t advanced attackers.
It’s everyday human behaviour.

Habits.
Shortcuts.
Assumptions.

The small decisions made dozens of times a day that quietly open the door to serious cyber incidents.

Cybersecurity today is less about stopping elite hackers and more about reducing predictable, repeatable human risk. This is where many organisations misunderstand the problem — and why traditional tools alone continue to fall short.

At SBA, we focus on cyber resilience that reflects how people actually work, not how security frameworks assume they do.

Why Most Breaches Are Caused by Human Behaviour

Technology rarely fails on its own. It fails because people interact with it in ways it wasn’t designed to tolerate.

This isn’t limited to workplaces. Recently, Mozilla commissioned 7ASecurity to test ten of the world’s most popular internet-connected children’s toys — including smart tablets, robots, watches and learning devices. These products weren’t niche or obscure. They were mainstream, trusted and widely used in homes.

Across all ten toys — from the Amazon Fire Kids Tablet and Huawei Watch Kids 4 to interactive robots like Emo and Miko Mini — researchers found widespread security and privacy weaknesses. Not because families were reckless, but because systems assumed perfect behaviour and ideal conditions.

That same pattern appears in businesses every day.

Across industries, most security incidents trace back to one or more of the following behaviours:

• Clicking links without verifying the sender
• Reusing passwords across systems
• Emailing sensitive documents without encryption
• Using personal devices or accounts for work
• Ignoring software updates due to inconvenience
• Assuming “someone else” is responsible for security

These aren’t reckless acts. They’re human ones.

People prioritise speed, familiarity and convenience — especially in high-pressure environments like legal practices, accounting firms, consultancies and SMEs where time is scarce and margins are tight.

Cyber risk emerges when systems are built without acknowledging this reality.

Familiarity Breeds Trust — and Vulnerability

One of the most striking findings from the toy research was how easily trust could be exploited.

Several voice-enabled toys, including the Emo Robot, could have their speakers hijacked by an attacker positioned on the same Wi-Fi or Bluetooth network. While this required proximity, the implication was clear: when a system implicitly trusts what it receives, manipulation becomes possible.

In a business context, the same thing happens every day.

Emails from familiar senders are rarely questioned — even though compromised accounts are now one of the most common attack vectors. People assume that if a message “looks right” and comes from someone they know, it must be safe.

Familiarity becomes a vulnerability.

Software can’t fix that on its own.

Data Goes Everywhere — Often Without Anyone Noticing

Most of the toys audited by 7ASecurity stored sensitive data locally and in the cloud — including voice recordings, images, video, contact details and location data. In four out of ten toys, that data was exposed through insecure physical storage. If the device was lost, sold or donated, personal information could be accessed simply by removing storage media.

This mirrors what SBA regularly sees in SMEs and law firms.

Sensitive files are emailed, copied to USB drives, shared via cloud links or downloaded to personal devices with little visibility or control. Once data leaves a secure environment, it’s effectively unmanaged.

In both cases — toys and workplaces — the issue isn’t malicious intent. It’s informal data handling driven by convenience.

And once visibility is lost, so is control.

The Data You Hand Over — Without Thinking Twice

To unlock the full functionality of most connected toys, parents had to create accounts, install apps and provide personal information. 7ASecurity found that six out of ten toys exhibited server-side vulnerabilities or missing authentication controls — meaning the data provided could potentially be harvested at scale.

The toys affected included popular products like TickTalk 5, Toniebox, Sphero Mini, Powerup 4.0 Airplane and PlayShifu Plugo Count.

Businesses do the same thing.

Staff sign up for tools to “get the job done” — file-sharing platforms, messaging apps, AI services — often without understanding how data is stored, processed or shared. This shadow IT creates blind spots that no firewall can see.

Every system that collects data becomes a potential liability if governance and controls aren’t built in from the start.

Policies Exist — But No One Really Reads Them

Mozilla’s research also highlighted another familiar problem: transparency.

Several toys had privacy policies that were vague, incomplete or buried under layers of legal language. In some cases, it was unclear what data was collected, how long it was retained, or which third parties had access.

In regulated industries like law and professional services, this has serious parallels.

If staff don’t understand how data should be handled — or why — policies become shelfware. Compliance becomes theoretical rather than operational.

You can’t make informed decisions without clear, practical guidance.

Why Cyber Insurance and Software Tools Aren’t Enough

Cyber insurance and security software play important roles, but they are frequently misunderstood as complete solutions.

The Limits of Cyber Insurance
Insurance helps manage financial fallout, not prevent incidents. Policies often include strict conditions around security controls and user behaviour. If basic hygiene isn’t met, claims may be limited or denied.

Insurance doesn’t stop:

• Data from being leaked
• Client trust from being damaged
• Business operations from being disrupted

The Software Fallacy
Firewalls, endpoint protection and monitoring tools are essential — but they don’t change behaviour.

Software cannot:

• Stop someone emailing the wrong attachment
• Prevent password reuse across platforms
• Make staff recognise a convincing phishing email
• Ensure data is handled in line with compliance obligations

The toy manufacturers tested by Mozilla had software, servers and cloud platforms. What they lacked were controls designed around real-world use.

The same mistake happens in businesses.

SBA’s Practical Approach to Cyber Hardening

SBA approaches cybersecurity as a business discipline, not just a technical one.

Our focus is on reducing exposure created by everyday habits — quietly, practically, and without unnecessary complexity.

Cybersecurity Hardening Services

We begin by strengthening the foundations:

• Secure configurations aligned to how teams actually work
• Identity and access controls that reduce reliance on passwords
• Segmentation and least-privilege access to limit impact when mistakes occur
• Clear visibility over where data lives and how it moves

The goal is not perfection, but resilience — ensuring small errors don’t become major incidents.

Human-Centric Cyber Risk Reduction

Instead of generic awareness training, SBA focuses on:

• Embedding secure behaviours into workflows
• Reducing decision fatigue by simplifying security choices
• Designing controls that guide people towards safer actions automatically
• Aligning security expectations with real-world pressures

When security works with people rather than against them, compliance improves naturally.

Data Handling & Compliance Support

Data is often an organisation’s most valuable asset — and its greatest liability.

SBA helps businesses:

• Understand what data they hold and why
• Apply appropriate controls based on sensitivity
• Align handling practices with Australian regulatory obligations
• Reduce unnecessary data retention and duplication

Good data governance lowers cyber risk, legal exposure and operational friction at the same time.

Building Cyber Resilience Without a Huge Spend

One of the biggest myths in cybersecurity is that effective protection requires large budgets.

The toy vulnerabilities uncovered by Mozilla weren’t exotic zero-day attacks. They were basic issues: weak authentication, poor storage controls, unclear data practices.

The same is true in most businesses.

Meaningful risk reduction often comes from:

• Removing unnecessary access
• Standardising secure processes
• Eliminating weak practices that persist out of habit
• Improving visibility and accountability

Small changes compound.

A Shift in Thinking

Cyber threats will continue to evolve. Attackers will always look for new techniques. But the most reliable entry points remain human habits that are well understood and highly predictable.

Whether it’s a smart toy in a child’s bedroom or sensitive client data in a law firm, the lesson is the same: systems must be designed for how people actually behave.

At SBA, we don’t assume perfect behaviour.
We design for real behaviour.

Because the hidden cyber risk isn’t hackers.
It’s habits — and habits can be changed.