For an Australian agribusiness or rural farm in 2026 a cyber risk is not just a case of a password being taken or an email you should have ignored. Disruption can come at your farm via GPS, payment systems, cloud software for management, contractors, food supply chains and any number of connected machines.
There is nothing glamorous about the best way to deal with it, but practicality will serve you better: put some safeguards around your email and payments, including the basics of protecting regional businesses online, keep operational technology apart from business systems, have offline backups, see that equipment is up to date and staff are trained so you know who to ring if things go pear-shaped. My name is Thomas Murphy and I have put together this guide to set out the risks as they are in plain English, not as though there is an IT department in every farm tucked away behind the machinery shed.
The Appeal To Cyber Criminals
Agribusinesses in Australia handle considerable sums of money and possess information of value. Add to that the fact their systems have to be running during transport, harvest, milking and planting and you have an appealing target, even for those who might think the operation is too remote or small to bother with.
One is not protected by distance. From anywhere with an internet connection an attacker can get at the bank access, cloud software and connected machinery of a property in the Top End, Dubbo, Mackay or Geraldton, where local support may be hard to come by.
What Lies Beyond The Farm Gate
Payroll, yield maps, customer data, telemetry, export papers, livestock records and supplier payments are all of interest to criminals. Then there is the matter of an email account falling into the wrong hands; it can show which supplier is due a big payment, who has authority over invoices and the trucking schedule.
Invoice fraud and business email compromise are insidious in their ordinariness. There will be no hoodies or dramatic computer music involved. The communication will refer to an actual account number or a legitimate shipment, only the bank details have been altered.
Exposure From Remote Work
It is common for managers, agronomists, mechanics and farm owners to be working in regional towns, depots, utes and offices as well as sheds. They will be using remote-support applications, hotspots or a shared computer and each one is an opening for unauthorised access or malware.
You have to give seasonal and contract workers system access. They are mostly decent folk with work to do on time but when a contract is up, informal arrangements and the like mean it is not easy to pull their accounts.
Where The Threat Is Most Acute
The more serious cyber threats to agribusiness are old hat in a sense, but in an environment less forgiving. An office PC that is locked out is an annoyance; do it during a critical delivery or while processing livestock and you are looking at disruption to the supply chain and financial consequences.
Sound cybersecurity is about assessing what the impact would be on operations. It is not enough to ask whether our files can be made off with, you also want to know what ceases to function if a machine or account is gone.
Ransomware
This can put the brakes on an agricultural operation by encrypting production records, office files and the odd piece of operational technology. The threat is to make you pay or put your data out there. But paying is no sure fire way to get it back and brings its own legal and practical headaches.
On a farm with a flat network where all the controllers, cameras and computers are in communication with one another, a ransomware attack is worse for wear. One laptop is all the entry an attacker needs for a good deal of territory.
Phishing
These messages are designed to pass for something from the government, a freight firm or your bank. A manager is asked to put in a new password or authorise a payment. MFA will limit what can be done with a stolen password but staff still need to be on their guard with login requests.
When it comes to changing payment details, do not use the number in the email. Pick up the phone to the one on a past invoice. It is a pause worth taking to avoid costly errors.
GPS
Jamming and spoofing can throw positioning and timing out of kilter. With precision agriculture depending on RTK-GPS, GNSS and location data for autonomous equipment and the like, the stakes are high.
But a problem with positioning is not always a cyberattack; it could be the weather, a bad antenna or poor satellite visibility. Do not put your faith in an electronic map alone. Have manual procedures in place and an alert process.
The Risks of Connected Technology
There is no denying the benefits of smart farming: it can make for less waste, greater efficiency and more useful data for a manager. But in bringing that technology in one may also be letting in legacy firmware, default passwords and supplier links of dubious provenance along with devices that are no longer supported.
One does not have to unplug all the sensors and go back to using a clipboard. The point is to have an understanding of what is connected and for what reason, and to be prepared for the event of a connection going down.
Put Your Machinery In Order
Make an inventory of tractors, harvesters, irrigation controllers, cameras, weighbridges, IoT and robotic milking systems, weather stations and any remote-access tools. For each one put on record the model, software version, support contact, internet link and who the supplier is.
It is inadvisable for office computers and connected machinery to have open access to one another. With network segmentation you can put security cameras, guest Wi-Fi, staff machines and production equipment in their own areas. Should a device be taken over, the blast radius is contained.
Take Charge of Cloud Data
Yield maps, livestock and chemical records, financials, staff information and the like will be in your cloud farm management software. Put the provider on notice to explain their approach to MFA, user permissions, data retention, breach notification and account recovery.
A farm’s production data can tell a lot about its commercial strategy, land use and customer relations; data privacy is not some abstract corporate matter. Do away with shared administrator logins and former users without delay, and make sure every worker has an account of his or her own.
Have a Manual Fallback
For all the automated processes of consequence there should be a fallback. Have instructions for feeding, milking, delivery and operating the machinery in print or offline form and put them where they will be at hand in the event of a network failure.
I was reminded of this on a long trip through regional Western Australia: a route on a map is not necessarily one you can put into practice. Digital systems are no different. If reception is poor and power is limited and there is a queue of problems to deal with, a backup plan is only as good as one’s ability to put it to use.
Exposure in the Supply Chain
No farm is an island. From grain merchants and stock agents to banks and government systems, the paddock is tied to the food supply chain by processors, transport operators and the like. A single weak account at a supplier can have repercussions for more than one business.
It is a problem shared across the agricultural supply chain. While a small operation in the regions cannot dictate the security of a major client, it is in a position to see to its own approvals, response procedures and devices.
Set Boundaries for Third Parties
Vendors and contractors should be given no more access than their job calls for. A time-limited account is to be preferred over permanent administrator status. Find out from the vendor how they do remote support, if they log sessions and how they go about revoking access once maintenance is done.
Major operators like JBS Foods, Mackay Sugar, Farleigh and Racecourse mills rely on a web of service businesses, hauliers and growers. A smaller supplier might not be the target per se but its account could be made into a convenient stepping stone if it is compromised.
Any Change to Payment Warrants Verification
New suppliers, a change of bank details or an urgent payment should require the sign off of two people. Call to confirm on a number you trust and make a written note of the approval.
The ACCC is wont to warn of scams built on impersonation and the diversion of payments. There is a simple lesson to be had: urgency is no proof. A caller can be very convincing and a road train may be standing by, yet money should not be released until you have verified the matter for yourself.
| Risk | Likely consequence | First control |
|---|---|---|
| Phishing | Stolen credentials or malware | MFA, email filtering and staff reporting |
| Invoice fraud | Funds to a criminal | Dual approval and an independent call-back |
| Ransomware | Systems and files locked out | Network segmentation, offline backups |
| Legacy firmware | Sensor or machinery exploited | A replacement schedule and supplier maintenance |
| GPS jamming/spoofing | Bad timing or guidance | Fallbacks, manual checks and alerts |
| Supplier compromise | Data or deliveries lost | Vendor review and restricted access |
Consider the above a guide to priorities rather than a forecast of incidents. It is worth a look over after a software upgrade, a new piece of equipment or at the height of the season.
Practical Protection For Farms
An owner can get a lot of protection in short order by concentrating on controls that head off the usual attacks. There is no call to put right everything in an afternoon; it will only end up with a folder of policies that are never read. Make a start with the accounts, the money and the systems that have a physical impact, then as the budget permits work on supplier controls and visibility.
Secure Accounts And Email
MFA should be in place for email, banking, payroll, cloud and remote access as well as administrator accounts. Rely on a password manager to provide a distinct login for each person. Do away with any superfluous accounts, particularly ones left over from old service providers, contractors or ex-employees.
With the bank, put in some payment alerts and limits. Make sure the business, not an individual, has the reins on recovery information for key email accounts. Staff must be made aware they can report anything suspicious at once and need not worry about recrimination.
Recovery Back Up
Have an offline backup that is out of ransomware’s reach on the network. And test it; otherwise one has a nice story to tell but no plan for recovery. A straightforward routine will do: secure periodic offline copies, regular system backups and daily for what is critical. Put in writing which things are to be restored first, be it irrigation controls, dispatch or livestock data, payroll and so on.
Critical Systems Should Be Segregated
An IT provider can put segmentation in the network to keep office PCs apart from guest devices, operational technology, cameras and the like. Any services of no use to the business ought to be disabled and default passwords changed.
Make the equipment supplier check the firmware on older gear. An unpatchable controller needs to be isolated and remote access curtailed; document the cost of a replacement so there are no unpleasant surprises when it breaks down.
Training
Conduct brief exercises with scenarios such as an MFA prompt that does not make sense, a bogus payroll notice or a request for remote support. The staff will then be in the habit of preserving information and knowing who to call. For a regional business the way to go is to make the right thing easy to do: have the reporting number next to the office phone, a checklist in plain English and it should be the norm to put a hold on a payment if something looks amiss.
Incident Response and Insurance
There are security controls that cyber insurance for a farmer cannot replace, even if it will cover certain expenses. One policy may differ from another as to what is covered in the way of social engineering losses, legal fees, notification, extortion, data restoration or interruption to the business.
A broker can give a straight answer on sub-limits, exclusions and waiting periods. Some policies will stipulate MFA, endpoint protection, timely notification or that you have tested your backups. Not having those in order could be the difference in making a claim.
Build A Useful Response Plan
Put together a response plan of some utility. Jot down the numbers for the owner, the manager, your insurer, bank, legal counsel, the authorities and any suppliers you need to get hold of after hours; store this with account and contract details in an offline file.
In the event of an incident, if it is safe to do so, take the devices off the network. Do not try to clean up evidence or wipe anything, and if funds have been moved the bank is to be contacted forthwith. Report the matter via the Australian Cyber Security Centre and follow its guidance for organisations in Australia.
Leave the guessing and negotiating to the attacker. There is a method to response: contain it, see to the evidence, restore in safety and let the appropriate parties know, then find out how it was allowed to happen.
Rural Business Security Checklist
Take a quiet week before harvest or similar to work through this. Without a date and someone to see to it, a task is merely an intention.
- MFA for all email, banking, payroll, cloud and remote access.
- Unique passwords; no inactive accounts.
- A phone call to confirm any invoice or change to bank details.
- Offline backups for the business’s vital records, and they should be tested.
- Office networks kept separate from IoT sensors, cameras and machinery.
- Check legacy firmware and make an inventory of connected machinery.
- It is advisable to make a periodic review of access for your suppliers and contractors.
- Put in place documentation for manual procedures in the event of an outage, be it with the power, internet or systems.
- Insurance requirements and those you would contact in the event of an incident should be put on record offline.
- See that your staff are trained to put in a report at the first sign of phishing or any MFA prompt that looks suspicious.
Where To Put Your Priorities
Make email and payment security your first order of business if time is of the essence. Enable MFA, have a look at forwarding rules and recent logins, get rid of old users, verify your bank-change protocols and be sure backups are in order. In a day one can cover the common ways into a business.
A more extensive operation would do well to undertake a hands-on review of remote access and operational technology. Where systems are safety-critical, governing milking, feeding, spraying, refrigeration or irrigation for instance, you might want the services of a qualified security provider and the machinery supplier.
Who Would Do Well With Some Help?
For small farms without an IT person in house, or where the machinery is of a certain vintage and connectivity is poor, a shared password and a consumer grade router are not much of a security plan. Then there are regional enterprises for whom a call out from a technician could mean hours in the car and a bad reception, with the bill coming due before things have quietened down; they will want some form of scheduled support.
One has to factor in the seasons too. Harvest demands, bushfire closures or cyclone warnings up north in Australia can put a crimp on testing and put off repairs. It is better to do maintenance when things are calm and have emergency numbers to hand when the Stuart Highway or the Gibb River Road are not easy going.
FAQs
The Impact Of Cybersecurity In Agriculture
An attack has the potential to compromise finances, privacy and food production as well as safety and continuity of business. Planting may be put back, milking interrupted, dispatch halted, livestock records made public or payments to a supplier diverted. Good controls will limit the chance of this happening and the recovery time.
Major Challenges For Australian Agriculture
Between the distances, the extremes of weather, a lack of labour, digital reliance and supply chain complexity, challenges abound. A short outage can run up against a tight operating window and with support hard to come by, a cyber incident is all the more magnified.
Australia’s Plans
At a national level the emphasis is on building resilience in the community, government and critical infrastructure. The message for the farm is to act on what the Australian Cyber Security Centre says: have your backups, use MFA, safeguard operational technology and be quick to report anything serious.
What Is The Biggest Threat?
It varies from farm to farm. Ransomware could be the main risk to one operation, another has more cause to be concerned with invoice fraud, GPS interference or a compromised supplier. But most often the danger is something unrecognised for which there is no fallback that has been tested.
Will Cyber Insurance Fend Off An Attack?
Not at all. While it can pick up the tab for response and recovery costs, it will not put a stop to ransomware or fraud. Think of it as an additional measure to go with network segmentation, training for staff, a solid incident-response plan and the like.
Keeping Things Going
These days cybersecurity is just part of running an Australian farm. You need to protect the data behind your decisions, the systems for operations and the accounts that handle the money. Be in a position to carry on when the cloud software or a supplier link goes down.
In agribusiness the sensible way to deal with cyber risks is to have a plan of recovery that is fit for purpose, to have less blind spots and fewer passwords around, rather than something that is only good for a poster in the office.
