· By Nicholas “Nick” O'Sullivan, Townsville
Building a security-first network for your business or not-for-profit in 2026
The gap between “someone finds a vulnerability” and “that vulnerability is being exploited at scale” has collapsed. Scanning, credential stuffing and phishing content that used to take real skill and days of effort can now be automated in hours. That changes the calculation for a five-person charity as much as it does for a listed company: security needs to be a day-one decision, not something bolted on after an incident. If you’re in the middle of setting up an organisation, our companion piece on the platform, communications and phone decisions worth making early is a useful place to start alongside this one.
2026 has been a rough year for WordPress specifically, and the scale is worth sitting with. A critical privilege-escalation flaw in the Kirki Freeform Page Builder plugin (CVSS 9.8) has been actively exploited in the wild, handing attackers full administrative control of vulnerable sites. Separately, a vulnerability in the Gravity SMTP plugin has been mass-exploited since May 2026, with Wordfence alone blocking more than 17 million exploit attempts against roughly 100,000 sites, stealing API keys along the way. The widely used Avada Builder plugin (over a million active installs) carried an arbitrary file read and SQL injection flaw disclosed in March 2026. And over one 72-hour window in April 2026, attackers gained push access to 25-plus plugins on the official WordPress.org repository itself, through a mix of purchased developer accounts, credential-stuffed logins and a compromised shared CI provider.
Zoom out and the pattern is structural, not a run of bad luck: security researchers tracked more than 250 new WordPress plugin vulnerability disclosures a week through 2026, with roughly 43% exploitable without any authentication at all, and around 23% still unpatched a full month after disclosure. A website is rarely “just marketing” anymore — a compromised site becomes a phishing launchpad, a malware host, or a stepping stone toward the same Microsoft 365 or Google Workspace credentials your staff reuse elsewhere.
The other major shift is that most real incidents don’t look like a movie hack. They look like a stolen password, no multi-factor authentication, and an AI-drafted phishing email with none of the spelling mistakes that used to be the giveaway. Microsoft has reported that more than 99.9% of compromised Microsoft 365 accounts did not have MFA enabled — the same fragile pattern we see repeatedly in Leadership Technology Reviews: one shared admin login, no break-glass account, and no one entirely sure who could recover access if it went wrong.
This is also where the cost conversation gets real. A full enterprise security stack — next-gen firewall, endpoint detection and response, wireless controllers and SD-WAN, each sold separately with its own annual per-seat or per-appliance licence — can genuinely stack up into the tens of thousands of dollars a year in recurring fees for a mid-sized organisation, on top of the original hardware. That licensing model makes sense for some environments. For a lot of small-to-medium businesses, churches, charities and community organisations, it’s money better spent elsewhere.
Unified platforms are a practical middle ground worth considering. Ubiquiti’s UniFi ecosystem, for example, manages routing, switching, Wi-Fi, access control and cameras from a single console, with hardware paid for once and no mandatory recurring per-device licence stacked on top. That single-pane-of-glass approach also suits how Suburban Secure works day to day — remote visibility and management across a client’s network without needing a site visit for routine changes. It isn’t automatically the right call for every environment (a heavily regulated organisation with specific compliance requirements may still need a dedicated next-gen firewall vendor), which is exactly why this is worth scoping properly rather than defaulting either way.
A security-first mindset in practice is mostly unglamorous habits, done consistently: multi-factor authentication on every account that supports it, a documented break-glass admin account instead of one shared login, automatic updates so your organisation isn’t part of that 23% still unpatched a month after disclosure, backups that have actually been tested by restoring from them, and a plain-English incident plan that doesn’t only exist in one person’s head. The Australian Cyber Security Centre’s Small Business Cyber Security Guide covers the same ground in more depth if you want a structured starting point.
Getting the ABN, platform, communications and phone decisions right — the ground covered in our companion piece on starting a charity or small business in 2026 — is the easy part to get excited about. Building security in from the start is what protects that investment once the organisation is actually running.
A network security review is usually the practical first step: mapping what’s actually on your network today, where the real risk sits, and whether a unified platform like Ubiquiti is a better fit than the licensing stack you’ve inherited.
