A production manager approving a machine schedule, an accounts officer releasing a supplier payment and a warehouse team receiving stock may all be working in the same ERP platform. That is exactly why ERP cybersecurity trends matter: a connected system improves control, but it also concentrates valuable data, permissions and operational decisions in one place.
For Australian businesses replacing spreadsheets and disconnected applications, cybersecurity cannot be treated as an IT task that happens after implementation. It needs to be designed into the way people access finance, inventory, payroll, production, point of sale and reporting every day. The practical question is not whether a business will face a cyber threat. It is whether its systems, people and recovery processes can limit the impact when one occurs.
ERP cybersecurity trends changing business priorities
The biggest shift is that attackers are increasingly targeting business workflows rather than only servers. A compromised user account can be used to change bank details, approve false invoices, export customer records or alter stock and production data. In a manufacturing, labour-hire or trading business, even a short interruption can affect dispatches, wages, purchasing and customer commitments.
Cloud ERP reduces some traditional infrastructure burdens, but it does not remove responsibility. Businesses still need to manage user access, connected applications, data quality, approval rules and the way staff respond to suspicious activity. The strongest security approach is operationally useful rather than obstructive. If controls make everyday work unnecessarily difficult, people will find workarounds.
Identity security is becoming the primary control point
Passwords alone are no longer enough, particularly where staff use mobiles, shared devices, remote access or multiple cloud applications. Multi-factor authentication is now a baseline, but more organisations are moving towards phishing-resistant methods such as authenticator apps, device-based sign-in and passkeys.
The more important discipline is access design. Each employee should have only the permissions required for their role, with elevated access granted for a defined purpose and removed when it is no longer needed. A store manager may need to approve discounts and see local stock, for example, but should not automatically have access to payroll or supplier banking details.
Role-based access should also reflect operational realities. Seasonal plantation staff, casual hospitality teams, external accountants and maintenance contractors may all need limited, time-bound access. Automated joiner, mover and leaver processes reduce the common risk of former staff or changed roles retaining access longer than intended.
AI is improving detection, while increasing social engineering risk
AI-enabled ERP tools can help businesses identify unusual transactions, forecast demand, interpret operational data and provide faster assistance through voice or chat interfaces. Security teams are applying similar techniques to detect abnormal sign-in behaviour, unexpected data exports and unusual approval patterns.
However, AI is also making phishing more convincing. Fraudulent emails can now be written in clear local language and tailored to a specific finance, procurement or executive role. Attackers may imitate a supplier requesting a bank account change or a manager asking for an urgent payment. Voice cloning adds another concern where voice-based approvals are informal.
The response is not to avoid AI. It is to set clear controls around high-risk actions. Payment detail changes should require independent verification through a known contact method. Material journal adjustments, supplier creation and large inventory write-offs should follow approval workflows. AI-generated recommendations should be reviewed by accountable staff, especially where they affect financial, safety or production decisions.
Segmentation matters as ERP connects to machines
For operationally intensive businesses, an ERP platform may connect to barcode scanners, weighing systems, PLCs, production equipment, time clocks and third-party logistics tools. These connections create useful real-time visibility, but they also extend the security boundary beyond office users and laptops.
A machine network should not have unrestricted access to finance or customer data simply because both systems exchange production information. Network segmentation separates operational technology from business applications and limits how far an incident can spread. Secure APIs, encrypted data transfer and tightly controlled service accounts are equally important when connecting external platforms.
This is particularly relevant for manufacturers and processors. A ransomware event that stops production planning or corrupts batch traceability can be as costly as an outage in the accounting system. Security planning should therefore include plant operations, not just IT assets.
The shift from prevention to recovery readiness
Prevention remains essential, yet no control is perfect. Modern ERP security planning gives equal attention to how quickly the business can identify, contain and recover from an incident.
Reliable backups are part of that plan, but only if they are tested. A backup that cannot be restored within the required timeframe is not a recovery strategy. Businesses should understand which data is backed up, how frequently it is captured, whether copies are protected from deletion or encryption, and how long a full restoration would take.
Recovery also depends on knowing what to do when systems are unavailable. Can warehouse staff continue receiving goods? Can production teams record output safely? Can payroll deadlines still be met? A short, role-specific continuity procedure is often more useful than a lengthy policy nobody has read. Teams should rehearse key scenarios, including a compromised finance account, an unavailable ERP environment and suspicious changes to supplier data.
Data governance is now a cybersecurity issue
ERP systems contain financial records, employee details, customer information, pricing, contracts and operational history. The more data collected, the more carefully it must be governed. Businesses should retain data for legitimate operational, legal and reporting purposes, then dispose of it securely when it is no longer required.
Visibility is just as important as retention. Audit trails should show who changed a purchase order, amended a pay rate, adjusted stock or approved a credit note. These records assist with investigations, but they also help managers resolve everyday exceptions without relying on memory or email chains.
For organisations using analytics platforms, data access needs the same attention as ERP access. A Power BI dashboard may combine sales, margin, labour and customer information into a highly useful view. It can also expose sensitive information widely if workspace permissions are not managed carefully.
Supplier and integration risk needs active management
Most ERP environments rely on more than one provider. There may be payment gateways, e-commerce tools, payroll services, transport platforms, banks, machine interfaces and specialist industry applications. Each integration should be assessed for the data it receives, the permissions it holds and the actions it can perform.
This does not mean rejecting useful integrations. It means connecting them deliberately. Use separate service accounts where possible, avoid sharing administrator credentials, restrict API scopes and review integrations that are no longer in use. When selecting a provider, ask practical questions about access controls, incident response, backup arrangements, data location and support responsibilities.
For small and mid-sized businesses, managed security services can be valuable where there is no large internal security team. The best arrangement is one that provides clear ownership. Your provider should explain what it monitors and manages, while your business remains accountable for approvals, staff behaviour, user access and business continuity decisions.
A practical security plan for a connected ERP
The right priority order depends on the industry, data sensitivity and level of integration. A professional practice handling client records may focus first on identity and document access. A manufacturer with PLC-connected equipment may place greater urgency on network segmentation and operational continuity. Still, most businesses can make meaningful progress by addressing five areas:
- enforce multi-factor authentication and review privileged accounts regularly;
- define role-based permissions and remove access promptly when roles change;
- protect payment, supplier and master-data changes with clear approval and verification steps;
- test backups and practise restoring the processes that keep operations moving; and
- review integrations, API accounts and security responsibilities with every technology provider.
These actions are not glamorous, but they reduce the pathways most often used in business-focused cyber incidents. They also improve day-to-day control by making accountability visible across finance, operations and IT.
OneBusiness approaches cybersecurity as part of a connected operating platform, not as a separate layer added after finance, stock and production workflows are built. When access, audit trails, machine data, analytics and operational approvals are designed together, teams gain better visibility without making the system harder to use.
The most useful security investment is the one that lets people keep working with confidence. Build controls around real decisions, test the moments when operations are under pressure, and make secure behaviour the easiest way to get the job done.
