Courtesy NZBusiness magazine

Growing past a handful of staff brings more customers, more systems and more revenue. New research suggests it also makes a business a bigger cyber target.
More New Zealand small businesses feel exposed to cyber-attacks, and those with 20 or more staff are being hit most often, new research shows.
The National Cyber Security Centre’s (NCSC) SME Cyber Security Behaviour Tracker 2026 found that 43 per cent of SMEs now think their organisation is vulnerable to a cyber-attack. That is up from 34 per cent last year.
The concern grows with business size. It rises to 55 per cent of businesses with 6-19 employees and 59 per cent of those with 20-49 employees.
Their worry is backed up by what they experienced. Of businesses with 20-49 employees, 76 per cent had a cyber threat or attack in the six months before the research, compared with 53 per cent of SMEs overall.
Of the medium-sized businesses that were attacked, 44 per cent said the impact was moderate to severe. The harm included financial loss, damaged devices and stress.
AI-enabled threats are now the fourth most top-of-mind cyber threat for businesses. Respondents are increasingly worried about AI-generated scams, deepfakes and more sophisticated attacks.
“AI is making it easier for cyber criminals to carry out attacks, and to increase the effectiveness of those attacks,” says Kevin Moar, NCSC’s Acting Deputy Director-General.
“We’re seeing it used to make scams, phishing attempts and impersonation more sophisticated and convincing, which can make it much harder for people to recognise when something isn’t right.”
Moar says that while criminals’ tools keep changing, the basics of protection stay the same:
• Keep software up to date.
• Use multi-factor authentication.
• Back up important data.
• Make sure staff know how to recognise and respond to threats.
Even as concern grows, the range of protective steps SMEs take has barely changed from last year. Almost one in three (32 per cent) still do nothing to train their staff in cyber security.
“People are one of the strongest defences a business has,” Moar says.
“Small actions taken consistently can make an organisation significantly harder to target.”
The research also found a gap in reporting. Most SMEs that had a cyber threat (68 per cent) reported or disclosed it, but almost a third did not.
Of those that didn’t report, 58 per cent said the incident wasn’t significant enough, and 51 per cent said they didn’t see the point.
Moar said even small incidents help build a clearer picture of the threats facing New Zealand businesses.
“Reporting can help a business understand what has happened, limit further harm and recover. It also gives us a clearer picture of the threats affecting New Zealand, so we can warn and support others.”
The findings come ahead of Cyber Smart Week, which runs from 5 to 11 October. Businesses can register for a free supporter toolkit with practical resources for training staff at ownyouronline.govt.nz/csw.