More New Zealand small businesses feel exposed to cyber-attacks, and those with 20 or more staff are being hit most often, new research shows.
The National Cyber Security Centre’s (NCSC) SME Cyber Security Behaviour Tracker 2026 found that 43 percent of SMEs now think their organisation is vulnerable to a cyber-attack. That is up from 34 percent last year.
The concern grows with business size. It rises to 55 percent of businesses with 6-19 employees and 59 percent of those with 20-49 employees.
Their worry is backed up by what they experienced. Of businesses with 20-49 employees, 76 percent had a cyber threat or attack in the six months before the research, compared with 53 percent of SMEs overall.
Of the medium-sized businesses that were attacked, 44 percent said the impact was moderate to severe. The harm included financial loss, damaged devices and stress.
AI-enabled threats are now the fourth most top-of-mind cyber threat for businesses. Respondents are increasingly worried about AI-generated scams, deepfakes and more sophisticated attacks.
“AI is making it easier for cyber criminals to carry out attacks, and to increase the effectiveness of those attacks,” says Kevin Moar, NCSC’s Acting Deputy Director-General.
“We’re seeing it used to make scams, phishing attempts and impersonation more sophisticated and convincing, which can make it much harder for people to recognise when something isn’t right.”
Kevin Moar is NCSC’s Acting Deputy Director-General. Photo by Mark Tantrum.
Moar says that while criminals’ tools keep changing, the basics of protection stay the same:
- keep software up to date
- use multi-factor authentication
- back up important data
- make sure staff know how to recognise and respond to threats
Even as concern grows, the range of protective steps SMEs take has barely changed from last year. Almost one in three (32 percent) still do nothing to train their staff in cyber security.
“People are one of the strongest defences a business has,” Moar says.
“Small actions taken consistently can make an organisation significantly harder to target.”
The research also found a gap in reporting. Most SMEs that had a cyber threat (68 percent) reported or disclosed it, but almost a third did not.
Of those that didn’t report, 58 percent said the incident wasn’t significant enough, and 51 percent said they didn’t see the point.
Moar said even small incidents help build a clearer picture of the threats facing New Zealand businesses.
“Reporting can help a business understand what has happened, limit further harm and recover. It also gives us a clearer picture of the threats affecting New Zealand, so we can warn and support others.”
The findings come ahead of Cyber Smart Week, which runs from 5 to 11 October. Businesses can register for a free supporter toolkit with practical resources for training staff at ownyouronline.govt.nz/csw.
