21 September 2026
New Zealand businesses are feeling increasingly exposed to cyber attacks, with new research revealing more medium-sized organisations are experiencing attacks, with more damaging consequences.
The SME Cyber Security Behaviour Tracker 2026 from the National Cyber Security Centre (NCSC) found nearly half (43%) of SMEs now believe their organisation is vulnerable to a cyber attack, up significantly from 34% last year. Vulnerability rises further among larger SMEs, reaching over half (55%) of businesses with 6-19 employees and 59% of those with 20-49 employees.
More medium-sized organisations are also being hit. More than three-quarters (76%) of businesses with 20-49 employees experienced a cyber threat or attack in the six months prior to the research, compared with 53% of SMEs overall.
Of medium sized businesses who experienced a cyber attack, 44% said the impact was moderate to severe (impacts included financial loss, damage to devices and stress). AI-enabled threats have emerged as a new area of concern for businesses, now ranking as the fourth most top-of-mind cyber threat. The research points to growing nervousness about AI-generated scams, deepfakes and increasingly sophisticated cyber attacks.
NCSC’s Acting Deputy Director-General, Kevin Moar: “AI is making it easier for cyber criminals to carry out attacks, and to increase the effectiveness of those attacks. We’re seeing it used to make scams, phishing attempts and impersonation more sophisticated and convincing, which can make it much harder for people to recognise when something isn’t right. The technology used by criminals continue to evolve, but the fundamentals of good cyber security do not. Keeping software up to date, using multi-factor authentication, backing up important data and making sure staff know how to recognise and respond to threats can significantly reduce an organisation’s vulnerability.”
The range of preventative actions carried out by SMEs has remained broadly stable year on year. Almost one in three SMEs (32%) are still taking no action to upskill or train their staff in cyber security.
The findings are being released ahead of Cyber Smart Week, which runs from 5–11 October 2026, with NCSC encouraging businesses to turn awareness of cyber risk into practical action.
“Cyber security is everyone’s responsibility, and people are one of the strongest defences a business has. Giving staff the skills to recognise suspicious activity, question something that doesn’t look right and know what to do when an incident happens can make a meaningful difference. Cyber Smart Week is a chance for businesses to make those conversations part of everyday work. Small actions taken consistently can make an organisation significantly harder to target”, says Moar.
The research also found a gap in reporting threats. While majority (68%) of SMEs that experienced a cyber threat reported or disclosed it, almost a third did not. Of those that did not report an incident, more than half (58%) said it was not significant enough to report, and half (51%) said they did not see the point.
Moar adds that “even seemingly minor incidents can help build a clearer picture of the threats facing New Zealand businesses. We receive reports of all sizes, from phishing attempts through to major breaches. Reporting can help a business understand what has happened, limit further harm and recover. It also gives us a clearer picture of the threats affecting New Zealand, so we can warn and support others.”
Businesses can take part in Cyber Smart Week by registering for a free supporter toolkit, which includes practical resources to help organisations upskill their people and strengthen everyday cyber security habits.
For more information and to sign up, visit Own Your Online.
Register to be a Cyber Smart Week supporter External Link
Read the full research