---
title: "53% and Rising: New Zealand SMEs are cybercrime targets"
description: New NCSC survey reveals 53% of NZ SMEs were cyber-attacked in 6 months - up from 36% last year. Get your immediate action plan to protect your business.
image: https://blog.nsp.co.nz/hubfs/Half%20of%20NZ%20SMEs%20have%20been%20victim%20to%20cyber%20attacks.png
---
[](https://nsp.co.nz/)
- [Home](https://nsp.co.nz/)
- Solution
##### [Cybersecurity](https://nsp.co.nz/cybersecurity/)
- [Incident Response](https://nsp.co.nz/cybersecurity/incident-response/)
- [Penetration testing (pen tests)](https://nsp.co.nz/cybersecurity/penetration-testing/)
- [Security Assessments](https://nsp.co.nz/cybersecurity/cyber-security-assessments/)
- [Secure Email](https://nsp.co.nz/cybersecurity/secure-email-services/)
- [Security Awareness](https://nsp.co.nz/cybersecurity/cyber-security-awareness-training/)
- [Security Operations Centre](https://nsp.co.nz/cybersecurity/security-operations-centre/)
- [VCISO Strategy Services](https://nsp.co.nz/cybersecurity/vciso-strategy-services/)
- [Cyber Insurance Assessments](https://nsp.co.nz/cybersecurity/cyber-insurance-assessments/)
- [Vulnerability Management](https://nsp.co.nz/cybersecurity/vulnerability-management/)
- [Ransomware Protection & Recovery](https://nsp.co.nz/cybersecurity/ransomware-protection-and-recovery/)
- [Tabletop Exercise](https://nsp.co.nz/tabletop-exercise/)
##### [Modern Workplace](https://nsp.co.nz/modern-workplace/)
- [AI Governance & Compliance](https://nsp.co.nz/modern-workplace/ai-governance-compliance/)
- [Remote Workforce](https://nsp.co.nz/modern-workplace/remote-workforce/)
- [Microsoft Co-Pilot](https://nsp.co.nz/modern-workplace/microsoft-365-co-pilot/)
- [Consultation](https://nsp.co.nz/modern-workplace/consultation/)
- [Productivity & Innovation](https://nsp.co.nz/modern-workplace/productivity-and-innovation/)
- [Business Intelligence](https://nsp.co.nz/modern-workplace/business-intelligence/)
- [Security](https://nsp.co.nz/modern-workplace/security/)
##### [Cloud](https://nsp.co.nz/cloud/)
- [Managed Services](https://nsp.co.nz/cloud/managed-services/)
- [Migration](https://nsp.co.nz/cloud/migration/)
- [Storage](https://nsp.co.nz/cloud/storage/)
- [PBX/Voice](https://nsp.co.nz/cloud/pbx-voice/)
- [Security](https://nsp.co.nz/cloud/security/)
##### [Managed Services](https://nsp.co.nz/managed-services/)
- [Managed IT](https://nsp.co.nz/cloud/managed-it/)
- [Helpdesk](https://nsp.co.nz/managed-services/helpdesk/)
- [Business Intelligence](https://nsp.co.nz/managed-services/business-intelligence/)
- [Business Innovation](https://nsp.co.nz/managed-services/business-innovation/)
- [Managed Network](https://nsp.co.nz/managed-services/managed-network/)
##### [Network Performance](https://nsp.co.nz/network-performance/)
- [Firewall as a Service](https://nsp.co.nz/network-performance/firewall-as-a-service/)
- [Network Intelligence](https://nsp.co.nz/network-performance/network-intelligence/)
- [Network Roadmaps](https://nsp.co.nz/network-performance/network-roadmaps/)
##### [Backup](https://nsp.co.nz/backup/)
- [Data Backup](https://nsp.co.nz/backup/data-backup/)
- [Data Consultancy](https://nsp.co.nz/backup/data-consultancy/)
- [Data Retention Solutions](https://nsp.co.nz/backup/data-retention-solutions/)
- [Cloud Storage](https://nsp.co.nz/backup/cloud-storage/)
- [Ransomware Protection & Recovery](https://nsp.co.nz/backup/ransomware-protection-and-recovery/)
##### [Professional Services](https://nsp.co.nz/professional-services/)
- [Services](https://nsp.co.nz/professional-services/services/)
- [Consultancy](https://nsp.co.nz/professional-services/consultancy/)
- [Project Delivery](https://nsp.co.nz/professional-services/project-delivery/)
##### [Cybersecurity](https://nsp.co.nz/cybersecurity/)
- [Incident Response](https://nsp.co.nz/cybersecurity/incident-response/)
- [Penetration testing (pen tests)](https://nsp.co.nz/cybersecurity/penetration-testing/)
- [Security Assessments](https://nsp.co.nz/cybersecurity/cyber-security-assessments/)
- [Secure Email](https://nsp.co.nz/cybersecurity/secure-email-services/)
- [Security Awareness](https://nsp.co.nz/cybersecurity/cyber-security-awareness-training/)
- [Security Operations Centre](https://nsp.co.nz/cybersecurity/security-operations-centre/)
- [VCISO Strategy Services](https://nsp.co.nz/cybersecurity/vciso-strategy-services/)
- [Cyber Insurance Assessments](https://nsp.co.nz/cybersecurity/cyber-insurance-assessments/)
- [Vulnerability Management](https://nsp.co.nz/cybersecurity/vulnerability-management/)
- [Ransomware Protection & Recovery](https://nsp.co.nz/cybersecurity/ransomware-protection-and-recovery/)
- [Tabletop Exercise](https://nsp.co.nz/tabletop-exercise/)
##### [Modern Workplace](https://nsp.co.nz/modern-workplace/)
- [AI Governance & Compliance](https://nsp.co.nz/modern-workplace/ai-governance-compliance/)
- [Remote Workforce](https://nsp.co.nz/modern-workplace/remote-workforce/)
- [Microsoft Co-Pilot](https://nsp.co.nz/modern-workplace/microsoft-365-co-pilot/)
- [Consultation](https://nsp.co.nz/modern-workplace/consultation/)
- [Productivity & Innovation](https://nsp.co.nz/modern-workplace/productivity-and-innovation/)
- [Business Intelligence](https://nsp.co.nz/modern-workplace/business-intelligence/)
- [Security](https://nsp.co.nz/modern-workplace/security/)
##### [Cloud](https://nsp.co.nz/cloud/)
- [Managed Services](https://nsp.co.nz/cloud/managed-services/)
- [Migration](https://nsp.co.nz/cloud/migration/)
- [Storage](https://nsp.co.nz/cloud/storage/)
- [PBX/Voice](https://nsp.co.nz/cloud/pbx-voice/)
- [Security](https://nsp.co.nz/cloud/security/)
##### [Managed Services](https://nsp.co.nz/managed-services/)
- [Managed IT](https://nsp.co.nz/cloud/managed-it/)
- [Helpdesk](https://nsp.co.nz/managed-services/helpdesk/)
- [Business Intelligence](https://nsp.co.nz/managed-services/business-intelligence/)
- [Business Innovation](https://nsp.co.nz/managed-services/business-innovation/)
- [Managed Network](https://nsp.co.nz/managed-services/managed-network/)
##### [Network Performance](https://nsp.co.nz/network-performance/)
- [Firewall as a Service](https://nsp.co.nz/network-performance/firewall-as-a-service/)
- [Network Intelligence](https://nsp.co.nz/network-performance/network-intelligence/)
- [Network Roadmaps](https://nsp.co.nz/network-performance/network-roadmaps/)
##### [Backup](https://nsp.co.nz/backup/)
- [Data Backup](https://nsp.co.nz/backup/data-backup/)
- [Data Consultancy](https://nsp.co.nz/backup/data-consultancy/)
- [Data Retention Solutions](https://nsp.co.nz/backup/data-retention-solutions/)
- [Cloud Storage](https://nsp.co.nz/backup/cloud-storage/)
- [Ransomware Protection & Recovery](https://nsp.co.nz/backup/ransomware-protection-and-recovery/)
##### [Professional Services](https://nsp.co.nz/professional-services/)
- [Services](https://nsp.co.nz/professional-services/services/)
- [Consultancy](https://nsp.co.nz/professional-services/consultancy/)
- [Project Delivery](https://nsp.co.nz/professional-services/project-delivery/)
- [About us](https://nsp.co.nz/about-us/)
- Resources
- [Blog](https://blog.nsp.co.nz/)
- [Webinar](https://nsp.co.nz/webinar/)
- [Blog](https://blog.nsp.co.nz/)
- [Webinar](https://nsp.co.nz/webinar/)
- [Contact us](https://nsp.co.nz/contact-us/)
[0508 010 101](tel:0508%20010%20101)[hello@nsp.co.nz](mailto:hello@nsp.co.nz)
- Home
- Blogs
- 53% and Rising: New Zealand SMEs are cybercrime...
### 53% and Rising: New Zealand SMEs are cybercrime targets
Dayna-Jean Broeders
03 September 2025
9 min
Read
# What Do Half of New Zealand's SMEs Have in Common? They've Been Cyber-Attacked.
A new survey from New Zealand's National Cyber Security Centre (NCSC) has revealed that [53% of small-to-medium businesses (SMEs)](https://www.ncsc.govt.nz/news/more-than-half-of-new-zealand-businesses-experiencing-cyber-threats/) have been targeted by **cyber threats in just the past six months**. That's a dramatic rise from 36% a year earlier, confirming what cybersecurity experts have been warning for years: this can happen to anyone.
## **SMEs in New Zealand are prime targets**
The NCSC's Mission Enablement Director Michael Jagusch highlighted a troubling disconnect in the findings. While businesses are "keenly aware of the threat," they don't understand how best to protect themselves. Many believe they're "already doing enough", which is a dangerous misconception that's leaving New Zealand businesses vulnerable. At NSP, we have seen it first hand with our customers, and our concern has grown significantly.
## **Why SMEs have become attractive targets**
Cyberattacks have historically been viewed as "big business problems," but we know this is no longer true, perhaps it never was.
SMEs are increasingly attractive targets because:
- **They hold valuable data** (financial information, customer details, intellectual property) but lack the layered defences of enterprise organisations
- **They're perceived as easier to breach**, with smaller IT teams and limited cybersecurity budgets
- **They provide access to bigger players** through supply chain attacks, one SME's compromise can lead to wider network exposure
- **They often underestimate their risk**, creating security gaps that criminals exploit
## **Social engineering over technical hacking**
Jagusch revealed that most attacks involve social manipulation, not sophisticated hacking:
"*The most common threats reported to us through the research were scam calls and phishing... cyber criminals will normally try to do the least amount of work possible. If I can just ask you for your password and you give it to me, that is far easier than hacking into a system.*"
This aligns with global data from IBM showing that 95% of breaches globally involve some form of human error or social engineering. The NCSC survey confirms phishing and scams remain the dominant attack methods, techniques that require convincing emails, spoofed domains, or phone calls rather than advanced technical skills.
For some of our clients, as recent as this week, social engineering has been the preferred hacking method. This is not just some written scare tactic to our audience, this is very real and we cannot stress enough how urgent it is to action, now.
## **What the survey reveals about NZ's cyber crime**
The survey revealed a critical weakness in New Zealand's SME cybersecurity posture. This false sense of security is one of the biggest threats to SME resilience.
Thinking [cybersecurity](https://nsp.co.nz/cybersecurity/) is "sorted" because you have antivirus software or a firewall is like assuming a lock on the front door protects your whole house, while leaving the windows wide open.
Here are the facts:
- **Threats are accelerating**: A [17% rise in targeting year-on-year](https://www.ncsc.govt.nz/insights-and-research/cyber-security-behavioural-research/cyber-security-behaviour-tracker/) is significant and shows no signs of slowing
- **Phishing dominates**: Low-cost, high-reward attacks remain cybercriminals' favourite weapon
- **SMEs are under-resourced**: Almost half of SMEs still rely on staff without specialist training to handle cybersecurity
- **Critical basics are missing**: Two-factor authentication and data backups are still not universal, despite being low-cost, high-value defences
## **Okay sure, let's play the *devils advocate* - What happens if you do, nothing?**
If we haven't said it enough in this article, New Zealand SME's are certainly a target to cyber criminals. Cyberattacks are no longer just an IT issue, they're a business continuity crisis.
The consequences of a breach extend far beyond the initial attack:
**Immediate impact:**
- **Downtime**: Even short disruptions can cripple productivity and revenue
- **Data loss**: Critical business information may be permanently compromised
- **Operational chaos**: Staff unable to access systems, customers unable to transact
**Long-term consequences:**
- **Reputation damage**: Clients, customers, and partners lose trust quickly and permanently
- **Financial losses**: From ransom payments to legal costs, regulatory fines, and lost sales
- **Regulatory pressure**: Privacy breaches must be disclosed, with compliance implications
- **Competitive disadvantage**: Recovery time allows competitors to gain market share
Inaction is more expensive than action. We always emphasize that businesses should take a proactive stand, rather than reactive.
## **5 Steps SMEs can take today**
The encouraging news is that SMEs don't need enterprise-level budgets to meaningfully improve their [cybersecurity](https://nsp.co.nz/cybersecurity/) posture. Based on the NCSC's recommendations, global best practices and what NSP do on a daily for our customers, here are the critical priorities:
**1. Make Two-Factor Authentication non-negotiable**
As Jagusch emphasized, 2FA is "a relatively simple, but really effective way of adding another layer of protection." Even if passwords are compromised, 2FA prevents unauthorized access. Yet it's still not consistently implemented across New Zealand businesses.
**Action:** Enable 2FA on all business-critical systems today, email, banking, cloud services, and administrative accounts.
**2. Implement regular, and verified backups**
Backups are only useful if they work when you need them. The NCSC identified regular backups as one of the "most impactful steps" businesses can take.
**Action:**
- - Schedule automated daily backups
- Store copies offline or in secure cloud environments
- Test restore procedures monthly
- Ensure backups are isolated from main networks to prevent ransomware encryption
**3. Train staff to recognize social engineering**
Since humans remain the primary attack vector, regular training is essential. This isn't a one-time session, it's an ongoing commitment like workplace health and safety.
**Action:**
- - Conduct monthly phishing simulations
- Train staff to identify red flags in emails, calls, and messages
- Create clear reporting procedures for suspicious communications
**4. Assess security gaps with a structured framework**
Adopt a recognised model like the NIST Cybersecurity Framework to ensure comprehensive coverage across five critical areas: Identify, Protect, Detect, Respond, Recover.
**Action:**
- - Conduct a baseline security assessment
- Identify critical assets and vulnerabilities
- Prioritize improvements based on risk and impact
- Document policies and procedures
**5. Build a culture of cybersecurity**
Cybersecurity cannot live in IT silos, it must be integrated into daily operations and leadership priorities.
** Action:**
- - Include cybersecurity in board and executive discussions
- Establish clear governance and accountability
- Allocate appropriate budget and resources
- Regularly review and update security measures
## Should you seek expert advice?
One of the survey's most concerning insights is that many SMEs still rely on staff without specialist expertise to make cybersecurity decisions. This approach is both risky and unsustainable.
As NSP, we wouldn't perform heart surgery, so why are businesses still expecting their general IT team to handle cybersecurity without specialist support?
Here is what we can do for you:
- [vCISO (Virtual Chief Information Security Officer)](https://nsp.co.nz/cybersecurity/vciso-strategy-services/): Enterprise-grade expertise tailored to SME budgets
- [Managed Detection and Response (MDR)](https://go.nsp.co.nz/managed-detection-and-response-for-nz-smes): 24/7 monitoring and incident response
- [Security assessments](https://nsp.co.nz/cybersecurity/cyber-security-assessments/): Professional evaluation of current defences and risks
- [Staff training programs](https://nsp.co.nz/cybersecurity/cyber-security-awareness-training/): Specialist-designed awareness and response training
## Our challenge to all New Zealand SMEs
With over half of SMEs targeted in just six months, the question isn't if your business will face an attack, it's when. If we have to keep saying it, we will, your business is at risk. [The NCSC survey](https://www.ncsc.govt.nz/assets/insights/Documents/sme-cyber-security-behaviour-tracker-2025.pdf) should is both a reality check and the roadmap for immediate action.
**This requires leadership at every level:**
- **IT Managers** must push for stronger controls and comprehensive training programs.
- **Business Owners** must view cybersecurity as an enabler of trust and business continuity, not just a cost centre.
- **Boards and Executives** must integrate cybersecurity into governance discussions and strategic planning.
## **The competitive advantage of proactive security**
Organizations that act now gain multiple advantages:
- **Protected data and operations**: Reduced risk of costly breaches and downtime
- **Customer trust**: Demonstrated commitment to data protection
- **Competitive positioning**: Resilience becomes a market differentiator
- **Compliance readiness**: Prepared for evolving regulatory requirements
- **Business continuity**: Maintained operations during security incidents
Those who delay face, [inevitable disruption, financial loss, and reputational damage](https://www.stuff.co.nz/business/360812457/more-half-nz-smes-have-experienced-cyber-threats-says-ncsc) when, not if, an attack succeeds.
## **Your next steps: From awareness to action**
The NCSC survey proves that businesses are not too small to be target, and that they are not doing enough. The numbers are very real:
**If more than half of SMEs in New Zealand are being targeted within a six-month window, your business is almost certainly in the crosshairs and you are not. doing. enough.**
**The time for action is now:**
- **Today**: Enable 2FA on critical systems
- **This week**: Test your backup and recovery procedures
- **This month**: Conduct staff phishing simulation training
- **Ongoing**: Treat cybersecurity as a business-critical function, not an IT afterthought
## **Security as a strategic enabler**
Cybersecurity isn't just about defence, it's about resilience, trust, and long-term business success. In an increasingly connected economy, your security posture directly impacts your ability to compete, grow, and serve customers.
The NCSC survey provides both the warning and the roadmap. The question remaining is simple: **Are you ready to act?** Though, we shouldn't be asking this anymore. You have to be ready.
**Need expert guidance?** If you're unsure where your SME stands, professional cybersecurity partners can help. From [security assessments](https://nsp.co.nz/cybersecurity/cyber-security-assessments/) and [staff training](https://nsp.co.nz/cybersecurity/cyber-security-awareness-training/) to [managed detection and response services](https://go.nsp.co.nz/managed-detection-and-response-for-nz-smes), specialized support provides enterprise-grade expertise tailored to SME realities and budgets.
Schedule a session with us to discuss where you are, and where you need to be and if you want to go forward, we will be your technology partner. This is obligation free.
Schedule a session now
#### CATEGORY
- [Cybersecurity (94)](https://blog.nsp.co.nz/tag/cybersecurity)
- [Digital transformation (37)](https://blog.nsp.co.nz/tag/digital-transformation)
- [Managed services (33)](https://blog.nsp.co.nz/tag/managed-services)
- [Awareness and education (23)](https://blog.nsp.co.nz/tag/awareness-and-education)
- [Cloud (23)](https://blog.nsp.co.nz/tag/cloud)
- [AI (20)](https://blog.nsp.co.nz/tag/ai)
- [Breach (17)](https://blog.nsp.co.nz/tag/breach)
- [IT Risk (17)](https://blog.nsp.co.nz/tag/it-risk)
- [modern workplace (12)](https://blog.nsp.co.nz/tag/modern-workplace)
- [Collaboration (11)](https://blog.nsp.co.nz/tag/collaboration)
- [Cyber Smart Week (11)](https://blog.nsp.co.nz/tag/cyber-smart-week)
- [Business strategy (9)](https://blog.nsp.co.nz/tag/business-strategy)
- [Culture (9)](https://blog.nsp.co.nz/tag/culture)
- [microsoft (9)](https://blog.nsp.co.nz/tag/microsoft)
- [Backup (8)](https://blog.nsp.co.nz/tag/backup)
- [Remote Workers (8)](https://blog.nsp.co.nz/tag/remote-workers)
- [copilot (7)](https://blog.nsp.co.nz/tag/copilot)
- [Cyber Insurance (6)](https://blog.nsp.co.nz/tag/cyber-insurance)
- [Future of work (6)](https://blog.nsp.co.nz/tag/future-of-work)
- [Managed Detection & Response (MDR) (6)](https://blog.nsp.co.nz/tag/managed-detection-response-mdr)
- [network performance (6)](https://blog.nsp.co.nz/tag/network-performance)
- [Vulnerability Assessment (5)](https://blog.nsp.co.nz/tag/vulnerability-assessment)
- [Microsoft Teams (4)](https://blog.nsp.co.nz/tag/microsoft-teams)
- [vCISO (4)](https://blog.nsp.co.nz/tag/vciso)
- [0365 (3)](https://blog.nsp.co.nz/tag/0365)
- [Governance (3)](https://blog.nsp.co.nz/tag/governance)
- [IT budget (3)](https://blog.nsp.co.nz/tag/it-budget)
- [Legal Industry (3)](https://blog.nsp.co.nz/tag/legal-industry)
- [Best Practice (2)](https://blog.nsp.co.nz/tag/best-practice)
- [Construction Industry (2)](https://blog.nsp.co.nz/tag/construction-industry)
- [Penetration Testing (2)](https://blog.nsp.co.nz/tag/penetration-testing)
- [Tabletop Exercise (2)](https://blog.nsp.co.nz/tag/tabletop-exercise)
- [health IT consultant (2)](https://blog.nsp.co.nz/tag/health-it-consultant)
- [Healthcare (1)](https://blog.nsp.co.nz/tag/healthcare)
see all
#### RECENT POST
[.webp)](https://blog.nsp.co.nz/nz-cyber-breaches-september-2026-what-to-do-next)
[3 NZ Cyber Breaches in 1 Week: What Every NZ Business Should Do | NSP](https://blog.nsp.co.nz/nz-cyber-breaches-september-2026-what-to-do-next)
14 Sept 2026
[](https://blog.nsp.co.nz/microsoft-365-security-drift-nz-business)
[Microsoft 365 Security Drift: What NZ Businesses Should Know | NS](https://blog.nsp.co.nz/microsoft-365-security-drift-nz-business)
13 Sept 2026
[](https://blog.nsp.co.nz/copilot-data-access-permissions-nz-business)
[What Can Your Staff See? The AI Question for NZ Businesses | NSP](https://blog.nsp.co.nz/copilot-data-access-permissions-nz-business)
08 Sept 2026
[](https://blog.nsp.co.nz/nz-businesses-adopting-ai-before-ready)
[Why NZ Businesses Are Adopting AI Before They're Ready | NSP](https://blog.nsp.co.nz/nz-businesses-adopting-ai-before-ready)
16 Aug 2026
### Let’s stay in touch!
Enter your details below to stay up-to-date with the latest IT solutions and security measures.
[](https://nsp.co.nz/)
A trusted technology partner for NZ SMEs. Building secure, scalable technology solutions for more than 20 years
##### Useful Links
- [About us](https://nsp.co.nz/about-us/)
- [Procurement](https://savvi.net.nz/)
- [Cybersecurity](https://nsp.co.nz/cybersecurity/)
- [Managed Services](https://nsp.co.nz/managed-services/)
- [Cloud](https://nsp.co.nz/cloud/)
- [Contact us](https://nsp.co.nz/contact-us/)
##### Contact
Unit 1, 13 Farnham Street Parnell, Auckland 1052, NZ
- [0508 010 101](tele:0508%20010%20101)
- [info@nsp.co.nz](mailto:info@nsp.co.nz)
-
-
-
Copyright © 2026 NSP - All rights reserved
- [Terms & Conditions](https://blog.nsp.co.nz/hubfs/NSP%20Terms%20and%20conditions/NSP%20Terms%20%26%20Conditions%202021.pdf)
- [Privacy Policy](https://nsp.co.nz/privacy-policy/)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Dayna-Jean Broeders",
"url" : "https://blog.nsp.co.nz/author/dayna-jean-broeders"
},
"dateModified" : "2026-05-11T02:21:39.803Z",
"datePublished" : "2025-09-03T22:10:38.000Z",
"headline" : "53% and Rising: New Zealand SMEs are cybercrime targets",
"image" : [ "https://blog.nsp.co.nz/hubfs/Half%20of%20NZ%20SMEs%20have%20been%20victim%20to%20cyber%20attacks.png" ],
"mainEntityOfPage" : {
"@id" : "https://blog.nsp.co.nz/53-and-rising-new-zealand-smes-are-cybercrime-targets",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.nsp.co.nz/hubfs/NSP_Logo_Primary%20logo_CMYK_1.png"
},
"name" : "Network Service Providers Ltd"
}
}
```