---
title: Basic Cyber Hygiene Works. Why Are NZ Businesses Still Hit?
description: The NCSC says fundamentals still work. Yet financially motivated attacks rose 18% in NZ. Here's the gap between knowing what to do & consistently doing it.
image: https://blog.nsp.co.nz/hubfs/NZ%20business%20owner%20at%20desk%20looking%20at%20security%20awareness%20training%20on%20laptop%20screen%2c%20representing%20the%20gap%20between%20cyber%20security%20awareness%20and%20consistent%20implementation%20for%20NZ%20SMEs.png
---
[](https://nsp.co.nz/)
- [Home](https://nsp.co.nz/)
- Solution
##### [Cybersecurity](https://nsp.co.nz/cybersecurity/)
- [Incident Response](https://nsp.co.nz/cybersecurity/incident-response/)
- [Penetration testing (pen tests)](https://nsp.co.nz/cybersecurity/penetration-testing/)
- [Security Assessments](https://nsp.co.nz/cybersecurity/cyber-security-assessments/)
- [Secure Email](https://nsp.co.nz/cybersecurity/secure-email-services/)
- [Security Awareness](https://nsp.co.nz/cybersecurity/cyber-security-awareness-training/)
- [Security Operations Centre](https://nsp.co.nz/cybersecurity/security-operations-centre/)
- [VCISO Strategy Services](https://nsp.co.nz/cybersecurity/vciso-strategy-services/)
- [Cyber Insurance Assessments](https://nsp.co.nz/cybersecurity/cyber-insurance-assessments/)
- [Vulnerability Management](https://nsp.co.nz/cybersecurity/vulnerability-management/)
- [Ransomware Protection & Recovery](https://nsp.co.nz/cybersecurity/ransomware-protection-and-recovery/)
- [Tabletop Exercise](https://nsp.co.nz/tabletop-exercise/)
##### [Modern Workplace](https://nsp.co.nz/modern-workplace/)
- [AI Governance & Compliance](https://nsp.co.nz/modern-workplace/ai-governance-compliance/)
- [Remote Workforce](https://nsp.co.nz/modern-workplace/remote-workforce/)
- [Microsoft Co-Pilot](https://nsp.co.nz/modern-workplace/microsoft-365-co-pilot/)
- [Consultation](https://nsp.co.nz/modern-workplace/consultation/)
- [Productivity & Innovation](https://nsp.co.nz/modern-workplace/productivity-and-innovation/)
- [Business Intelligence](https://nsp.co.nz/modern-workplace/business-intelligence/)
- [Security](https://nsp.co.nz/modern-workplace/security/)
##### [Cloud](https://nsp.co.nz/cloud/)
- [Managed Services](https://nsp.co.nz/cloud/managed-services/)
- [Migration](https://nsp.co.nz/cloud/migration/)
- [Storage](https://nsp.co.nz/cloud/storage/)
- [PBX/Voice](https://nsp.co.nz/cloud/pbx-voice/)
- [Security](https://nsp.co.nz/cloud/security/)
##### [Managed Services](https://nsp.co.nz/managed-services/)
- [Managed IT](https://nsp.co.nz/cloud/managed-it/)
- [Helpdesk](https://nsp.co.nz/managed-services/helpdesk/)
- [Business Intelligence](https://nsp.co.nz/managed-services/business-intelligence/)
- [Business Innovation](https://nsp.co.nz/managed-services/business-innovation/)
- [Managed Network](https://nsp.co.nz/managed-services/managed-network/)
##### [Network Performance](https://nsp.co.nz/network-performance/)
- [Firewall as a Service](https://nsp.co.nz/network-performance/firewall-as-a-service/)
- [Network Intelligence](https://nsp.co.nz/network-performance/network-intelligence/)
- [Network Roadmaps](https://nsp.co.nz/network-performance/network-roadmaps/)
##### [Backup](https://nsp.co.nz/backup/)
- [Data Backup](https://nsp.co.nz/backup/data-backup/)
- [Data Consultancy](https://nsp.co.nz/backup/data-consultancy/)
- [Data Retention Solutions](https://nsp.co.nz/backup/data-retention-solutions/)
- [Cloud Storage](https://nsp.co.nz/backup/cloud-storage/)
- [Ransomware Protection & Recovery](https://nsp.co.nz/backup/ransomware-protection-and-recovery/)
##### [Professional Services](https://nsp.co.nz/professional-services/)
- [Services](https://nsp.co.nz/professional-services/services/)
- [Consultancy](https://nsp.co.nz/professional-services/consultancy/)
- [Project Delivery](https://nsp.co.nz/professional-services/project-delivery/)
##### [Cybersecurity](https://nsp.co.nz/cybersecurity/)
- [Incident Response](https://nsp.co.nz/cybersecurity/incident-response/)
- [Penetration testing (pen tests)](https://nsp.co.nz/cybersecurity/penetration-testing/)
- [Security Assessments](https://nsp.co.nz/cybersecurity/cyber-security-assessments/)
- [Secure Email](https://nsp.co.nz/cybersecurity/secure-email-services/)
- [Security Awareness](https://nsp.co.nz/cybersecurity/cyber-security-awareness-training/)
- [Security Operations Centre](https://nsp.co.nz/cybersecurity/security-operations-centre/)
- [VCISO Strategy Services](https://nsp.co.nz/cybersecurity/vciso-strategy-services/)
- [Cyber Insurance Assessments](https://nsp.co.nz/cybersecurity/cyber-insurance-assessments/)
- [Vulnerability Management](https://nsp.co.nz/cybersecurity/vulnerability-management/)
- [Ransomware Protection & Recovery](https://nsp.co.nz/cybersecurity/ransomware-protection-and-recovery/)
- [Tabletop Exercise](https://nsp.co.nz/tabletop-exercise/)
##### [Modern Workplace](https://nsp.co.nz/modern-workplace/)
- [AI Governance & Compliance](https://nsp.co.nz/modern-workplace/ai-governance-compliance/)
- [Remote Workforce](https://nsp.co.nz/modern-workplace/remote-workforce/)
- [Microsoft Co-Pilot](https://nsp.co.nz/modern-workplace/microsoft-365-co-pilot/)
- [Consultation](https://nsp.co.nz/modern-workplace/consultation/)
- [Productivity & Innovation](https://nsp.co.nz/modern-workplace/productivity-and-innovation/)
- [Business Intelligence](https://nsp.co.nz/modern-workplace/business-intelligence/)
- [Security](https://nsp.co.nz/modern-workplace/security/)
##### [Cloud](https://nsp.co.nz/cloud/)
- [Managed Services](https://nsp.co.nz/cloud/managed-services/)
- [Migration](https://nsp.co.nz/cloud/migration/)
- [Storage](https://nsp.co.nz/cloud/storage/)
- [PBX/Voice](https://nsp.co.nz/cloud/pbx-voice/)
- [Security](https://nsp.co.nz/cloud/security/)
##### [Managed Services](https://nsp.co.nz/managed-services/)
- [Managed IT](https://nsp.co.nz/cloud/managed-it/)
- [Helpdesk](https://nsp.co.nz/managed-services/helpdesk/)
- [Business Intelligence](https://nsp.co.nz/managed-services/business-intelligence/)
- [Business Innovation](https://nsp.co.nz/managed-services/business-innovation/)
- [Managed Network](https://nsp.co.nz/managed-services/managed-network/)
##### [Network Performance](https://nsp.co.nz/network-performance/)
- [Firewall as a Service](https://nsp.co.nz/network-performance/firewall-as-a-service/)
- [Network Intelligence](https://nsp.co.nz/network-performance/network-intelligence/)
- [Network Roadmaps](https://nsp.co.nz/network-performance/network-roadmaps/)
##### [Backup](https://nsp.co.nz/backup/)
- [Data Backup](https://nsp.co.nz/backup/data-backup/)
- [Data Consultancy](https://nsp.co.nz/backup/data-consultancy/)
- [Data Retention Solutions](https://nsp.co.nz/backup/data-retention-solutions/)
- [Cloud Storage](https://nsp.co.nz/backup/cloud-storage/)
- [Ransomware Protection & Recovery](https://nsp.co.nz/backup/ransomware-protection-and-recovery/)
##### [Professional Services](https://nsp.co.nz/professional-services/)
- [Services](https://nsp.co.nz/professional-services/services/)
- [Consultancy](https://nsp.co.nz/professional-services/consultancy/)
- [Project Delivery](https://nsp.co.nz/professional-services/project-delivery/)
- [About us](https://nsp.co.nz/about-us/)
- Resources
- [Blog](https://blog.nsp.co.nz/)
- [Webinar](https://nsp.co.nz/webinar/)
- [Blog](https://blog.nsp.co.nz/)
- [Webinar](https://nsp.co.nz/webinar/)
- [Contact us](https://nsp.co.nz/contact-us/)
[0508 010 101](tel:0508%20010%20101)[hello@nsp.co.nz](mailto:hello@nsp.co.nz)
- Home
- Blogs
- Basic Cyber Hygiene Works. Why Are NZ...
### Basic Cyber Hygiene Works. Why Are NZ Businesses Still Hit?
NSP Marketing
18 October 2026
10 min
Read
# The NCSC Says Basic Cyber Hygiene Still Stops Most Attacks. So Why Are NZ Businesses Still Getting Hit?
The NCSC's Cyber Threat Report 2026 contains a finding that should be reassuring and is, in practice, deeply frustrating.
"The agency's assessment is that many common attacks still succeed through weaknesses in basic security rather than highly advanced technical methods."
Translation: most of what's hitting NZ businesses right now doesn't require sophisticated exploitation of unknown vulnerabilities. It doesn't require nation-state resources or elite hacking capability. It succeeds because the fundamentals - MFA, patching, backups, staff training - aren't consistently in place.
The NCSC's Chief Operating Officer Mike Jagusch said it again after the Q1 2026 findings: "For now, the best way to prepare is getting the basic security measures in place."
This is not a new message. The NCSC has been saying it for years. The problem is that it hasn't translated into the behaviour change the data would require. Financially motivated attacks on NZ businesses rose 18% in 2025/26. Four incidents reached C2, Highly Significant classification - as many in one year as in the previous decade combined. Seventy-six percent of NZ businesses with 20 to 49 staff experienced a cyber threat or attack in the six months before the NCSC's most recent SME Behaviour Tracker survey.
The basics work. NZ businesses are still getting hit. Both of these things are true simultaneously.
Understanding why requires looking at the gap between knowing what to do and actually doing it - and doing it consistently, completely, and continuously.
## What "Basic Cyber Hygiene" Actually Means
Before diagnosing why the basics aren't being applied, it's worth being precise about what they are. The NCSC's consistent list is short.
**Multi-factor authentication -** Every account. Not most accounts - every account. The NCSC's own research identifies MFA gaps as a contributing factor in a significant proportion of credential-based incidents. An account without MFA is protected only by a password, and passwords are routinely stolen through phishing, purchased from breach data marketplaces, or guessed through automated attacks.
**Patching on a defined schedule -** Software vulnerabilities are discovered and published constantly. When a patch is released, the window between publication and exploitation by attackers can be measured in days. Unpatched systems are documented, publicly listed weaknesses. The NCSC's post-incident analysis consistently identifies unpatched systems as an entry point.
**Tested, isolated backups -** The distinction matters: backups that run, and backups that have been tested to confirm they can be restored within an acceptable timeframe. Connected backups - those accessible from the same network as the systems they're backing up - are vulnerable to the same ransomware that encrypts the production environment. Isolated, tested backups are the recovery capability that determines whether a ransomware incident is a crisis or an inconvenience.
**Staff training on social engineering -** The NCSC's 2026 report and every preceding annual report identifies phishing and credential harvesting as the most common initial access method. Most successful phishing attacks don't depend on technical sophistication - they depend on a staff member making a decision under time pressure. Training that gives staff the tools to recognise and report suspicious activity addresses the most common attack vector directly.
**Managing privileged access -** Who has administrative access to what systems, and is that access still appropriate? Over-privileged accounts - particularly those belonging to staff who have changed roles or left - are a consistent finding in post-incident analysis.
None of these is technically complex. None requires significant budget. The NCSC's guidance on all five is freely available. And yet.
## The Gap Between Awareness and Consistent Application
The NCSC's SME Cyber Security Behaviour Tracker 2026 reveals the specific nature of the problem.
Fifty-three percent of NZ SMEs experienced a cyber threat in the six months before the research - up from 36% the year before. Forty-three percent now consider their organisation vulnerable to a cyber attack, up from 34% the previous year.
Awareness is rising. The gap is in action.
Thirty-two percent of NZ SMEs still take no action to train or upskill employees in cyber security. That figure has remained broadly unchanged from the previous year's research, despite the increase in incidents and the increase in businesses reporting they feel vulnerable.
The NCSC's analysis is direct: "This perception by some businesses that they are already doing enough is preventing them from implementing some of the most important cyber security practices."
Ninety-four percent of small businesses recognise that cyber security is important. But the recognition of importance and the implementation of specific controls are different things. A business that knows MFA is important but hasn't enforced it universally, that knows patching matters but doesn't have a defined schedule, that knows backups are necessary but hasn't tested a restoration - that business has the awareness without the protection.
This is the comfort gap. And it's specifically what the 2026 data reflects. Businesses feel more aware of the risk than they did. They are not necessarily more protected.
## Why "Having" a Control Is Different From the Control Working
The NCSC's 2026 Cyber Threat Report and the quarterly insights reports document a consistent pattern in post-incident analysis: the controls that should have prevented the attack were present, but not fully implemented, not consistently maintained, or not covering every scenario they needed to cover.
MFA was deployed - but not on every account. Patching was happening - but not on a defined schedule, and not for every system. Backups were running - but hadn't been tested, and were connected to the same network the ransomware encrypted. Staff had received security training - once, at induction, two years ago.
As NSP's CISO Geordie Stewart noted at the IBANZ webinar earlier in 2026: "Having a control isn't the same as having an effective control. That's the most common reason cyber claims fail."
The insurance dimension of this is increasingly concrete. Cyber underwriters are no longer asking whether controls are in place. They're asking whether those controls are working, documented, and maintained. Post-incident forensic investigation routinely reveals the gap between what a business described on its application form and what its environment actually looked like. Claims fail not because businesses lied, but because they assumed that partial implementation was equivalent to full protection.
The NCSC's post-incident guidance makes the same point. The C2-classified incidents in 2025/26 - four in one year, matching the previous decade - were not breaches of impregnable defences. They were breaches where controls that existed were not complete enough to prevent the attacker from achieving their objective.
## The Consistency Problem
Security fundamentals don't work when they're applied to most of the environment. They work when they're applied to all of it.
This is the consistency problem, and it's the specific reason the basics continue to fail despite being well understood.
An MFA policy that covers 95% of accounts leaves 5% of accounts protected only by a password. Those accounts are the ones attackers find. A patching schedule that covers most systems but has exceptions for older or less-critical infrastructure leaves those systems as entry points. A backup process that hasn't been tested since implementation leaves the assumption of recovery intact while the reality is unknown.
The NCSC's quarterly reports are consistent: phishing and credential harvesting remain the most reported incident types, quarter after quarter, year after year. The attack method hasn't changed significantly. What varies is whether the business that was targeted had MFA consistently in place - or whether there was an account, a system, or a process that fell outside the policy.
This is also why configuration drift matters so directly. As we covered in our post on [Microsoft 365 security drift](https://blog.nsp.co.nz/microsoft-365-security-drift-nz-business), a Microsoft 365 environment that was configured securely at a point in time will drift from that configuration as the business changes. New staff join. Applications are connected. Exceptions are made. Permissions accumulate. The environment the security controls were configured for is no longer the environment that exists.
A business that configured MFA universally eighteen months ago and hasn't reviewed whether it's still universally applied may believe it has consistent MFA coverage. Whether it actually does is a different question - and the answer requires someone to check.
## The Monitoring Gap: Why Knowing Isn't Enough
There's a second dimension to why basic controls fail even when they're present: without active monitoring, the gap between a control being in place and a control failing can go undetected indefinitely.
MFA can be present and have exceptions that nobody has reviewed. An account can be compromised and operating silently within the environment for days before anyone notices. A phishing email can capture credentials and those credentials can be used before the alert generated by the unusual sign-in is reviewed.
The NCSC's data on dwell time - the gap between initial access and detection - illustrates this precisely. Fourteen days is the global median. For organisations that only find out through external notification, it's 25 days. In the Mathspace education sector breach, it was five weeks.
The fundamentals reduce the likelihood of initial access. They don't eliminate it. What active monitoring provides is the early detection that limits what an attacker can do during the window between initial access and discovery.
This is specifically why the NCSC's recommendation to get the basics in place is necessary but not complete. The basics work as the first line of defence. They work best when someone is actively watching what those defences are reporting.
Seventy-six percent of NZ mid-sized businesses experienced a cyber threat in the past six months. Forty-four percent of businesses that experienced an attack described the impact as moderate or severe. These are businesses that, in many cases, had some security controls in place. The question the data raises is not whether those businesses cared about security - it's whether anyone was actively watching their environment when the attack was underway.
## What Changes the Outcome
The NCSC's message is consistent and correct: the basics work. The question for NZ businesses is whether the basics are in place, complete, maintained over time, and actively monitored.
**Complete MFA deployment -** Not most accounts. Every account, every application, every administrative system. A review of current MFA coverage - not an assumption - is the starting point. Microsoft Entra ID, as we covered in our post on [what Entra ID is and why it matters](https://blog.nsp.co.nz/what-is-microsoft-entra-id-nz-businesses-guide), is where MFA coverage is configured and where the gaps show up.
**A defined patching schedule with records -** Monthly as a minimum, with critical patches applied faster. Documentation that shows when patches were applied - not just that patching is being done, but evidence that it happened - is what underwriters and the NCSC's post-incident analysis look for.
**Tested, isolated backups -** When was the last restoration test? Does the business know its recovery time objective - how long systems would take to restore? Are backups stored independently of the main network? These are the specific questions that determine whether backup capability is real or assumed.
**Current, specific staff training -** Not a one-time induction session. Ongoing training that reflects the current threat environment - including the social engineering and phishing patterns the NCSC's quarterly reports identify as the most active methods against NZ businesses. Thirty-two percent of NZ SMEs do no security training. For those that do, the question is whether it's current and specific enough to address how attacks are actually arriving.
**Active monitoring of what the controls are reporting -** This is where NSP's [Managed Detection and Response service](https://go.nsp.co.nz/managed-detection-and-response-for-nz-smes) sits in relation to the NCSC's guidance. The NCSC is right that the basics are the foundation. MDR is what ensures someone is actively watching what the foundation is detecting - continuously, after hours, including the days and weeks when an attacker is present but hasn't yet been identified.
The NCSC's Cyber Smart Week 2026 theme is "find a scam before it finds you." For NZ businesses, the equivalent message is: get the basics in place, keep them maintained, and make sure someone is watching what they're reporting.
## Frequently Asked Questions
**What does the NCSC mean by "basic cyber hygiene"?**
The NCSC's consistent list of basic cyber security practices covers MFA on all accounts, patching on a defined schedule, tested and isolated backups, staff training on phishing and social engineering, and management of privileged access. These are the controls the NCSC's post-incident analysis most frequently identifies as absent or incomplete in breached environments.
**If basic hygiene works, why are NZ businesses still being breached?**
The NCSC's SME Behaviour Tracker 2026 identifies the gap: awareness is high, but implementation is incomplete. Thirty-two percent of NZ SMEs do no security training. Controls that are present but not consistently applied leave the gaps attackers find. A business with MFA on most accounts but not all, or backups that haven't been tested, may believe it has adequate protection while having specific exposures that an attacker will identify.
**What is configuration drift and how does it affect basic security controls?**
Configuration drift is the gradual movement of an IT environment away from its intended configuration as the business changes over time. Staff join and leave, applications are added, exceptions are made, and permissions accumulate. A security control that was configured correctly at a point in time may no longer be applied consistently across the current environment. Regular review - not one-time configuration - is what keeps basic controls effective.
**What is the NCSC's SME Cyber Security Behaviour Tracker?**
The Behaviour Tracker is the NCSC's annual research into how NZ SMEs approach cyber security - what controls they have in place, how they respond to incidents, and where the gaps are. The 2026 edition found 53% of NZ SMEs experienced a cyber threat in the six months before the survey, 43% consider themselves vulnerable, and 32% take no action to train staff on cyber security.
**How does active monitoring complement basic security controls?**
Basic security controls reduce the likelihood and impact of initial access. Active monitoring - as provided by Managed Detection and Response - detects when initial access occurs despite those controls and limits what an attacker can do during the dwell period before discovery. The NCSC's data shows the global median dwell time is 14 days. Active monitoring reduces that window significantly, limiting the damage an attacker can cause before being identified and contained.
**What does the NCSC recommend for NZ businesses following the 2026 Cyber Threat Report?**
The NCSC recommends accelerating security updates, strengthening access controls, and preparing for disruption. Specifically: implementing MFA, managing privileged access, protecting network edges, and ensuring staff are trained on recognising and reporting suspicious activity. The 2026 report adds preparation for AI-accelerated threats as an emerging priority alongside these fundamentals.
## Is Your Business Actually Protected?
Knowing the basics matter is not the same as having them consistently in place. A free 30-minute consultation with NSP covers your current security posture - what's deployed, what's drifted, and what's actively monitored - against the controls the NCSC's 2026 data identifies as most consequential.
**[Book your free consultation →](https://go.nsp.co.nz/managed-detection-and-response-for-nz-smes)**
Or call us directly: **0508 010 101**
### Related Reading
- [Financially Motivated Attacks on NZ Businesses Are Up 18%. Here's Where the Money Goes.](https://blog.nsp.co.nz/ncsc-2026-financially-motivated-attacks-nz-businesses)
- [How Long Was Your Business Exposed Before Anyone Noticed?](https://blog.nsp.co.nz/how-long-was-your-business-exposed-breach-detection-nz)
- [Microsoft 365 Security Drift: What NZ Businesses Should Know](https://blog.nsp.co.nz/microsoft-365-security-drift-nz-business)
- [The Security Baseline Every NZ Business Needs Before Buying Cyber Insurance](https://blog.nsp.co.nz/the-security-baseline-every-nz-business-needs-before-buying-cyber-insurance)
- [What Is Microsoft Entra ID and Why Does Every NZ Business Need to Understand It?](https://blog.nsp.co.nz/what-is-microsoft-entra-id-nz-businesses-guide)
- [Your Business Has Cybersecurity Tools. Who Is Actually Watching Them?](https://blog.nsp.co.nz/who-is-watching-your-cybersecurity-nz-mdr)
- [Managed Detection and Response - NSP](https://go.nsp.co.nz/managed-detection-and-response-for-nz-smes)
- [Cybersecurity Assessments - NSP](https://go.nsp.co.nz/cyber-risk-assessment-nz)
[Book a complimentary consultation with our experts](https://go.nsp.co.nz/cyber-risk-assessment-nz)
#### CATEGORY
- [Cybersecurity (101)](https://blog.nsp.co.nz/tag/cybersecurity)
- [Digital transformation (37)](https://blog.nsp.co.nz/tag/digital-transformation)
- [Managed services (33)](https://blog.nsp.co.nz/tag/managed-services)
- [Awareness and education (23)](https://blog.nsp.co.nz/tag/awareness-and-education)
- [Cloud (23)](https://blog.nsp.co.nz/tag/cloud)
- [AI (20)](https://blog.nsp.co.nz/tag/ai)
- [Breach (17)](https://blog.nsp.co.nz/tag/breach)
- [IT Risk (17)](https://blog.nsp.co.nz/tag/it-risk)
- [Managed Detection & Response (MDR) (12)](https://blog.nsp.co.nz/tag/managed-detection-response-mdr)
- [modern workplace (12)](https://blog.nsp.co.nz/tag/modern-workplace)
- [Collaboration (11)](https://blog.nsp.co.nz/tag/collaboration)
- [Cyber Smart Week (11)](https://blog.nsp.co.nz/tag/cyber-smart-week)
- [Business strategy (9)](https://blog.nsp.co.nz/tag/business-strategy)
- [Culture (9)](https://blog.nsp.co.nz/tag/culture)
- [microsoft (9)](https://blog.nsp.co.nz/tag/microsoft)
- [Backup (8)](https://blog.nsp.co.nz/tag/backup)
- [Remote Workers (8)](https://blog.nsp.co.nz/tag/remote-workers)
- [copilot (7)](https://blog.nsp.co.nz/tag/copilot)
- [Cyber Insurance (6)](https://blog.nsp.co.nz/tag/cyber-insurance)
- [Future of work (6)](https://blog.nsp.co.nz/tag/future-of-work)
- [network performance (6)](https://blog.nsp.co.nz/tag/network-performance)
- [Vulnerability Assessment (5)](https://blog.nsp.co.nz/tag/vulnerability-assessment)
- [Microsoft Teams (4)](https://blog.nsp.co.nz/tag/microsoft-teams)
- [vCISO (4)](https://blog.nsp.co.nz/tag/vciso)
- [0365 (3)](https://blog.nsp.co.nz/tag/0365)
- [Governance (3)](https://blog.nsp.co.nz/tag/governance)
- [IT budget (3)](https://blog.nsp.co.nz/tag/it-budget)
- [Legal Industry (3)](https://blog.nsp.co.nz/tag/legal-industry)
- [Best Practice (2)](https://blog.nsp.co.nz/tag/best-practice)
- [Construction Industry (2)](https://blog.nsp.co.nz/tag/construction-industry)
- [Penetration Testing (2)](https://blog.nsp.co.nz/tag/penetration-testing)
- [Tabletop Exercise (2)](https://blog.nsp.co.nz/tag/tabletop-exercise)
- [health IT consultant (2)](https://blog.nsp.co.nz/tag/health-it-consultant)
- [Healthcare (1)](https://blog.nsp.co.nz/tag/healthcare)
see all
#### RECENT POST
[](https://blog.nsp.co.nz/ncsc-2026-basic-cyber-hygiene-nz-businesses-still-getting-hit)
[Basic Cyber Hygiene Works. Why Are NZ Businesses Still Hit?](https://blog.nsp.co.nz/ncsc-2026-basic-cyber-hygiene-nz-businesses-still-getting-hit)
18 Oct 2026
[](https://blog.nsp.co.nz/ncsc-2026-financially-motivated-attacks-nz-businesses)
[Financially Motivated Cyber Attacks on NZ Businesses Up 18% | NSP](https://blog.nsp.co.nz/ncsc-2026-financially-motivated-attacks-nz-businesses)
18 Oct 2026
[](https://blog.nsp.co.nz/identity-security-beyond-mfa-nz-busines)
[Identity Security Beyond MFA | NSP](https://blog.nsp.co.nz/identity-security-beyond-mfa-nz-busines)
27 Sept 2026
[](https://blog.nsp.co.nz/christchurch-construction-engineering-cybersecurity-monitoring-mdr)
[Christchurch Construction Cyber Security: The Monitoring Gap | NSP](https://blog.nsp.co.nz/christchurch-construction-engineering-cybersecurity-monitoring-mdr)
23 Sept 2026
### Let’s stay in touch!
Enter your details below to stay up-to-date with the latest IT solutions and security measures.
[](https://nsp.co.nz/)
A trusted technology partner for NZ SMEs. Building secure, scalable technology solutions for more than 20 years
##### Useful Links
- [About us](https://nsp.co.nz/about-us/)
- [Procurement](https://savvi.net.nz/)
- [Cybersecurity](https://nsp.co.nz/cybersecurity/)
- [Managed Services](https://nsp.co.nz/managed-services/)
- [Cloud](https://nsp.co.nz/cloud/)
- [Contact us](https://nsp.co.nz/contact-us/)
##### Contact
Unit 1, 13 Farnham Street Parnell, Auckland 1052, NZ
- [0508 010 101](tele:0508%20010%20101)
- [info@nsp.co.nz](mailto:info@nsp.co.nz)
-
-
-
Copyright © 2026 NSP - All rights reserved
- [Terms & Conditions](https://blog.nsp.co.nz/hubfs/NSP%20Terms%20and%20conditions/NSP%20Terms%20%26%20Conditions%202021.pdf)
- [Privacy Policy](https://nsp.co.nz/privacy-policy/)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "NSP Marketing",
"url" : "https://blog.nsp.co.nz/author/nsp-marketing"
},
"dateModified" : "2026-10-18T20:25:20.230Z",
"datePublished" : "2026-10-18T20:25:20.000Z",
"headline" : "Basic Cyber Hygiene Works. Why Are NZ Businesses Still Hit?",
"image" : [ "https://blog.nsp.co.nz/hubfs/NZ%20business%20owner%20at%20desk%20looking%20at%20security%20awareness%20training%20on%20laptop%20screen%2c%20representing%20the%20gap%20between%20cyber%20security%20awareness%20and%20consistent%20implementation%20for%20NZ%20SMEs.png" ],
"mainEntityOfPage" : {
"@id" : "https://blog.nsp.co.nz/ncsc-2026-basic-cyber-hygiene-nz-businesses-still-getting-hit",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.nsp.co.nz/hubfs/NSP_Logo_Primary%20logo_CMYK_1.png"
},
"name" : "Network Service Providers Ltd"
}
}
```