The National Cyber Security Centre (NCSC) has released its latest research on how New Zealand businesses are coping with cyber risk, and one group stands out: medium-sized businesses.
Awareness is going up. Unfortunately, so is the number of businesses that feel exposed.
Mid-sized businesses are being hit hardest
According to the NCSC’s 2026 SME Cyber Security Behaviour Tracker, businesses with 20 to 49 staff reported far more threats and attacks than smaller firms. More than three quarters had some kind of cyber incident in the six months before the research.
That doesn’t surprise me. It’s the size where a business leans heavily on its systems, holds valuable data, uses plenty of cloud services and often has people working from all over the place, but usually doesn’t have a dedicated security team. That’s a very attractive combination for a criminal.
AI is making the scams better
The research also shows businesses are increasingly worried about AI-powered attacks: AI-written scams, impersonation, deepfakes and very convincing phishing emails. The days of spotting a scam by its dodgy spelling are pretty much over. Today’s messages can look professional, personal and completely believable.
People still matter most
Here’s the number that jumped out at me: almost one in three SMEs still give their staff no cyber security training at all.
Most businesses get the need for antivirus, backups and multi-factor authentication. But a lot of incidents still start with a person clicking a link, approving a sign-in request or replying to something that looks genuine. Training isn’t about turning your team into security experts. It’s about helping them notice when something doesn’t feel right, and knowing what to do about it.
The basics still work
For all the change, the NCSC keeps coming back to the same fundamentals:
- keep software up to date
- use multi-factor authentication
- back up your important data
- train your staff
- have a clear way to report incidents
Not exciting, I know. But they’re still some of the best ways to cut your risk, and they sit at the heart of how we look after our clients’ cyber security. Most of the time resilience comes from doing the basics well and consistently, not from buying the latest shiny product.
There’s no finish line
The other thing this research reinforces is that security is never “done”. New vulnerabilities turn up all the time. Your systems change. People join and leave. Attackers change their tactics. A setup that was fine two years ago may not cover you today.
That’s why more businesses are moving to regular reviews and continuous monitoring instead of a one-off project or an annual audit. Security has become part of running the business, not something you tick off once.
We see it with the businesses we look after. Our KARE framework gives them a solid base (identity protection, device security, email security, compliance controls, monitoring and risk management), but the aim is never just to keep things as they are. The businesses that cope best are the ones that keep reviewing, keep tightening things up and keep adapting as the risks change.
Curious how your business stacks up against the NCSC basics? Book a free health check, or call us on 0800 688 768.