“We are too small to be worth attacking.” It is the most common sentence we hear from New Zealand business owners — and the country’s own cyber agency has now addressed it directly. In its 2025 Cyber Threat Report, the National Cyber Security Centre writes that many organisations make the mistake of “assuming they are not big enough, wealthy enough or critical enough to be a target.”
What the numbers say
In the 2024/25 year the NCSC received nearly 6,000 incident reports, with $26.9 million in direct financial losses reported — sharply up on the year before — and more than half of small and medium businesses reported experiencing at least one cyber threat during the year. The true numbers are higher: most incidents are never reported.
Why small is now a target
The economics of cybercrime changed. Ransomware and phishing kits are sold as a service now — criminal franchises where the developers take a cut and low-skill affiliates run volume attacks. Attackers do not choose your business; their scanning tools choose whoever left a door open. A five-person firm with exposed remote access is more attractive than a bank with proper defences, because attacks are automated and effort matters more than size. Add business email compromise — quietly redirecting an invoice payment — and a small firm’s $40,000 payment run is a perfectly worthwhile day’s work.
The reassuring part
The same reports carry good news: most successful attacks still get in through basics — unpatched systems, reused passwords, no multi-factor authentication, exposed remote access, backups that were never tested. You do not need an enterprise budget to close those. You need someone to actually do it, verify it, and keep it done.
Find out where you stand in two minutes
Our free Security Health Check asks the twelve questions that matter most — the same fundamentals the NCSC keeps pointing to — with instant, plain-English feedback and no sign-up. If the results raise questions, here is how we handle security for organisations across New Zealand, or book a conversation.
Want this handled properly? Talk to us about Cybersecurity.
