In September the National Cyber Security Centre released its Cyber Threat Report 2026, and a few days later its research into how small and medium businesses handle cyber security was reported in NZBusiness. One number stood out. Of businesses with 20 to 49 staff, 76 percent had a cyber threat or attack in the six months before the research, compared with 53 percent of small and medium businesses overall.
That makes sense when you think about it. A growing business has more people, more logins, more suppliers and more money moving around, and it often still runs on the habits it had when it was ten people around one table. The encouraging part is that business owners have noticed: 43 percent now think their organisation could be vulnerable, up from 34 percent a year earlier. Noticing is the first step. Here are the next five.
1. Turn on multi-factor sign-in everywhere that matters
The NCSC's own advice to small businesses starts here, and for good reason. A stolen password on its own should never be enough to get into your email, your accounting system or your bank. Start with email and finance, then work outward. Where your systems support passkeys, they are even easier for staff than a code on a phone.
2. Let updates happen, and know who is checking
Keeping software up to date sounds dull, and that is exactly why it slips. Set computers, phones and your Microsoft 365 environment to update automatically, then make it someone's job to confirm that they actually did. One quiet laptop that has not restarted in three months is all an attacker needs.
3. Prove your backup with a restore
Most businesses have a backup. Far fewer have tried getting something back from it. Pick one important folder this month and restore it somewhere safe. If that goes smoothly, you have real peace of mind. If it does not, you have found the problem on a quiet Tuesday instead of during a crisis. We wrote more about this in One Copy Is Not a Backup.
4. Ten minutes of training beats a fifty-page policy
The research found that almost one in three businesses still do nothing to train their staff. The report also notes that criminals are using AI to make phishing emails and scam messages far more convincing, so the old advice to look for spelling mistakes no longer holds. A short, regular conversation works better than an annual slideshow. Teach one habit above all: if a message asks you to pay something, change bank details or sign in urgently, pause and check with a phone call to a number you already know.
5. Give every new starter a front door and every leaver a locked one
Growth means hiring, and hiring means accounts. Write a one-page checklist for joining (which systems, which access, multi-factor set up on day one) and a matching one for leaving (access removed the same day, shared passwords changed). It is a small piece of admin that closes one of the most common gaps we see in growing teams.
None of these steps need a big budget. They need someone to own them, and a growing business usually has nobody whose job that is yet.
Make it easy to speak up
One last habit costs nothing at all. Make sure your team knows that reporting a suspicious email, or admitting they clicked something they should not have, is always the right call and never gets anyone in trouble. A quick report in the first ten minutes is worth far more than a perfect record.
If you would like a second pair of eyes on any of this, that is what we do every day. Our security assessment checks these basics across your business and gives you a short, plain-English list of what is already in good shape and what to tackle first. Or simply give us a call on 09 974 2379 and talk it through with one of our senior engineers.
