Cyber Security Steps For Small Businesses
Cyber security can sound like a technical problem, but for many businesses it starts with an ordinary email.
Kordia’s 2026 New Zealand Business Cyber Security Report found that 44% of surveyed organisations experienced a successful cyber attack or incident in the past year. Among those affected, email scams were the most common way in, and 61% reported an impact on their business.
The survey covered organisations with 50 or more staff, so these figures are not the rate for all small businesses. The risks, though, are familiar: a convincing email, a stolen password, or sensitive information sent to the wrong place.
How affected businesses said they were compromised
Kordia’s 2026 New Zealand Business Cyber Security Report found that 44% of surveyed organisations experienced a successful cyber attack or incident in the past year. Among those affected, email scams were the most common way in, and 61% reported an impact on their business.
The survey covered organisations with 50 or more staff, so these figures are not the rate for all small businesses. The risks, though, are familiar: a convincing email, a stolen password, or sensitive information sent to the wrong place.
How affected businesses said they were compromised
Percentage of surveyed organisations that experienced an incident. Respondents could select more than one answer.
Four useful steps for any business owner
You do not need to understand every cyber threat to take action. Start with the accounts and information your business relies on most, and ask your IT provider to help check where the gaps are.
Source: Kordia, New Zealand Business Cyber Security Report 2026, pages 2, 5 and 6. www.kordia.co.nz/cyber-security-report-2026
Four useful steps for any business owner
- Turn on two-step verification for email, banking and other important accounts. It adds a second check when someone signs in.
- Check bank account changes by phone using a supplier number you already trust before paying.
- Keep software updated and make sure important files are backed up.
- Set simple rules for AI use so your team knows what client or business information can be entered into AI tools.
You do not need to understand every cyber threat to take action. Start with the accounts and information your business relies on most, and ask your IT provider to help check where the gaps are.
Source: Kordia, New Zealand Business Cyber Security Report 2026, pages 2, 5 and 6. www.kordia.co.nz/cyber-security-report-2026
Other Bulletin Articles
