New research: most small businesses still don’t feel prepared for a cyber attack
In preparation for Cyber Week 2026 which runs from 5-11th October, The National Cyber Security Centre (NCSC) has just released its 2026 SME Cyber Security Behaviour Tracker, run with research agency TRA. It surveyed 373 small to medium businesses across New Zealand, and the findings are worth a read for any Taupō business owner.
A few things stood out:
- Nearly half of SMEs still don’t feel prepared for a cyber security breach, even though preparedness has crept up slightly since 2022 (42% then, 56% now). Smaller businesses, particularly those with 0 to 5 staff, feel least ready.
- AI-enabled threats are a fast-growing concern, with scams, deepfakes and more sophisticated attacks showing up as a new top-five worry for the first time.
- Bigger SMEs are getting hit harder. Larger businesses (20 to 49 staff) are experiencing more attacks, and the impact is more severe: more lost data, more financial loss, more reputational damage.
- Reporting has stalled. Around a third of businesses that experience an attack still don’t report it, most commonly because they don’t think it’s a big enough issue or don’t know who to contact.
- Motivation, not knowledge, is the real barrier. Businesses generally know what they should be doing (using strong passwords, backing up data, multi-factor authentication) but a third still aren’t investing any time in up-skilling staff.
The takeaway for us locally is simple: cyber security isn’t just an IT problem, it’s a people and habits problem, and it doesn’t discriminate by business size.
Read the full 2026 tracker here: NCSC Cyber Security Behaviour Tracker
If you’d like support getting your team up to speed, this is a great place to start. Keep an eye out too, as we’re looking at running a workshop next year on how to front up to the press if your business ever has a cyber breach.
