Being small is no protection against a cyber attack
It is a common misconception that cyber attacks are only experienced by large organisations – banks, hospitals and multinational companies – and that small and medium businesses fall outside a threat actor’s radar due to their modest customer bases and smaller digital footprint.
In reality, small and medium-sized businesses are very attractive targets for cyber criminals as they have fewer resources to allocate towards combatting cyber threats. Small and medium businesses are often time-poor, have limited finances to uplift their information technology frameworks, and often rely on third party service providers for their IT needs. The data supports this: according to the National Cyber Security Centre (NCSC) SME Cyber Security Behaviour Tracker 2026, 53% of small and medium businesses in New Zealand who were surveyed, experienced a cyber threat or attack in the six months prior to the research.
The cost of a cyber attack
In McAfee’s Cybersecurity for Small Business Guide, of the surveyed small businesses that experienced a cyberattack, 61% lost more than USD$10,000 dealing with the attack. In 58% of the cases, the company lost more than a week of valuable business time dealing with IT issues due to the attack.
Whilst the average cost of a data breach for small and medium businesses in New Zealand is estimated at $173,000 (NCSC 2024 SME Behaviour Tracker), the true cost of responding to a cyber-attack is likely significantly higher once longer-tail recovery costs and reputational damage are considered.
One incident, multiple consequences
What makes today's cyber environment particularly difficult for small and medium businesses is that incidents rarely stay contained. A single event may begin as a compromised system or fraudulent email, but can often trigger operational disruption, privacy exposures, extortion demands, and legal action. Many of these can take months, and even years, to respond to and hopefully recover from.
Additionally, not every cyber incident starts with a sophisticated attack. Misconfigurations, accidental data exposure and privacy missteps (including issues with website tracking and analytics tools) are a growing source of claims. A business does not need to be deliberately targeted to face a costly incident.
In addition to encrypting systems, instances of threat actors also stealing sensitive data are on the rise, using the threat of public exposure of this data to amplify reputational damage and increase pressure on an SME to pay a ransom demand.
The Marsh Global Cyber Claims Report identifies business interruption as one of the most significant cost drivers in cyber claims, and notes that the most severe outcomes are becoming increasingly costly. For a small business with limited cash flow and internal resources, a multi-layered incident can quickly become an existential problem.
A changing legislative landscape
New Zealand is moving from a largely voluntary, high-trust cyber security model toward a more regulated environment as indicated by the New Zealand Government’s Cyber Security Strategy 2026–2030 and the Cyber Security Action Plan 2026–2027.
This will look to bring New Zealand legislation more in line with other jurisdictions such as Australia, with proposed increases in offences and penalties as well as mandatory cyber security obligations for critical infrastructure.
Prevention on its own is not enough
Multifactor authentication, backups and staff training reduce risk and remain essential components of mitigating cyber risk, but they do not make a business immune to attacks. This is where cyber insurance can play a critical role. Cyber insurance provides an important safety net, and in combination with good cyber hygiene, ensures that a small to medium business has access to specialist resources and financial protection. Cyber insurance can help ensure that when prevention is not enough, a business has the support and financial capacity to recover. Depending on the policy, it can provide access to incident response specialists, legal support, business interruption cover, notification costs and liability protection.
For a small business owner managing multiple functions at once, that support can mean the difference between a well-managed and fast recovery, or a prolonged crisis.
Cyber insurance is not just for large organisations; specific small to medium business policies are now available that better reflect the unique needs and exposures of smaller businesses. As incidents become more complex and the cost of recovery continues to rise, businesses without dedicated cyber insurance cover are often the most exposed.
