Cyber security in New Zealand

Cyber Security New Zealand: What SMBs Need and What It Costs

Cyber security for a New Zealand small or mid-sized business is a short list of controls done properly: hardened identities and devices, monitoring that someone actually reviews, a tested way back from an incident, and the evidence to prove it to an insurer, a client or a board.

This page explains what that means in practice, how New Zealand regulation and certification fit in, how to choose a provider, and what it costs. The prices are ours and are published. OxygenIT has worked with New Zealand businesses since 2005 and is certified to ISO 27001 and ISO 42001.

Book the 15-Minute Founder Call

Or call 0800 242 206

What does cyber security mean for a New Zealand business?

For a New Zealand business of 20 to 200 staff, cyber security means reducing the chance that an attacker gets in, noticing quickly when one does, and being able to recover and prove what happened. It is a set of controls and habits, not a single product.

Most of the work is unglamorous: multi-factor authentication switched on everywhere it should be, devices patched, email filtered, backups that restore, staff who recognise a fake invoice, and nobody outside the business holding admin rights they should not have. Those are the same small, overlooked settings a cyber security audit usually finds.

The specialist layers, penetration testing, a security operations centre and a formal framework such as SMB1001 or ISO 27001, sit on top of that base. They are worth paying for once the basics are in place, and rarely before.

What are the real threats facing New Zealand SMBs?

The threats that reach New Zealand SMBs most often start with people and passwords rather than exotic hacking: phishing emails, fake invoices, stolen or reused passwords, and ransomware that arrives through one of those doors.

Phishing and fake invoices. Convincing emails, fake invoices and malware attachments designed to slip past weak filters. One wrong click from a careful staff member is enough.
Leaked and reused passwords. A staff password exposed in a third-party breach can end up for sale and be tried against Microsoft 365 accounts. A one-off breach check is a snapshot, not monitoring.
Ransomware on everyday devices. Laptops, desktops and servers are the entry point. An outdated workstation can be enough to stop a business working.
Human error. Attackers rely on urgency and curiosity. Training turns staff from the weak point into the first line of defence.

Most businesses learn about a breach late, from a client or the bank rather than from their own systems. The controls below exist to change that.

The national figures back this up. Between April and June 2026 the National Cyber Security Centre (NCSC) responded to 1,129 incident reports, with $2.7 million in reported direct financial loss. Scams and fraud was the most common category, with 348 incidents, and unauthorised access accounted for $1.3 million of the loss, roughly half of it. The NCSC’s survey of small and medium businesses found that 76% of businesses with 20 to 49 employees had experienced a cyber threat or attack in the previous six months, against 53% of SMEs overall.

Sources: NCSC, Quarter Two Cyber Security Insights 2026; NCSC, SME Cyber Security Behaviour Tracker 2026.

What does a cyber security programme actually include?

A working cyber security programme has four parts: prevention and hardening, monitoring and detection, response and recovery, and governance and evidence. Missing any one of them leaves a gap the others cannot cover.

Prevention and hardening

Identity management and multi-factor authentication, firewall configuration, email filtering, patching and endpoint protection. This is where most risk is removed, and where a vulnerability assessment tells you what is still open.

Monitoring and detection

Endpoint detection and response (EDR) and, for businesses that need it, a security operations centre (SOC) watching for unusual behaviour, with alerts reviewed by security specialists. See SOC as a service and managed EDR for NZ SMBs.

Response and recovery

Isolating an affected device quickly, then getting back to work from backups that have been tested. A backup that has never been restored is a hope, not a plan.

Governance and evidence

Policies, a framework such as SMB1001 or ISO 27001, and a document you can hand to a board, an insurer or an auditor. A cyber security audit maps your gaps against a framework and ranks them by exposure.

Testing sits across all four. A penetration test checks whether the controls hold up when someone actually tries to get past them, and most businesses should test at least annually and after major changes.

How do New Zealand regulation and certification fit in?

In New Zealand the legal baseline is the Privacy Act 2020, which includes mandatory notification of serious privacy breaches. Certification such as SMB1001 or ISO 27001 is voluntary, but insurers, larger customers and boards increasingly ask for it as proof.

Privacy Act 2020. Sets how personal information must be protected and when a breach must be notified. The 2025 amendment added IPP 3A, covered in our IPP 3A guide.
NCSC guidance. The National Cyber Security Centre publishes free guidance for New Zealand organisations and is a sensible first reference for any business.
SMB1001. A five tier cyber security standard developed by Dynamic Standards International and certified through the CyberCert platform, built for New Zealand and Australian small and medium businesses and attested annually by a company director. Gold is the level most businesses target when a cyber insurer or a larger customer wants proof. More in our SMB1001 Gold guide and the NZ cyber framework comparison.
ISO 27001. The international standard for information security management. Heavier and more formal, typically suited to larger practices or those serving enterprise and government clients.
ISO 42001. The international standard for AI management systems, relevant once staff use AI tools with business data.
Cyber insurance. Insurers ask detailed questions about controls before they quote or renew. See cyber insurance requirements in NZ and what underwriters ask.

OxygenIT itself is certified to ISO 27001 and ISO 42001, both independently audited. We also work with clients on NIST, the Essential Eight and CIS Controls.

How do you choose a cyber security provider in New Zealand?

Choose a New Zealand cyber security provider on evidence you can check in writing: a recognised framework the provider holds for itself, a current professional indemnity insurance certificate, the named certifications of the engineers who will touch your systems, and published response times and prices.

A provider that answers with reassurance instead of a document is telling you something. Ask which framework they hold for themselves, not only which ones they can help you get. Our licensing, insurance and credentials page works through the same checks for OxygenIT as a worked example, and the guide to individual cyber security certifications explains what engineer-level credentials such as CISSP and CISA mean.

Questions to ask on the first call

Which security framework do you hold yourselves? Ask to see the certificate.
What are your response and resolution times, by priority? Response and resolution are two different promises. Ask for both.
When are you staffed, and what happens outside those hours? A straight answer here tells you a lot.
What security is inside the monthly fee? EDR, MFA management, email filtering, backup restore testing and awareness training should be itemised.
Who owns the documentation, and how do we leave? Term, notice, and whether exit is fee-free at a named point.

Ask every provider you are talking to, including us, for the same answers in writing.

What does cyber security cost for a New Zealand SMB?

At OxygenIT, a one-off cyber security audit costs $4,500 to $10,000, a vulnerability assessment about $1,500 per 10 staff, and ongoing managed security starts with the Managed IT Support band from $1,200 a month for a team of up to ten. All prices are NZD excluding GST.

Published OxygenIT cyber security prices
Service	Price and what it buys
Cyber security audit	$4,500 to $10,000 per audit The advisory review: gaps mapped against a framework, ranked by exposure, with a remediation proposal. Remediation is quoted separately.
Vulnerability assessment	about $1,500 per 10 staff The technical testing: a vulnerability scan, a penetration test component and an IT review. A 30-user business lands at about $4,500.
SMB1001 certification, Bronze	from $525 a month The baseline controls SMB1001 requires. Price shown is for a 10 user business.
SMB1001 certification, Gold	from $1,425 a month The level most businesses target for an insurer or larger customer. Price shown is for a 10 user business.
Managed IT Support	from $1,200 a month For a team of up to ten. The first band that includes managed EDR, MFA enforcement, email filtering and security awareness training.
Fully Managed IT	from $3,600 a month For a team of up to ten. Adds advanced security operations such as SOC monitoring or MDR, and compliance and governance work.

NZD excluding GST. Managed IT bands are priced by team size on a 36 month term, and a team smaller than ten is priced as ten. The first 90 days are money back, no reason required, and there is a fee-free break at nine months on 90 days notice. Every band and team size is on the pricing page and managed IT services pricing.

More detail: what a cyber security audit costs, what a vulnerability assessment costs and what SMB1001 certification costs.

Cyber security New Zealand: frequently asked questions

What is the first cyber security step for a New Zealand SMB?

Find out where you are exposed before buying anything. A cyber security audit maps your gaps against a framework and ranks them by exposure, so the money goes on the risks that matter. At OxygenIT an audit costs $4,500 to $10,000, and remediation is quoted separately once you know what needs fixing.

How much does cyber security cost for a small business in NZ?

At OxygenIT, a cyber security audit is $4,500 to $10,000 and a vulnerability assessment is about $1,500 per 10 staff. Ongoing managed security starts with Managed IT Support, from $1,200 a month for up to ten users, which includes managed EDR, MFA enforcement, email filtering and awareness training. NZD excluding GST.

What is the difference between a vulnerability assessment and a penetration test?

A vulnerability assessment scans your network, endpoints and cloud for known weaknesses and gives you a prioritised fix list. A penetration test goes further, with a person actively trying to exploit weaknesses to see whether your controls hold. Our vulnerability assessment includes a penetration test component alongside the scan and an IT review.

Do New Zealand businesses have to be certified for cyber security?

No law requires a New Zealand SMB to hold a cyber security certification, but the Privacy Act 2020 requires personal information to be protected and serious breaches to be notified. Certification such as SMB1001 is voluntary, and is increasingly how insurers, banks and larger customers ask a business to prove its security posture.

Is SMB1001 or ISO 27001 better for a New Zealand SMB?

For most New Zealand SMBs, SMB1001 is the practical choice: a five tier standard built for New Zealand and Australian small and medium businesses, attested annually by a director. ISO 27001 is heavier and more formal, and typically suits larger practices or those serving enterprise and government clients. OxygenIT holds ISO 27001 itself.

How often should a New Zealand business have a penetration test?

Most businesses should complete penetration testing at least once a year. Test again after major system changes, a new cloud deployment, or when a compliance framework or insurer requires it. Regular testing finds new weaknesses before attackers do, and gives you dated evidence to show a board or an insurer.

Does OxygenIT provide cyber security outside Christchurch?

Yes. OxygenIT is based in Christchurch and works with New Zealand businesses of 20 to 200 staff. Our cyber security services are delivered remotely, so a business anywhere in New Zealand gets the same service as one in Christchurch. The first step is the same everywhere: a 15-minute call with Tim.

Talk to OxygenIT about your cyber security position

Fifteen minutes with Tim is the way in. If it looks like a fit, a 45-minute discovery call follows, then the scoping work that produces your quote. All three are free. If we are not the right fit, we will say so on the call.