CERT NZ's 2025 data shows significant growth in cyber incidents affecting NZ businesses — with AI-assisted phishing, ransomware against SMBs, and supply chain attacks all increasing. Here's a summary of the threat landscape affecting NZ businesses right now.
CERT NZ's quarterly and annual reporting provides the most accurate picture of the cyber threat landscape affecting New Zealand businesses and individuals. 2025 has seen several notable trends — some continuing the trajectory of prior years, some representing new escalations. Here's a summary of what the data shows and what it means for NZ SMBs.
Phishing: Volume Up, Quality Up
Phishing remains the highest-volume incident category reported to CERT NZ, and 2025 has seen both volume and sophistication increase. AI-assisted phishing content — grammatically correct, personalised, contextually relevant — has made the traditional "look for spelling mistakes" advice obsolete. Phishing simulations run by Optimyze for managed clients show increased initial click rates on AI-generated phishing content compared to traditional template phishing, with experienced staff increasingly vulnerable to well-personalised approaches.
The targets of phishing have also shifted — away from generic credential harvest pages toward business process targeting: payments, account changes, and software updates. The financial motivation has always been there; the tactics have become more sophisticated in exploiting business processes specifically.
Ransomware: SMBs in the Crosshairs
The ransomware ecosystem has evolved in a direction that significantly affects NZ SMBs. "Ransomware-as-a-Service" (RaaS) models have proliferated — criminal groups develop the ransomware and lease it to "affiliates" who handle the targeting and deployment, splitting the ransom proceeds. This model has dramatically lowered the technical barrier to running ransomware attacks, increasing the volume of attacks against smaller targets that wouldn't previously have been worth sophisticated attackers' time.
Double extortion — encrypting files AND exfiltrating data before encryption, threatening to publish it if ransom isn't paid — is now standard practice for most active ransomware groups. This changes the calculus for backup-as-recovery: restoring from backup resolves the encryption, but doesn't prevent publication of already-exfiltrated data.
Business Email Compromise: Highest Financial Losses
BEC — including invoice fraud, CEO fraud, and vendor impersonation — continues to generate the highest total financial losses in CERT NZ reporting, despite lower incident volumes than phishing. Average losses per BEC incident are substantially higher than phishing because the target is financial transfer rather than credential harvest. AI-assisted BEC — using personalised, contextually sophisticated emails — is accelerating this trend.
Supply Chain: Increasing Vector
Supply chain attacks — compromising software or service providers to reach their customers — increased in frequency in 2025. For NZ businesses, the most relevant supply chain risks are: compromised practice management software (accounting, legal), compromised MSP management tools (attacks specifically targeting MSPs to reach their clients), and malicious code injected into legitimate software updates.
What This Means for NZ SMB Security in 2026
The threat trajectory points to: increasing importance of MFA (the single control that stops most automated attacks), increasing need for behavioural EDR (as malware increasingly uses legitimate tools rather than new files), and increasing value of monitoring (as attacks are more likely to succeed despite controls, making detection and response speed critical). The businesses that manage these risks best in 2026 are the ones that have addressed all three dimensions — prevention, detection, and response — rather than treating security as a single product or checkbox.
The 2025 threat landscape isn't fundamentally different in kind from prior years — the same attack categories dominate. What's changed is scale, sophistication, and the degree to which automation and AI have lowered the cost of attacks. The response is the same: layered controls, properly deployed and actively monitored.
