The Problem Wasn't Knowledge. Nobody Was Watching.

One in three small businesses in New Zealand was hit by a cyber attack in the last six months. Most of them already knew what they were supposed to do.

Backups. Updates. Multi-factor authentication. Staff training. The knowledge wasn't the problem.

The problem was that nobody was watching.

Security fails in the gaps, not the plan

A backup configured once and then forgotten. Software updates quietly disabled on one laptop — and unnoticed for a month. Staff trained a year ago, a third of them since replaced by people who never sat through it.

None of these are knowledge failures. They are attention failures. Security isn't a thing you set up; it's a thing you maintain. The moment it becomes "configured and forgotten," it has already started to decay.

Why small business became the primary target

Attackers have worked out that small businesses hold valuable data and rarely have anyone watching it full-time. Large enterprises have security teams. A 15-person firm usually has a backup that someone set up two years ago and an assumption that it's still working. That gap is exactly what's being exploited — and it's why small business, not big enterprise, is now the main target.

What actually protects a business

Not a one-time configuration. An ongoing managed process: continuous monitoring, scheduled checks, and staff training built in from day one rather than done once and forgotten. The difference between a business that gets breached and one that doesn't is rarely the tools they own — it's whether someone is actually watching them.

Why we focus on construction, engineering and infrastructure

We specialise in construction, engineering and infrastructure businesses because we come from that world. Remote sites, field crews, project documentation that has to be accessible from anywhere. Generic IT support doesn't understand that operational reality — the site office with patchy connectivity, the crew that needs the latest drawing at 7am, the subcontractor who needs access for six weeks and then shouldn't. We do.

A straightforward conversation

If any of this sounds uncomfortably familiar — a backup you haven't checked, a team that's changed since the last training, updates you assume are running — it's worth having a look before something forces the issue.

Free 30-minute IT security audit. No sales pitch, just a clear picture of where your business stands. bses.co.nz