New Zealand businesses overestimate their cybersecurity and resilience while many employees lack necessary training and awareness.
The State of Cybersecurity Index 2025 highlights a noticeable gap between leadership confidence and employee readiness.
The survey found that while 71% of security leaders believe employees are knowledgeable about cyber risks, only 51% of employees agree.
Datacom Chief Information Security Officer Collin Penman, pictured above, says the findings should motivate businesses to improve their cyber resilience strategies.
“Some organisations are getting this right, with business continuity and resilience plans in place. But they remain the exception rather than the rule.”
Cyber fatigue also weakens defences. 61% of New Zealand security leaders reported burnout, surpassing Australia’s 58%.
“There is a real risk that businesses are operating with a false sense of security. Leaders believe their teams are ready to tackle threats, but this disconnect is leaving businesses exposed.
“They should leverage technology for growth, but it has to be done safely and responsibly,’ says Penman.
Aotearoa behind Australia in cybersecurity and resilience
The report also highlights a gap between New Zealand and Australia in cybersecurity readiness.
Unlike Australian businesses, Kiwi companies are less likely to have managed security services and employees are less aware of AI security risks.
AI drives opportunity, but security governance must keep pace
AI is transforming businesses, but many do not implement clear frameworks to ensure security and governance keep pace.
“New Zealand cannot afford to fall behind in cyber resilience,” says Penman.
With AI adoption accelerating and cyber threats evolving, cybersecurity is only as strong as the organisation’s weakest link.
To ensure security strategies are effective, companies must embed governance into their security frameworks and equip employees to be cyber resilient.
“Cybersecurity investment supports business continuity, growth and trust. Because preventing a breach is always better than responding to one.”
