Keeping Kiwis safe online: Tackling New Zealand’s email security challenges

New Zealanders are feeling the pain of more frequent and effective cyberattacks. While knowing how to avoid attacks is important, it’s not enough to prevent damage. Consumers, businesses and service providers all need to do more to ensure safe email communications.

Numbers tell the story. According to the National Cyber Security Centre (NCSC), 53% of Aotearoa small-to-medium enterprises (SMEs) experienced a cyber threat between January and June 2025, a significant increase from the 36% reported in 2024. At the same time, the direct financial loss from cyber security incidents reported to the NCSC reached $26.9 million in 2024/25, up from $21.6 million the previous year.

Many of those losses originated with emails. Phishing campaigns continue to be highly effective because they target people rather than technology. Attackers use fraudulent emails to steal credentials, deliver malware, compromise business email accounts and trick employees into transferring money or sensitive information.

The challenge is becoming even greater as cybercriminals adopt artificial intelligence (AI). Generative AI allows attackers to create highly convincing phishing emails with flawless grammar, realistic branding and personalised content at scale. The result is a new generation of scams that are increasingly difficult to distinguish from legitimate communications.

Education remains an important part of cybersecurity. People who understand common threats are more likely to identify suspicious activity and avoid risky behaviour.

The NCSC's Cyber Security Consumer Behaviour Tracker shows that awareness of cyber threats remains relatively high in Aotearoa. However, awareness of scams varies by age group, with older participants generally demonstrating higher awareness of many scam types.

But awareness alone is not preventing losses from increasing. Businesses continue to suffer greater financial damage from cyber incidents year after year. Why? Because modern attacks are designed to bypass human judgement. AI-generated phishing emails, business email compromise (BEC) attacks and sophisticated social engineering techniques can deceive even experienced users. Education reduces risk, but it cannot eliminate it.

Organisations and individuals need multiple layers of protection that combine people, processes and technology.

For individual consumers, two practices provide some of the strongest protection against email-based attacks.

Enable multi-factor authentication

Multi-factor authentication (MFA) adds an additional verification step when logging into online accounts. Even if attackers steal a password through a phishing email, MFA can prevent them from accessing the account.

Consumers should enable MFA on email accounts, banking services, social media platforms and any other service that supports it. According to the NCSC Cyber Security Consumer Behaviour Tracker, Kiwis have some room for improvement. Only 42% use MFA for their email accounts, and only 47% protect their email accounts with unique passwords.

Stay alert to phishing attempts

Phishing awareness remains essential. Users should be cautious when opening unexpected emails, clicking links or downloading attachments. Common warning signs include urgent requests, unusual payment instructions, suspicious links and messages that attempt to create panic or pressure.

When in doubt, verify requests through a separate communication channel before acting.

Businesses need a more comprehensive approach that combines technology with employee education.

Deploy integrated cyber protection

Email security should not operate in isolation. Organisations benefit from an integrated cyber security platform that combines email protection with broader cyber security capabilities so security teams can detect, prevent and respond to threats more effectively.

Acronis Cyber Platform for Business delivers integrated cyber protection capabilities, including email security and email archiving, enabling organisations to protect communications, retain business records and simplify compliance requirements within a unified platform.

By reducing the number of disconnected tools that security teams must manage, businesses can improve visibility and strengthen their overall security posture.

Invest in effective security awareness training

Employees remain a critical line of defence against phishing attacks.

Regular security awareness training helps staff recognise evolving threats, understand safe online practices and respond appropriately when suspicious activity occurs. Effective programmes go beyond annual compliance exercises by providing ongoing education that reflects current attack techniques.

Acronis Security Awareness Training helps organisations build cyber resilience by delivering practical, engaging training that prepares employees to identify and respond to real-world threats.

Managed service providers (MSPs) can play a vital role in protecting both businesses and consumers across New Zealand.

Strengthen email security for clients

MSPs can help clients reduce risk by deploying advanced email security solutions that block phishing attempts, malware and business email compromise attacks before they reach end users.

Because email is often the first step in a cyberattack, strengthening this layer of defence protects organisations and the customers they serve.

Acronis Email Security provides MSPs with advanced protection capabilities designed to defend clients against modern email threats while simplifying management across multiple customer environments.

Reduce tool sprawl with an integrated platform

Many MSPs face operational challenges caused by managing multiple disconnected security tools.

An integrated platform that includes email security alongside backup, endpoint protection, disaster recovery and management capabilities can reduce complexity, improve efficiency and provide better visibility across customer environments.

Acronis Cyber Platform for MSPs helps service providers consolidate cyber protection services within a single platform, reducing operational overhead while strengthening security outcomes for clients.

Rising attack volumes, increasing financial losses and the growing use of AI by cybercriminals mean that organisations in New Zealand can no longer rely on awareness alone to protect their email communications.

Consumers need strong account security and phishing awareness. Businesses need integrated cyber protection and ongoing employee training. MSPs need modern email security and streamlined platforms that help them protect customers efficiently.

By combining education with robust technology and proactive security practices, organisations across Aotearoa can build stronger resilience against the email-based threats that continue to drive cybercrime today.