New Zealand's National Cyber Security Centre recorded 7,122 cyber security incidents in the year to 30 June 2024, including 343 incidents with the potential for high national impact. Lower-severity incidents affected individuals and small-to-medium businesses, with reported losses reaching $21.6 million in 2023/24, according to the NCSC annual report.
That changes the opening question. What is cybersecurity? It isn't mainly about stopping a movie-style hacker in a dark room. For a New Zealand SaaS founder, it's about keeping customer data private, accounts under control, payments accurate, and the product available when customers need it.
A company can have smart engineers, a tidy cloud setup, and still lose control because someone clicks a convincing sign-in link or forgets to remove an ex-contractor's access. The practical work sits where people, processes, technology, and business risk meet.
A Wellington SaaS team starts Tuesday with a Slack message from a customer. Their admin console looks different. A contractor's account has been used overnight, and the contractor reused a password from another service. There's no dramatic malware alert, no mysterious hooded figure, and no cinematic green code. There's an ordinary credential problem, followed by an extraordinary amount of work.
The team has to identify what the account touched, contain access, check logs, speak with customers, and decide whether personal information was exposed. Meanwhile, the founder is trying to keep the company calm while sales asks whether a major prospect needs to be told.
That's cybersecurity in the world.
Cybersecurity is the discipline of protecting people, data, systems, and business operations from digital harm. Antivirus software can help, but it's one small part of the picture. A security programme also covers identity, staff behaviour, access rules, supplier risk, software changes, backups, monitoring, and response.
Think about a shared office.
One lock won't secure the whole building. Likewise, a password manager won't fix a missing offboarding process, and a penetration test won't stop a finance team member sending money to the wrong account.
Practical rule: Treat cybersecurity as a business control, not a software purchase.
SaaS makes this sharper because customers hand you data and trust you to operate the service. If your platform stores health information, payroll details, financial records, or customer conversations, a security incident becomes your customer relationship problem, not merely your hosting provider's technical problem.
That's why a founder-friendly guide to practical cyber security tips for SMEs can be useful alongside deeper technical work. Small teams need clear actions, not a shelf full of policy documents nobody reads.
The rest is less frightening than it sounds. You need a useful mental model, a view of the threats landing in New Zealand, a framework that fits your buyers, and a short list of actions you can start this quarter.
Start with three words: confidentiality, integrity, and availability. Security teams often call them the CIA triad, but the idea is simple.
Confidentiality means the right people can see information, and the wrong people can't. For a SaaS product, that might mean one customer can't view another customer's records.
Integrity means information stays correct and trustworthy. If an invoice number, account balance, user role, or audit record can be changed without detection, your product can't reliably support the business around it.
Availability means the service and its data are accessible when authorised users need them. An app that is secure but unavailable during a critical customer workflow still creates business harm.
A shared apartment is a useful comparison. Confidentiality means your flatmate doesn't read your private mail. Integrity means nobody alters your bills. Availability means you can get through the front door when you come home. One careless roommate can affect everyone, which is why shared systems need shared rules.
People risk includes phishing, social engineering, weak passwords, accidental disclosure, and approval mistakes. Attackers often persuade a person to open the door rather than force the lock.
Process risk appears when a company has no reliable way to remove access, approve production changes, check suppliers, or respond to incidents. A good engineer can still work inside a weak process.
Technology risk includes cloud misconfiguration, unpatched dependencies, exposed interfaces, insecure integrations, and poor logging. Technology risk tends to get the most attention because it feels technical. It isn't always the largest source of loss.
A leaky boat makes the point. You can patch the obvious hole, but if another hatch remains open, the boat still takes on water. Security works the same way. Controls need to cover the routes an attacker can use, not only the vulnerability that made the headlines.
Phishing sends a convincing message that pushes someone towards a fake sign-in page or unsafe action. Credential stuffing uses passwords stolen elsewhere, hoping people reused them. A supply-chain compromise reaches your company through a vendor, dependency, integration, or build tool.
Exposed APIs can reveal data or allow actions without enough authorisation checks. Insider mistakes can expose information without malicious intent. These paths differ, but they often lead to the same outcomes: private data becomes visible, trusted records change, or the service stops working.
NZ incident figures point to a people-and-process problem as much as a technical one. In the first quarter of 2025, the NCSC handled 1,369 incidents. Scams and fraud accounted for 486, phishing and credential harvesting for 440, and unauthorised access for 228, according to the NCSC Q1 2025 incident breakdown. For founders, that places identity, payment approvals, and everyday decisions at the centre of the risk picture.
| Threat type | What it looks like for SaaS | Primary impact |
|---|---|---|
| Phishing and credential theft | A finance lead signs in to a fake Xero page, or an engineer approves a false identity prompt | Confidentiality and account control |
| Scams and fraud | An attacker redirects an invoice payment or impersonates a supplier | Financial loss and integrity |
| Unauthorised access | A reused admin password, missing MFA, or active ex-contractor account opens a production console | Data exposure and operational control |
| Ransomware | Systems or endpoints become unavailable, affecting support, development, or service delivery | Availability and recovery |
| Supply-chain compromise | A dependency, CI runner, or vendor connection introduces malicious code or access | Integrity, confidentiality, and availability |
Phishing deserves attention because it can bypass the application entirely. A fake Xero sign-in page may capture a finance lead's credentials, giving an attacker a route into email, cloud storage, billing tools, or customer records. The initial mistake happens in a browser, while the consequences travel through the organisation.
Scams and business email compromise use the same trust relationships. A message may appear to come from a founder, customer, or supplier and request a payment change. Useful safeguards include approval by a second person, a callback to a trusted number, and separate people for requesting and approving payments.
Unauthorised access often reflects forgotten identity decisions. An ex-contractor retains access, a shared administrator account leaves no useful audit trail, or a production console has no MFA. Each gap can expose data and operations because a SaaS environment connects identity directly to both.
Ransomware can interrupt support, engineering, internal administration, and customer service. Personal information may also create notification and communication duties. Recovery depends on knowing which systems matter, having usable backups, and being able to explain what happened.
The first quarter of 2025 included 366 incidents with reported financial loss, totalling $7.8 million, as recorded in the same NCSC Q1 2025 figures. A founder can map each threat to the CIA triad before selecting tools. Phishing threatens confidentiality and identity. Fraud threatens integrity and cash. Ransomware threatens availability. Controls should follow the risk, rather than the latest security headline.
Frameworks help a growing SaaS company turn scattered security tasks into a repeatable operating model. They won't make decisions for you, and they don't replace sound judgement. Think of them as a map. You still need to know where your company is going.
NIST Cybersecurity Framework 2.0 gives teams a clear language for governance, identifying risk, protecting systems, detecting events, responding, and recovering. It works well in board conversations and customer reviews because it describes outcomes without forcing one technical stack.
ISO 27001 and ISO 27002 bring more formal governance, documented controls, evidence, and independent certification. Enterprise buyers may treat certification as a procurement gate, particularly when they need confidence that a supplier runs a managed information security system. Founders considering the route can review ISO 27001 certification guidance for NZ businesses before committing internal time.
The New Zealand Information Security Manual, or NZISM, is especially relevant when you work with government information or pursue government contracts. It carries local context, but it can feel heavy for an early product with a small team.
CERT NZ's Critical Controls offer a practical starting point. They help founders focus on identity, patching, backups, logging, staff awareness, and other controls that reduce common exposure without requiring a large compliance project.
| Framework | Best for | Audit weight | Implementation effort | NZ/AU buyer recognition |
|---|---|---|---|---|
| NIST CSF 2.0 | Risk conversations and programme planning | Moderate | Moderate | Strong |
| ISO 27001/27002 | Enterprise procurement and formal assurance | High | High | Strong |
| NZISM | Government and sensitive information | High in government settings | High | Strong in NZ government |
| CERT NZ controls | Early practical improvements | Lower | Low to moderate | Useful local signal |
The order matters. Many founders start with CERT NZ controls for quick improvements, use NIST CSF as a shared language, pursue ISO 27001 when enterprise deals demand formal assurance, and apply NZISM when government contracting makes it relevant.
Don't choose a framework to impress a future buyer you haven't met. Choose the one that matches your current customer profile, risk, and capacity. A framework should help your team make better decisions on a Tuesday morning, not create a second business made of paperwork.
Legal duties depend on your organisation, customers, data, contracts, and location. A founder shouldn't treat a blog post as legal advice, but you can still build the right operating habits before a solicitor reviews the details.
The Privacy Act 2020 governs how organisations handle personal information in New Zealand. The Notifiable Privacy Breaches scheme becomes relevant when a privacy breach has caused, or is likely to cause, serious harm. Notification duties can involve the Privacy Commissioner and affected people, and the process runs on a 72-hour clock once the organisation becomes aware of a notifiable breach. Confirm the legal test with the Office of the Privacy Commissioner's breach notification guidance.
This quarter, name the incident lead, create an escalation list, preserve logs, and draft customer communications. Waiting until a breach occurs is a poor time to discover nobody knows who can make the call.
APRA CPS 234 matters when your SaaS product supports an APRA-regulated entity or sits inside its information-security arrangements. The customer may require evidence that you understand security capability, control effectiveness, testing, and incident escalation. Ask regulated customers which obligations flow into your contract, then map owners and evidence before procurement asks for it.
Australia's Essential Eight maturity model is a common baseline for organisations improving endpoint, identity, patching, application, and recovery controls. It doesn't automatically make a SaaS compliant with every customer requirement, but it gives teams a concrete set of control areas to discuss with Australian buyers. Start by checking MFA, administrator privileges, patching, backups, and application control against your actual environment.
New Zealand's Cyber Security Strategy 2026–2030 frames cybercrime as an economic and behavioural risk. It says New Zealanders lose more than $1.6 billion annually to cybercrime and cites a survey of 295 large New Zealand businesses, where 59% reported a cyber incident in the previous year, as described in the Government strategy document.
The strategy also points towards an anticipated mandatory reporting regime. Treat that as a planning signal, not a reason to wait. Build a reliable incident register, preserve evidence, and establish a reporting decision process now.
If your product holds EU or US customer data, contractual and privacy duties may extend beyond New Zealand and Australia. GDPR and US state privacy laws differ in scope and trigger, so map where data is collected, stored, processed, and transferred. Put that map in front of privacy counsel, then make retention, deletion, access, and breach workflows match the advice.
For a local overview of the threat environment and business implications, founders can also consult this guide to cybersecurity in New Zealand.
Security ownership starts with a name beside it. In the earliest stage, that may be the founder, supported by an engineer who understands the product and cloud environment. The arrangement is imperfect, but unnamed responsibility is worse.
As customer questionnaires and board reporting grow, a fractional or virtual CISO can create structure without the cost of a full internal team. They can help set policy, organise evidence, lead risk reviews, and prepare the business for buyer scrutiny.
A dedicated security engineer becomes sensible when the product and organisation have enough moving parts to justify a permanent owner, especially after a regulated customer arrives. A larger company may then need separate capability across security engineering, governance, detection, privacy, and response.
Buyers and investors often look for signals that are simple but meaningful:
Good governance is often the cheapest sales tool a SaaS company has.
It shortens procurement conversations because you can answer with evidence instead of improvisation. It also makes engineering calmer. When access reviews, incident roles, and change approvals are clear, people spend less time guessing during a stressful event.
Security belongs in product planning because a security failure changes the customer experience. It can interrupt a release, delay onboarding, expose records, or force a hard conversation with a buyer. Treating it as a product and governance function gives the founder a seat at those decisions before the risk becomes urgent.
A useful first quarter doesn't need a grand programme. It needs ordered work.
Fortnight one: Enable MFA across SaaS tools, turn on SSO where it fits, list the assets that run the product, and rotate administrator credentials.
Fortnight two: Map where data enters, lives, and leaves. Mark sensitive information, record retention needs, and write a short incident response playbook with names and phone numbers.
Fortnight three: Work through CERT NZ's critical controls, test backups, review logging, and run a phishing simulation or tabletop exercise. Keep the exercise practical. A fake compromised account is enough to expose unclear decisions.
Fortnight four: Commission a basic penetration test, review the findings with engineering, assign fixes, and brief the board or leadership team. A test is useful only when someone owns the remediation.
For a startup-specific checklist, use this cybersecurity guide for startups. Also keep the CERT NZ Get Cyber Safe resources, the NCSC risk management guidance, the OAIC security guidance, the Privacy Commissioner's breach notification material, and the 2026–2030 Cyber Security Strategy close at hand.
If your SaaS team needs help turning security concerns into a practical plan, NZ Apps offers founder-focused guides and regional technology coverage to help you assess tools, suppliers, and operating priorities. Visit NZ Apps to find relevant resources for building a more credible security posture across New Zealand and Australia.
Add your NZ or Australian app or tech company to the NZ Apps directory and get discovered by founders and operators across the region.
Get ListedReach tech decision-makers across New Zealand and Australia. Sponsored and dofollow editorial links, permanent featured listings, and sponsored articles on a DA30+ .co.nz domain.
See Options