Digital surfaces
Threat themes
- Data Loss
- Unauthorized Access
- Business Email Compromise
Recommended services
Recommended security products
Verified New Zealand data
Market-level figure, not a per-company loss estimate.
BEC-driven
high-value transfer fraud signal
NCSC linked the Q3 2025 loss increase to a small number of high-value reports involving unauthorised or falsified transfers of money resulting from business email compromise.
- Official source:
- NCSC Quarter Three Cyber Security Insights 2025 / Data landscape
- Period:
- Q3 2025
- Scope note:
- Official reported New Zealand figure. This is market-level context, not a per-company loss estimate and not a BilgeQor outcome.
29 / 25 / 23
organisation phishing / scam / unauthorised-access reports
Organisation incidents in Q2 2025 included phishing and credential harvesting 29, scams and fraud 25, and unauthorised access 23.
- Official source:
- NCSC Quarter Two Cyber Security Insights 2025 / Data landscape
- Period:
- Q2 2025
- Scope note:
- Official reported New Zealand figure. This is market-level context, not a per-company loss estimate and not a BilgeQor outcome.
32 / 21 / 17
public / professional / financial sector reports
Q4 2025 sector reports included Public Administration and Safety 32, Professional / Scientific / Technical / Administrative and Support Services 21, and Financial and Insurance Services 17.
- Official source:
- NCSC Quarter Four Cyber Security Insights 2025 / Data landscape
- Period:
- Q4 2025
- Scope note:
- Official reported New Zealand figure. This is market-level context, not a per-company loss estimate and not a BilgeQor outcome.
NZ$12.1m / 56
high-value loss concentration
Incidents of NZ$10,000 and over made up NZ$12.1 million, or 97% of Q3 2025 reported loss, despite consisting of only 56 incidents.
- Official source:
- NCSC Quarter Three Cyber Security Insights 2025 / Data landscape
- Period:
- Q3 2025
- Scope note:
- Official reported New Zealand figure. This is market-level context, not a per-company loss estimate and not a BilgeQor outcome.
Likely loss areas
Supplier portals, project files, tender documents, subcontractor access, invoice workflows, shared drives and remote access need recurring control to reduce BEC, access and document-manipulation exposure.
Structured support changes the outcome
Visibility
With structured support
Critical surfaces, access paths, payment flows, customer data and vendor dependencies are mapped before they become an incident.
Without structured support
Risk is often discovered after a fraud report, unauthorised access, customer complaint, partner review or operational disruption.
Prioritisation
With structured support
Findings are translated into a plain-English, business-prioritised roadmap so urgent access, payment, backup and logging issues are handled first.
Without structured support
Technical issues stay scattered across teams; fixes compete with product work without a clear impact view.
Evidence
With structured support
A security file, executive summary, remediation notes and follow-up record make security easier to explain to leadership, customers, banks and partners.
Without structured support
The organisation may rely on informal assurance, screenshots or fragmented notes when difficult security questions arrive.
Incident readiness
With structured support
Logging, access ownership, backup expectations and response paths are checked before a fraud, data-loss or service-disruption event escalates.
Without structured support
Response is slower because account ownership, vendor access, logs, backups and communication responsibilities are unclear.
Cost exposure
With structured support
Preventive work becomes budgetable and tied to official New Zealand risk signals instead of vague fear.
Without structured support
Cost often appears during a crisis: lost transactions, recovery work, customer trust loss, regulatory questions and rushed remediation.
BilgeQor Method
For New Zealand, BilgeQor turns official market signals into a practical security file: what is exposed, what could create business impact, and what should be handled first.
01
Market and sector evidence
We start with official New Zealand data from NCSC, MBIE / Consumer Protection, FMA, the Office of the Privacy Commissioner and business digital-capability sources where relevant.
02
Exposure mapping
We map payment flows, customer portals, apps, APIs, admin roles, cloud storage, vendor access, public forms and high-value document workflows.
03
Impact framing
We connect each risk to practical loss areas: fraud handling, unauthorised access, downtime, customer trust, partner review, recovery cost and remediation pressure.
04
Security file delivery
We deliver a structured executive summary, prioritised findings, remediation notes and a 14/30/90-day action path where appropriate.
05
Follow-through
One-off reviews can become monthly advisory, retesting, hardening or launch-readiness work when the team needs continued support.
The method does not guarantee prevention, recovery, compliance or regulator approval. It creates clearer security decisions using verified evidence and a maintained delivery record.