When it comes to technology priorities, what’s the difference between a business with 15 employees and one with 150? You might expect some variation, but our 2021 research uncovered a difference so stark it serves as a major warning for New Zealand’s small business community.
In our independent report, The State of IT for NZ’s SMEs, we asked business leaders to rank their top technology investment priorities. For medium-sized businesses, the answer was decisive and clear: Security & Risk Management was their #1 priority, with nearly a third (28.8%) citing it as their main focus.
For small businesses, it was a completely different story. Security ranked a distant 12th.
This isn't just a statistical curiosity; it's a critical vulnerability chasm. While small businesses were rightly focused on immediate needs like business process management and customer experience, they were deprioritising the very thing that protects those investments.
Why the Great Divide?
As a business grows, its risk profile changes. Medium-sized businesses prioritise security because they’ve often learned the hard way. They manage more complex systems, hold more customer data, and are more likely to have faced the compliance, reputational, or financial consequences of a security incident. They see security not as an operational cost, but as a fundamental requirement for resilience and growth.
Small businesses, on the other hand, often operate with a sense of "it won't happen to me." Our report found they were more concerned with increasing revenues and retaining customers. Yet, as the report states, "malicious actors seek to exploit the newly introduced gaps and security risks." They don't discriminate by size; they look for the easiest target. The rapid shift to remote work during the pandemic dramatically expanded the attack surface for every business, a fact medium-sized businesses clearly took to heart.
Closing the Gap Before It's Too Late
As our report summarises, "security and risk management ought to be high on the agenda... Newly introduced apps and unsecured access create big risks." For small businesses, treating security as an afterthought is no longer viable. It’s time to shift the mindset from "if" an incident will happen to "when," and to treat security as the essential, business-enabling investment that it is.
To explore more of the key differences and investment priorities between small and medium businesses, download the full, independently researched report: The State of IT: New Zealand’s Small and Medium-Sized Business Edition
