Cybersecurity statistics can sometimes tell two very different stories at the same time. This year seems to have kicked off with peaks and valleys across the months.
On one hand, ESET’s latest threat data for New Zealand suggests that the number of detected cyber threats has eased during the second quarter of 2026 compared to the same time last year.
After a spike in March, detections dropped again in April, climbed sharply in May, then settled back in June. Looking across the past 6 months, the pattern has become increasingly noticeable: sudden bursts of activity followed by equally sharp declines. At face value, it might seem like cybercriminals are losing interest in New Zealand.
Unfortunately, they’re probably just changing tactics.
Modern security software has become remarkably good at dealing with traditional malware. Security products now recognise suspicious behaviour instead of relying solely on virus signatures, share intelligence globally within minutes, and increasingly use artificial intelligence to spot emerging threats before they spread.
Many attacks may simply never reach New Zealanders because they’re intercepted long before they land in an inbox or browser. That’s one reason why threat detections don’t always tell the whole story.
Cybercriminals, are nothing if not adaptable
Rather than spending time trying to beat security software, many have shifted their attention to the one thing antivirus can’t fully patch: human behaviour.
While malware detections appear to be flattening, the amount of money being lost to scams continues to grow. Reports on ongoing increases in financially motivated cybercrime, such as investment scams, impersonation scams, business email compromise and online marketplace fraud, continue to be major contributors to losses across New Zealand. The methods may be changing, but the end goal hasn’t changed at all: exploiting them for financial gain.
Artificial intelligence is accelerating this trend
Creating a believable scam no longer requires excellent English, graphic design skills or hours of manual research. AI tools can generate polished emails, imitate professional writing styles, create convincing fake documents and even produce realistic voice recordings. The result is that scams often feel far more authentic than they did only a few years ago.
That’s especially concerning for small businesses.
Many organisations have invested in good cybersecurity tools, and that’s paying off. Better endpoint protection, stronger email filtering and improved detection technologies are blocking many of the attacks that would have slipped through several years ago.
But if an employee receives a convincing invoice from what appears to be a trusted supplier and willingly authorises payment, no antivirus in the world can stop that transaction.
The same applies at home
A banking app can protect your login credentials. A browser can warn you about dangerous websites. Your antivirus can quarantine malicious files. None of them can stop someone from believing they’re speaking to their bank when they’re actually talking to a scammer.
That’s becoming the defining challenge of modern cybersecurity.
Technology continues to improve, which is helping drive down many traditional malware detections. At the same time, criminals are investing more effort into manipulating trust instead of exploiting software.
Attacking conversations instead of computers
That’s why our quarterly threat reports are much more than counting detections. They reveal how attackers are adapting to the defences standing in their way.
For New Zealanders, the latest figures are actually quite encouraging. They show that modern security technology is doing exactly what it’s designed to do, disrupting many conventional attacks before they become widespread. But they also remind us that cybersecurity has become less about avoiding obviously infected files and more about recognising when something simply doesn’t feel right.
Sometimes the most effective security feature isn’t a piece of software at all. It’s the little voice in your head that says, “Hang on… why is my power company suddenly asking me to pay by cryptocurrency?”
