654,000 workplaces, 3.7 staff each: who is watching New Zealand's logs?

The numbers

In February 2025, Stats NZ counted 654,459 business locations in New Zealand, up 110,640 (20%) since 2015. A business location is a single site where a business operates, so a company with three branches counts three times.

Those locations employ about 2.45 million people between them (2,449,835 in the 19 industry groups). Divide one by the other and the average location has 3.7 employees. That is our arithmetic, not a published figure, and an average hides a lot: a few large employers pull it up, and many locations, such as property-holding companies, have no staff at all.

Look at where most locations sit. Real estate (130,485 locations), construction (82,410) and professional services (73,488) are the three biggest groups, and all three average fewer than three employees per location. Finance and insurance, an industry that handles money and personal data all day, averages 1.3.

What attackers are doing

The National Cyber Security Centre's latest quarterly figures (April to June 2026) show where the losses are. It received 1,129 incident reports. Phishing and credential harvesting made up 327 of them, and unauthorised access 203. Unauthorised access was not the most common incident, but it accounted for about $1.3 million of the $2.7 million in direct losses reported for the quarter.

Put simply: a stolen login is where the money is. And the account it opens is usually a Microsoft 365 or Google mailbox.

What this means for a four-person business

A business with three or four staff does not have a security operations centre. It has an IT provider, often a managed service provider (MSP), and a cloud tenant. That makes the MSP's logging the real line of defence for most of the country. Three things decide whether anyone can tell what happened after an account is taken over:

• Sign-in logs are kept. Microsoft Entra ID keeps them for 7 days on the free tier and 30 days with P1 or P2. Most account takeovers are noticed later than that, so export them somewhere with longer retention.
• Mailbox auditing is on and someone looks at it. Attackers who get into a mailbox commonly add an inbox rule that hides or forwards replies, so the real owner doesn't see the fraud happening.
• Admin changes raise an alert: new forwarding, new app consents, MFA methods added or removed.

One hunt to run this week

If your tenants feed Microsoft Sentinel, this query lists inbox rules created or changed in the last 14 days that move, hide, forward or delete mail. Most results will be people tidying their inbox. The ones to look at closely are rules that move mail into folders nobody uses (RSS Feeds is a favourite), forward to outside addresses, or were created from an unfamiliar IP address.

// Inbox rules that hide, move, forward or delete mail (last 14 days).
// Needs the Microsoft 365 (Exchange) connector: OfficeActivity table.
OfficeActivity
| where TimeGenerated > ago(14d)
| where Operation in ("New-InboxRule", "Set-InboxRule", "UpdateInboxRules")
| extend Params = tostring(Parameters)
| where Params has_any ("DeleteMessage", "MoveToFolder", "MarkAsRead",
                        "ForwardTo", "ForwardAsAttachmentTo", "RedirectTo", "RSS")
| project TimeGenerated, UserId, ClientIP, Operation, Params
| order by TimeGenerated desc

No SIEM? An administrator can get the same picture straight from Exchange Online PowerShell:

# Exchange Online PowerShell: rules that forward, redirect or delete.
Get-Mailbox -ResultSize Unlimited | ForEach-Object {
  Get-InboxRule -Mailbox $_.UserPrincipalName |
    Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo -or $_.DeleteMessage } |
    Select-Object MailboxOwnerId, Name, Enabled, ForwardTo, RedirectTo, DeleteMessage
}

The short version

New Zealand's business base is mostly very small, and the most costly incidents come through stolen logins. The fix is not a SOC for every business. It is good logging, kept long enough, with a few high-value detections, run by whoever already looks after the IT.

Sources

• Source: Geographic Units by Industry and Statistical Area, via Community Pulse by Data n Dashboards. Original publisher: Stats NZ, Business Demography. Business-location and employee counts are summed from territorial-authority rows for February of each year. Stats NZ randomly rounds these counts, so industry figures sum to within a few of the published total.
• National Cyber Security Centre, Quarter two cyber security insights 2026 and Incidents and referrals, 1 April to 30 June 2026.
• Averages per location and percentage changes are EmberSec's own arithmetic from the figures above.