This week is Cyber Smart Week in New Zealand — the NCSC's annual awareness push, running 5 to 11 October 2026 under the theme "find a scam before it finds you." Across the Tasman, Australia is running Cyber Security Action Month with its own message: "take a second, stay secure." Both campaigns have landed on the same underlying concern this year, and it is worth taking seriously: AI has made scams dramatically more convincing, and the detection habits most people learned five years ago no longer work.
(To be clear: SecureAZ is not part of the government campaign — we are a NZ training provider pointing at the same problem, because it is the problem.)
Why this year's theme is different
For a decade, awareness advice leaned on surface tells: spelling mistakes, clumsy grammar, odd formatting, generic greetings. Those tells existed because scam volume came from non-English-speaking operations producing templates at scale.
AI removed that constraint. A scammer with a free chatbot now writes flawless, locally flavoured, personally addressed messages in seconds — and can clone a voice from a few seconds of audio, or stand up a pixel-perfect fake login page without knowing how to code. The NCSC's campaign messaging this year says it plainly: AI is enabling more convincing messages and impersonation than ever.
The practical consequence: if your team's scam radar is still tuned to "look for the typos," it is tuned to a threat that largely retired. We broke down the full shift in how AI voice cloning is powering vishing scams in NZ and the top 10 cyber threat trends for 2026.
"Could your team spot the scam?" is an empirical question
Here is the uncomfortable thing about awareness: every business owner believes their team is switched on, and almost none have evidence. Cyber Smart Week is built around exactly this gap — not "install more software," but "could your people recognise what is in front of them?"
Three questions to ask yourself this week:
- If a perfect-English invoice email arrived from a supplier's lookalike domain, who in your business would catch the domain? The difference between a legitimate address and a fraudulent one is now routinely a single character.
- If your "CEO" rang a staff member asking for an urgent payment, would they verify by a second channel — or comply? Voice is no longer proof of identity. We covered real cases in deepfake CEO fraud hitting NZ businesses.
- If a fake Microsoft login page harvested one password, how far would it reach? The answer depends entirely on MFA coverage and password reuse — see our MFA guide for small business.
If you cannot answer all three with evidence, you have a visibility problem before you have a security problem.
What "finding the scam first" looks like in practice
The NCSC's broader guidance makes a point we have always built SecureAZ around: ongoing awareness beats the once-a-year training video. Instinct is built by repetition and testing, not by a compliance module in January. A workable programme for an NZ small business looks like:
- Short, regular training — minutes a month covering the scams actually circulating in NZ and Australia, not generic global content
- Realistic phishing simulations — safe fakes, sent to your real team, measuring who clicks, who reports, and who enters credentials
- Immediate micro-training for whoever clicks — the teachable moment, not the shame moment
- Reporting you can show the board or your insurer — risk trending down, quarter on quarter
That second step is the one most businesses skip, and it is the only one that turns "we think our team is fine" into data. We wrote a practical guide to it in running an employee phishing test.
Use the week
Cyber Smart Week gives you a ready-made excuse to raise this internally without sounding alarmist — the government is literally running the conversation for you. Forward the Own Your Online material to your team, spend ten minutes at your next stand-up on the three questions above, and if you want the empirical answer rather than the hopeful one: SecureAZ's 45-day free trial is long enough to train your team AND run a full phishing simulation cycle — up to 5 users, no credit card. Put your team to the test.
Find the scam before it finds you. This week of all weeks.