Top Cybersecurity Companies In New Zealand For 2027
Dominic Tarn
Head Writer - ReVerb
10.23.2026
Meta description: Compare 10 cyber security companies NZ organizations hire for testing, 24/7 monitoring and compliance in 2027.
Quick answer: For large-scale managed security and CREST penetration testing, start with Bastion Security Group, DEFEND or Kordia (Aura Information Security). AMARU and Cyberoptic Security suit smaller businesses that want clear pricing. Pulse Security is a strong pick for specialist testing and incident response, and Emsisoft for endpoint protection software.
New Zealand has built a capable home-grown cyber security industry, and most of the best options for local organizations are Kiwi firms. Demand comes from central and local government, banks and insurers, healthcare providers, critical infrastructure operators and a growing number of SMEs facing ransomware, email fraud and supplier security questionnaires. The Privacy Act 2020 and the government’s NZISM framework shape much of the work, so local knowledge counts.
This list covers cyber security companies NZ organizations can hire for penetration testing, managed detection and response, governance and compliance, incident response and security software. It includes only firms headquartered or founded in New Zealand, not the local offices of overseas groups. Some are national consultancies with 150 or more staff; others are specialist boutiques of ten people.
To build it, we checked each company’s own website for its offices, services, certifications, team size and any clients or prices it publishes. If a company does not publish a fact, we left it out.
Cybersecurity Companies In New Zealand At A Glance
Company
Location
Best For
Core Services
Bastion Security Group
Auckland and Wellington
Full-service security for government and enterprise
Penetration testing, MDR, DFIR, GRC, PCI QSA
DEFEND
Auckland, Wellington and Christchurch
Microsoft-centric managed security
24×7 monitoring, XDR, assessments, transformation
Kordia (Aura Information Security)
Wellington and Auckland
Testing plus a 24/7 managed SOC
Penetration testing, red teaming, vCISO, managed security
Datacom
Offices across New Zealand
Large organizations wanting security within wider IT
Cybersecurity and protective services
AMARU
Auckland CBD
Subscription security for growing companies
CREST testing, MDR, SOC 2 and ISO 27001 compliance
SSS
Wellington
Identity and security operations
Managed security operations, IAM, email security
Pulse Security
Wellington and Auckland
Specialist testing and incident response
Penetration testing, red teaming, code review, forensics
Bastion Security Group describes itself as a New Zealand-based cyber security consultancy, formed by bringing together five companies: Quantum Security, ZX Security, Helix Security, Cassini and Cythera. It now has more than 150 cyber security professionals across New Zealand and Australia, with offices on Shortland Street in Auckland, Brandon Street in Wellington and Bourke Street in Melbourne. Bastion says 400 clients rely on it.
The service range is one of the widest in the country. Assessment work includes penetration testing across networks, web and mobile apps, cloud, APIs, OT/SCADA, wireless and hardware, plus red teaming, purple teaming, AI penetration tests, cyber maturity assessments, certification and accreditation and audit. On the defensive side, Bastion runs managed detection and response with 24/7 threat monitoring (covering 115,000+ assets), digital forensics and incident response, threat intelligence and dark web monitoring. Advisory services include vCISO, board reporting and policy development, and it offers PCI QSA assessments.
Bastion is a CREST-certified member company and an approved supplier on the DIA Marketplace. Its consultants hold certifications including CISSP, CISM, CISA, OSCP, SABSA and PCI-QSA. A typical penetration test takes around five days, and the team responds within one business day with a scoped proposal.
Services: Penetration testing, red and purple teaming, MDR, DFIR, threat intelligence, GRC, certification and accreditation, PCI QSA, vCISO
Certifications: CREST member company; DIA Marketplace approved supplier
2. DEFEND: 2025 Microsoft Security Partner Of The Year
DEFEND has offices in Freemans Bay (Auckland), Featherston Street (Wellington) and Tuam Street (Christchurch), and a team of more than 160 experts. In 2025 it was named Microsoft Security Partner of the Year, which it says made it the first company across Australia and New Zealand to receive that global award. DEFEND has also joined forces with One NZ in a partnership.
Its work follows a lifecycle model. Plan covers security assessment and strategy. Transform delivers a cybersecurity transformation framework. Operate provides 24×7 measuring, monitoring and management through its DEFEND iCE service. Assure covers maturity measurement and vulnerability and penetration testing. Products include DEFEND Guardian XDR for Business, Guardian XDR for Enterprise and DEFEND Insights SSPM.
DEFEND holds ISO/IEC 27001:2022, ISO/IEC 27701:2019, SOC 2 Type 2 and NZ Fernmark certifications, and lists government, finance and insurance, health, critical infrastructure and not-for-profit sectors among its clients.
Kordia is proudly NZ owned and describes itself as having one of the largest cyber security teams in New Zealand. Its independent consultancy, Aura Information Security, has more than 30 people with offices in Wellington, Auckland and Melbourne. Aura is a CREST provider in New Zealand and Australia, a Primary Supplier in all five categories of the DIA ICT Security and Related Services panel, and was named best security company at the iSANZ awards in 2018 and 2019.
Aura handles the advisory and testing side: penetration testing, purple and red teaming, social engineering, physical security testing, security assessments, cloud and architecture reviews, continuous assurance and vCISO services, plus executive, employee and secure development training. Kordia’s managed security service provides 24/7, 365 monitoring from its local SOC team, with threat hunting, SOAR automation, continuous threat exposure management and digital forensics and incident response.
Kordia also delivers RedShield web application shielding, SASE and Zero Trust planning and NIST framework compliance, and lists Microsoft Gold (Security) among its technology partners.
Services: Penetration testing, red teaming, vCISO, security training, 24/7 managed security and SOC, DFIR, cloud security, SASE
Location: Wellington and Auckland (Aura also in Melbourne)
Certifications: CREST provider (Aura); DIA ICT Security panel Primary Supplier; iSANZ best security company 2018 and 2019
4. Datacom: Locally Owned IT Group With Cybersecurity And Protective Services
Datacom describes itself as one of the region’s leading locally owned technology businesses, with more than 60 years of local expertise, a team of almost 6,000 people and 32 offices across New Zealand, Australia, Malaysia and the Philippines. Its security solutions include cybersecurity and protective services, delivered as part of a much wider IT services business.
That scale is the main reason to consider Datacom. Large organizations and public sector agencies that already use Datacom for cloud, applications or infrastructure can add security services from the same supplier, with consistent contracts and account management. For organizations that want an independent tester separate from their IT supplier, a specialist firm on this list may suit better.
Services: Cybersecurity and protective services alongside cloud, infrastructure and application services
Location: Offices across New Zealand (32 offices across four countries)
5. AMARU: Auckland Firm Offering CREST Testing And Subscription Security
AMARU (formerly Simplify Security) is headquartered at 17 Customs Street East in Auckland and says it is trusted by more than 70 brands across New Zealand and Australia. It monitors more than 500 systems and reports resolving more than 1,000 valid vulnerabilities for clients.
Its services are built around subscriptions rather than one-off projects. They include cyber security and Microsoft security assessments, CREST-certified penetration testing, 24/7 managed detection and response with threat hunting, a fully managed security service, security awareness training (phishing and social engineering), incident response planning and security and compliance officers on a subscription basis. AMARU helps clients achieve SOC 2, ISO 27001, NIST CSF, Essential Eight, PCI DSS, NZISM and HIPAA compliance, and offers its own compliance planning platform, Swise.ai.
Published case studies and clients include Oceania Healthcare (incident response plan), Figured (SOC 2 compliance), Spectrum Foundation (managed AI security operations center), SolarZero and Harmoney. Vendor partners include Microsoft, CrowdStrike, Google Cloud, Mandiant, Sophos and AWS.
6. SSS: NZ-Owned Security Specialist Founded In 1985
SSS was founded in 1985 as Scientific Software & Systems Limited and shifted its focus to IT security about 30 years ago. It is New Zealand owned and managed, with an office at 187 Featherston Street in Wellington.
SSS focuses on two areas. Managed security operations cover threat detection and SOC services. Identity and access management covers employees, contractors and third-party users. It also has its own products, Scouter and AssureMail (email security).
Its site shows organizations including Ryman Healthcare, BNZ, ACC, Oranga Tamariki, KiwiRail, Trade Me, the University of Auckland and the Reserve Bank of New Zealand, and case studies cover Gisborne District Council, Heritage Lifecare and Timaru District Council.
Clients: Ryman Healthcare, BNZ, ACC, KiwiRail, Trade Me, Reserve Bank of New Zealand, Timaru District Council
7. Pulse Security: Specialist Penetration Testing, Red Teaming And Forensics
Pulse Security is a technical security consultancy with Wellington and Auckland phone lines and a Wellington postal address. It focuses on hands-on testing and response rather than managed services.
Penetration testing covers web applications and APIs, external, internal and wireless networks, host and SOE builds, cloud environments, mobile applications and bespoke systems. It also offers red teaming and attacker emulation, and security research as a service. Consultancy reviews cover network and application architecture, source code, DevOps and general security advice. A separate incident response practice handles preparedness, incident management, forensic investigations and malware analysis, with forensic investigators who are GIAC Certified Forensic Analysts.
Pulse Security suits organizations with in-house development teams and internal security staff that want deep technical testing and code review.
Location: Wellington and Auckland (postal: PO Box 610, Wellington 6140)
8. CyberTeam: ISANZ 2025 Cybersecurity Startup Of The Year
CyberTeam is a Wellington-based, New Zealand owned and operated consultancy with no offshore resourcing. Co-founders Tom Britton and Chris Hawksworth started it as practitioners, and it has grown to a team of ten plus an extended network of contract specialists. It was named ISANZ 2025 Cybersecurity Startup of the Year.
Its services fall into five areas: governance, risk and compliance; augmented security (extending your own team); security engineering; security architecture; and threat-informed defence. Engagements are flexible in pace and include board-ready reporting, and the team works within the NZISM and Privacy Act.
CyberTeam lists more than 30 major New Zealand clients, including BNZ, ASB, Auckland Council, the Department of Internal Affairs, the Department of Conservation, Fire and Emergency NZ, MFAT, Stats NZ, the Ministry of Health and Crown Law.
Cyberoptic Security is NZ owned and operated and based in Auckland, with local consultants and packages designed for smaller teams. It offers penetration testing, CyberSafe Essentials, secure configuration reviews, technical controls validation, vulnerability scanning and bespoke testing.
Testing types include web applications (following the OWASP Web Security Testing Guide), APIs, internal and external networks, AI and LLM systems (prompt injection, data leakage and tool abuse), mobile apps (following OWASP MASTG) and hardware such as IoT and medical devices. Standard engagements are fixed price, and you receive the price before work starts.
Cyberoptic publishes its prices: an external network vulnerability scan costs NZ$1,400, an external network penetration test NZ$3,100, a web application penetration test NZ$4,800, a Microsoft 365 secure configuration review NZ$4,600 and an internal network penetration test NZ$6,500. The site does not state whether GST is included.
Pricing: NZ$1,400 to NZ$6,800 per fixed-scope package (GST treatment not stated)
10. Emsisoft: NZ-Headquartered Anti-Malware And Ransomware Specialist
Emsisoft is headquartered in New Zealand and has local teams across all time zones. It was founded in 2003 as an association of malware researchers, and moved from Austria to New Zealand in 2014. Founder and managing director Christian Mairoll is based in New Zealand, and the company has about 40 staff.
Unlike the consultancies on this list, Emsisoft makes security software. Its range includes Emsisoft Business Security, Enterprise Security (with EDR), Anti-Malware Home, Mobile Security, the Emsisoft Emergency Kit and the Remediation Kit, which includes a command-line scanner and ransomware decryption tools.
Emsisoft suits businesses and MSPs looking for a New Zealand headquartered endpoint protection vendor.
How To Choose A Cybersecurity Company In New Zealand
The right partner depends on whether you need a one-off test, ongoing monitoring or help with governance. These questions will help.
Do You Need Testing, Monitoring Or Both?
Penetration testing finds weaknesses at a point in time. Managed detection and response watches your systems around the clock. Bastion, Kordia, DEFEND and AMARU offer both. Pulse Security and Cyberoptic focus on testing.
Is The Provider CREST Certified?
CREST certification shows a testing provider meets international standards for methodology and ethics. Bastion, Aura and AMARU state CREST certification on their sites. Many government and enterprise buyers require it.
Which Frameworks Must You Meet?
Public sector work often follows the NZISM, while SaaS companies selling overseas may need SOC 2 or ISO 27001. Ask whether the provider has helped similar organizations meet the same framework.
Where Is Your Data Monitored From?
If you buy managed security, ask where the SOC staff sit and where logs are stored. Kordia, CyberTeam and SSS stress local, New Zealand-based teams.
What Will It Cost?
Ask for fixed-scope quotes. Cyberoptic publishes prices, which helps as a benchmark for smaller tests.
Frequently Asked Questions
How Much Does A Penetration Test Cost In New Zealand?
Cyberoptic Security publishes fixed prices ranging from NZ$1,400 for an external vulnerability scan to NZ$6,800 for a hardware security assessment, with a web application penetration test at NZ$4,800. Larger or more complex scopes are quoted separately, and most consultancies quote per engagement.
How Long Does A Penetration Test Take?
Bastion says a typical test takes around five days, depending on scope. Reporting and retesting add time, so plan for a few weeks from scoping to final report.
Should I Choose A NZ-Owned Cyber Security Company?
Local firms understand the Privacy Act 2020, the NZISM and New Zealand government procurement, and can respond in your time zone. All of the cyber security companies NZ buyers will find on this list are headquartered or were founded here.
What Is The Difference Between MDR And A SOC?
A security operations center (SOC) is the team and tooling that monitors security events. Managed detection and response (MDR) is a service that uses a SOC to detect threats and respond on your behalf, often including containment.
More New Zealand Lists
Explore more ReVerb guides to technology providers across New Zealand:
For organizations that need everything from testing to 24/7 monitoring, Bastion Security Group, DEFEND and Kordia (with Aura Information Security) have the scale and certifications, and Datacom suits large buyers that want security inside a wider IT contract. AMARU offers subscription security and compliance for growing companies, and SSS brings decades of experience in identity and security operations.
For specialist needs, Pulse Security provides deep technical testing and forensics, CyberTeam focuses on governance and architecture for the public sector, Cyberoptic offers fixed-price tests for smaller teams, and Emsisoft supplies endpoint protection software. Match the provider to the work you actually need, and ask for certifications and a clear scope before you sign.
Bookmark this guide to make a well-informed decision. If you want to add your company to this list, drop us a line or submit a form in the Top Choices section. After a thorough review, we will decide whether it is an appropriate addition.
