Managed security as a service

Your own security team. Without hiring one.

Most NZ small businesses can't afford a dedicated security team — or the time to manage cybersecurity themselves. KIS Managed Security gives you complete, ongoing protection handled by experts, structured around NIST CSF 2.0, reported to you in plain English, and priced so it actually makes sense for a business your size.

We monitor your systems, train your people, respond when things go wrong, and keep your security posture up to date — including your path toward ISO 27001 if that's your goal. You focus on running your business.

Book a free conversation See pricing

200+ NZ businesses protected

0 Client breaches under managed monitoring

24/7 Eyes on your environment

6 Industries served across NZ

200+ figure and 0 breaches based on internal KIS engagement data

Why it matters

Small businesses are the number one target.

According to CERT NZ's annual cyber security insights report, small and medium businesses consistently represent the largest group of cybercrime reporters in New Zealand — not because they're more valuable, but because they're less protected. Attackers know that most SMBs don't have a security team, don't have monitoring in place, and will take days to even notice something's wrong.

A managed security service closes that gap. It gives your business the same level of protection a large organisation has — without needing the headcount or budget that goes with it.

Source: CERT NZ Cyber Security Insights Report — cert.govt.nz

The average NZ SMB has no security monitoring

Most small businesses rely on antivirus and hope for the best. Antivirus catches known malware. It doesn't catch phishing, ransomware delivered via email, or an attacker who's already inside your network and moving quietly.

Without monitoring, breaches go undetected for days

Most businesses without active monitoring find out about a breach from a customer, a bank, or the media — not their own systems. By then, significant damage is usually already done.

Managed security changes the equation

Instead of reacting to incidents, we prevent most of them. And when something does happen, you have an expert team ready to respond immediately — not a panicked search for help at the worst possible moment.

What it covers

Every layer of your security. One monthly fee.

Managed security as a service isn't a single product — it's a complete programme covering your technology, your people, and your processes, structured around NIST CSF 2.0's six core functions. Here's what that looks like in practice.

📊

Technology layer

24/7 monitoring of your endpoints, network, email, and cloud environment. Threats are detected, triaged, and contained — often before you're even aware of them. Aligned to NIST CSF 2.0 Detect and Respond.

👥

People layer

Monthly phishing simulations and security awareness training keep your team sharp. 82% of breaches involve a human element — your people are both your biggest risk and your best defence.

Verizon Data Breach Investigations Report 2024 — verizon.com/dbir

📋

Process layer

Security policies, incident response plans, and compliance monitoring ensure your business has the right procedures in place — and that they're actually being followed. Aligned to NIST CSF 2.0 Govern.

🔍

Assurance layer

Quarterly vulnerability reviews and an annual risk assessment — conducted against NIST CSF 2.0 and ISO 27001 controls — make sure your security posture keeps pace as your business and the threat landscape evolve.

📝

Reporting layer

A monthly plain-English report tells you what we found, what we did about it, and what the state of your security looks like. No dashboards, no jargon, no noise — just the information you need to make decisions.

📞

Support layer

A direct line to your KIS account lead whenever you need it. Questions, concerns, second opinions — we're a phone call away, not a ticketing system queue.

How it works

Getting started is simpler than you think.

Our workflow

01

Free conversation

We talk about your business, your concerns, and your goals. No sales pitch — just an honest conversation about where you are and what you need.

02

We scope and quote

A clear proposal within two business days. Exact scope, fixed price — no surprises. We'll recommend the right tier for your situation.

03

We onboard your environment

We set up monitoring, run a baseline assessment against NIST CSF 2.0, and get everything in place. Typically two weeks — no disruption to your team.

04

We manage. You get on with business.

Monthly reports keep you informed. Quarterly review calls keep us aligned. We handle everything in between.

What you need to provide

About an hour of your time

For the initial conversation and onboarding call. We handle everything else.

Access to the right people

Usually you, your IT contact if you have one, and whoever manages your systems day-to-day.

Read-only access where needed

We never need admin credentials or the ability to make changes without your explicit approval.

An honest picture of where you are

The more candid you are, the more useful our service will be. No judgement — we've seen everything.

Pricing

Simple, honest pricing. No surprises.

Three tiers to suit businesses at every stage. All prices exclude GST. Switch tiers as your business grows — no lock-in after the first three months.

Essentials

$399/mo

NZD per month, exc. GST

Foundation-level protection for small businesses taking their first steps in managed security.

Annual risk assessment (NIST CSF 2.0)
Security awareness training — up to 10 staff
Quarterly vulnerability scan
Security policy templates
Email support

Get started

Right for your business if any of these sound familiar.

"I know I should be doing more about security, but I don't know where to start."

That's exactly why we exist. The first call is free, there's no obligation, and we'll give you an honest view of your priorities — even if that means pointing you somewhere else.

"We had an incident and we don't want it to happen again."

Post-incident is one of the best times to get managed security in place. We'll understand what happened, close the gaps, and make sure you're protected going forward.

"A client or insurer is asking about our security posture."

Managed security gives you something real to point to — active monitoring, documented policies, regular assessments mapped to NIST CSF 2.0. We can help you respond to questionnaires and audits confidently.

"Our IT person handles security too, but that's not really their speciality."

This is the most common situation we see. Your IT team handles the day-to-day; KIS provides the security expertise and monitoring they don't have time or training for.

"We're growing fast and security needs to keep pace."

As you take on more staff, more clients, and more systems, your attack surface grows. Managed security scales with you — and the Business tier can upgrade to Enterprise as you grow.

"I'm not sure managed security is worth the cost for a business our size."

The average cost of a cyber incident for a NZ SMB is significant — and our Business tier costs $10,788 per year. The economics usually become clear pretty quickly.

Cost estimate based on industry incident cost data — individual incidents vary

How it compares

Managed security vs. the alternatives.

Capability	KIS managed security	Antivirus only	In-house IT	Do nothing
24/7 threat monitoring	✓ Included	✗	Rarely	✗
Staff phishing training	✓ Monthly	✗	Sometimes	✗
Incident response	✓ On-call	✗	Ad hoc	✗
Regular risk assessments	✓ Quarterly	✗	Rarely	✗
NIST CSF 2.0 alignment	✓ Built-in	✗	Varies	✗
Compliance support	✓ Available	✗	Limited	✗
Plain-English reporting	✓ Monthly	✗	Varies	✗
Scales with your business	✓ Yes	Limited	Requires hiring	✗
Typical annual cost (SMB)	From $4,788	$200–600	$80,000+	$0 (until an incident)

Common questions

What people ask us before they get started.

It means a specialist team handles your cybersecurity on an ongoing basis — monitoring your systems, training your staff, responding to threats, and keeping your security posture up to date. Our programme is structured around NIST CSF 2.0's six functions: Govern, Identify, Protect, Detect, Respond, and Recover. You get enterprise-level protection without needing an in-house security team.

Antivirus is a single tool that catches known malware. Managed security is a complete programme. Think of it as the difference between a smoke detector and an actual fire service — one alerts you after the fact, the other actively works to prevent incidents and responds immediately when something happens.

Not at all. Managed security as a service is specifically designed for businesses without dedicated security staff. KIS handles all the technical work and communicates with you in plain English. You don't need any security background to get started.

We can typically begin onboarding within a week of agreeing scope. For urgent situations — like a recent incident or an imminent audit — email hello@kis.co.nz directly and we'll prioritise.

It's a short, plain-English document — typically one to two pages — covering what our monitoring detected last month, what we did about it, any changes to your risk profile, and what we recommend focusing on next. No technical jargon, no security scores that require a decoder ring.

We ask for a three-month minimum commitment so we have time to set things up properly and demonstrate value. After that, contracts roll month to month. We don't believe in locking clients in — we'd rather earn your business every month.

Yes — and it's straightforward. We'll flag when your situation suggests an upgrade makes sense, but the decision is always yours. There's no penalty for moving between tiers.

We work with businesses across healthcare, finance, retail, education, technology, and construction. Each industry has different risks and regulatory requirements — we bring specific knowledge of the sectors we serve, not just generic security advice.

Individual services

Need a specific service rather than an ongoing programme?

All KIS services are available individually. Browse the full range or ask us what's right for you.

Risk assessment

A standalone assessment of your current vulnerabilities — the natural starting point before committing to an ongoing service.

View service →

Penetration testing

A one-off or annual test to find what an attacker could actually exploit in your environment — mapped to NIST CSF 2.0 and ISO 27001.

View service →

Compliance

If a specific framework — NIST CSF 2.0, ISO 27001, NZ Privacy Act, SOC 2 — is your primary goal, start here.

View service →

Our Workflow…

Free conversation
We talk about your business, your concerns, and your goals. No sales pitch.
We scope and quote
A clear proposal arrives within two business days. Exact scope, fixed price — no surprises.
We get to work
We handle the heavy lifting. We’ll only contact you when we need something or have something to show you.
We debrief clearly
Every engagement ends with a plain-English walkthrough of findings, recommendations, and next steps.

What you need to provide…

About an hour of your time
For the initial conversation and the final debrief. We do the rest.
Access to the right people
Usually your IT contact (or you, if that’s the same person) and whoever owns the systems in scope.
Read-only access where needed
For most assessments, we only ever need read access — never admin credentials or the ability to make changes.
An honest picture of where you are
The more candid you are about your current setup, the more useful our findings will be. There’s no judgement here.

That’s genuinely it. You don’t need a dedicated IT team, a security background, or any preparation beyond booking the first call.

Not sure which service you need?

Start here.

A free 30-minute conversation. We’ll tell you honestly what your business needs — and what it doesn’t.

Book a free conversation

What others say about us…

We’d always had a family member looking after our IT, and while we trusted them completely, we hadn’t realised how much risk we were quietly carrying. KIS came in and overhauled our entire security setup, got us properly configured with multi-factor authentication, and went through our Microsoft 365 environment to make sure the right people had the right access and licensing. It wasn’t just a technical fix, it was genuine peace of mind. We now know our systems are actually secure, not just looked after by someone who means well.

Jeremy T.Owner, Auto Services

As a financial services firm, protecting client data isn’t optional. We had no formal security management framework in place and knew we needed to get serious. KIS assessed where we stood and mapped out a practical path toward NIST and ISO 27001 compliance, grounded in what was realistic for our size and structure. Their advice was prioritised and clear, and we came away with a credible roadmap and the confidence that we’re taking the right steps in the right order.

Pam K.CIO, Financial Services Firm

We were rolling out AI across the organisation and our internal IT team is great, but this was new territory. We needed someone to close the gaps fast and set us up to manage things ourselves going forward. KIS delivered on all of it. They implemented data loss prevention, a document classification scheme, and Microsoft Purview, and the uplift in our security and compliance posture has been significant. The best part? They didn’t just fix things and leave. We came out of it actually understanding the system and capable of running it ourselves.

Abby S.Compliance Officer, Telecommunications Company

We’re a small non-profit focused on young people, and like many organisations like ours, we were running largely on goodwill and volunteers. We had a website collecting significant personal information and, honestly, we hadn’t fully grasped the risk we were sitting on. KIS conducted a penetration test, walked us through every finding, and worked through remediation of all critical vulnerabilities with our budget in mind the whole time. They treated our mission as if it mattered to them too, and that made all the difference.

Elizabeth C.Senior Leader, Youth Organisation

Your own security team. Without hiring one.

Small businesses are the number one target.

The average NZ SMB has no security monitoring

Without monitoring, breaches go undetected for days

Managed security changes the equation

Every layer of your security. One monthly fee.

Technology layer

People layer

Process layer

Assurance layer

Reporting layer

Support layer

Getting started is simpler than you think.

Simple, honest pricing. No surprises.

Right for your business if any of these sound familiar.

"I know I should be doing more about security, but I don't know where to start."

"We had an incident and we don't want it to happen again."

"A client or insurer is asking about our security posture."

"Our IT person handles security too, but that's not really their speciality."

"We're growing fast and security needs to keep pace."

"I'm not sure managed security is worth the cost for a business our size."

Managed security vs. the alternatives.

What people ask us before they get started.

Need a specific service rather than an ongoing programme?

Risk assessment

Penetration testing

Compliance

Our Workflow…

What you need to provide…

Not sure which service you need?

What others say about us…

KIS

Services

Company

Useful links