A new report from New Zealand’s National Cyber Security Centre urges business and organisational leaders to prepare for a cyber threat environment transformed by artificial intelligence.
The Cyber Threat Report 2026, released today, assesses cyber security risks facing New Zealand businesses and highlights actions leaders should take to strengthen their resilience.
The key finding is that artificial intelligence (AI) is rapidly reshaping the cyber landscape, with frontier AI supercharging risks and opportunities.
The report’s authors believe that by early 2027, malicious actors may have access to advanced AI capabilities currently available only through leading models.
It warns that disruptive incidents may occur with little warning and organisations should prepare now.
National Cyber Security Centre (NCSC) head Catriona Robinson said cyber security was a critical consideration for every New Zealand business.
“The cyber threat landscape is changing faster than ever. Alongside familiar threats from cyber criminals and state actors, businesses and organisations face a powerful new disruptor in the form of frontier artificial intelligence,” Robinson said.
“We are also seeing new types of threat emerge, including that of a North Korean IT worker clandestinely obtaining remote IT work with a New Zealand business in order to earn foreign currency for the North Korean state.
“This kind of activity is subject to United Nations sanctions which have effect under New Zealand law and also creates risks of espionage and extortion for businesses that are targeted.”
Robinson said AI offered many opportunities, but the technology was already being used to increase the speed, scale and sophistication of cyber attacks.
She suggested the next generation of frontier AI models could automate attacks, identify vulnerabilities and enable highly personalised targeting of organisations and individuals.
The threat of attacks is growing in New Zealand, with 369 incidents of potential national significance handled by the NCSC during the 2025-26 year.
Of that figure, 162 were linked to criminal or financially motivated actors, an 18% increase on the previous year.
“The severity of incidents has increased. During 2025/26 the NCSC recorded four incidents classified as C2, or Highly Significant. That’s as many in one year as were recorded over the previous 10 years.”
The report notes AI is also becoming part of the cyber crime toolkit, enabling more convincing phishing campaigns, scams and social engineering attacks.
It concluded that strong cyber security fundamentals remain the best defence against human and AI-enabled threats.
Robinson said the Government couldn’t protect every organisation from every cyber threat, and leaders who prepare now would be best placed to manage the challenges.
“Cyber crime has evolved into an industrialised global industry. Cyber criminals are becoming more persistent, aggressive and effective in their pursuit of payment through extortion and data theft.
“Boards, chief executives and senior leaders need to consider whether their businesses or organisations have the people, processes and resources needed to respond to a faster-moving cyber threat environment.”
Tom Raynel is a multimedia business journalist for the Herald, covering small business, retail and tourism.
- Stay ahead with the latest market moves, corporate updates, and economic insights by subscribing to our Business newsletter – your essential weekly round-up of all the business news you need.