Cyber criminals will only get smarter and bolder in 2026 - Patrick Sharp
THE FACTS
- Cyber criminals are becoming bolder, using AI to enhance attacks and targeting supply chains.
- Kordia reports 59% of businesses experienced cyber attacks, highlighting the need for increased vigilance.
- Complacency in small businesses remains a major risk, as they are seen as low-hanging fruit.
If this year has told us anything, it’s that cyber criminals aren’t slowing down. They’re working harder and faster than ever before, especially as AI supercharges attacks at a rate we’ve never seen before.
High-profile cyber attacks – such as the Asahi and Jaguar Land Rover incidents in the UK, and the Qantas breach which saw New Zealand customers’ personal data being leaked on the dark web – demonstrated how vulnerable even the world’s biggest brands can be. As we look to 2026, the threat landscape will become even more complex, with hardened criminals making the most of the latest tools.
With the latest research from Kordia showing 59% of businesses in New Zealand suffered a cyber attack or incident in the last year, organisations need to be more vigilant than ever.
Here are some of the cyber trends to look out for next year.
1. Cyber criminals will be even more audacious
Cyber criminals will become bolder and more confident, spurred by the success of some high-profile breaches in 2025. Identity-based attacks and social engineering – basically, psychological manipulation – are very effective, and criminals will double down.
To get the most “bang for buck”, we’ll likely see more cross-industry attacks and those focused on disrupting supply chains. These are highly impactful, which means more lucrative – and attackers know it. When Jaguar Land Rover’s supply chain was hit, the UK Government stepped in with a £1.5 billion ($3.4b) loan to offset the impact on smaller suppliers, such was the flow-on impact on the wider economy. If an Air New Zealand or a Fonterra faced a similar attack, would the New Zealand Government be prepared to make a similar move?
2. Global instability will continue fuelling cyber warfare
Behind the ongoing conflicts around the world, there are largely invisible, but just as destructive, battles happening in parallel. Cyber crime is increasingly becoming a proxy for war, whether it’s through espionage, attacking key infrastructure or fuelling social division.
New Zealand organisations need to be vigilant. Distant geopolitical tensions can have very real local effects. Nation-state actors overseas may not target us directly, but our companies and systems often sit within the blast radius of their campaigns.
3. Old tricks still work – and they’re evolving
Cyber criminals will rely on tried and tested methods, simply because they still work. Humans may be distracted or unaware of the prevalence of attacks, so social engineering remains a favourite tool. But the methods are evolving: vishing (voice-based phishing) and video deepfakes are getting more sophisticated, and can bypass traditional detection tools.
Meanwhile, many businesses have moved their operations to the cloud without investing in cloud security expertise. Unsecured web applications remain a common entry point, and a gift to hackers. The rapid rise of vibe coding (using AI to code) could also introduce fragile, poorly tested code that invites exploitation.
4. AI will create more security problems than it solves
Attackers are already using AI to scale up and personalise phishing emails, and create deepfakes of videos and audio to gain unauthorised access. Generative AI lowers the barrier to entry for almost anyone to pull off sophisticated scams.
Businesses will continue to jump on the AI hype and try to use it to transform operations. But rushing into it, on shaky security foundations, will create more vulnerabilities – both accidental and malicious. Employees using AI may be inadvertently pouring sensitive data and confidential business information into AI tools, with little visibility from the IT security team until it leaks out in a data breach.
Expect 2026 to bring more sensational AI-native cyber attacks, but the real damage will come from more mundane AI misuse and poor implementation.
5. Complacency will remain the biggest risk for small businesses
In the midst of rapidly developing tech and smarter cyber criminals, our ‘she’ll be right’ attitude could be our biggest enemy.
New Zealand is a nation of small businesses, and many owner-operators assume they’re too small or obscure to be targeted, or that cyber security is purely an IT issue. The truth is that every organisation holds something of value to criminals, whether it’s money or personal data. Without the right skills and vigilance, this complacency will continue to cost us dearly.
The truth is, cyber crime is a business – as larger businesses bolster defences, smaller businesses present low-hanging fruit. With AI enabling hackers to scam businesses faster and more efficiently, even extracting a few thousand dollars from a handful of victims a week can be an extremely cost-effective endeavour.
Staying protected in turbulent times
Facing so many threats, and an overwhelming range of cyber security tools and services, it’s not getting any easier for business leaders. A trusted security professional can be an important adviser, helping you make the right calls specific to your business. But even some basic hygiene, such as training staff on how to spot phishing, good password practices, and regular patching and updating of software, can go a long way to securing your business.
Above all, humans remain the foundation of good security. Technology is only as effective as the people and processes that support it. Tools and processes can help enforce security, but ensuring your people have the right knowledge and understanding of cyber threats is critical for protecting your business, and recovering from an almost inevitable attack.
2026 will bring more sophisticated tools, more ambitious criminals and more opportunities for mistakes. But with awareness, good governance and a people-first approach, businesses can stay one step ahead.
Catch up on the debates that dominated the week by signing up to our Opinion newsletter – a weekly round-up of our best commentary.