Microsoft outage sparks fresh concerns about nation’s cyber protection and vulnerability

Friday’s Microsoft Outlook outage has sparked fresh questions about New Zealand’s vulnerability to global technology glitches and whether the Government was doing enough.

“From a cyber security perspective, the Government needs to be much more engaged,” frequent critic Don Christie said of Catalyst IT.

In early 2026, the officials laid out two new proposed categories of infrastructure that could be subject to mandatory minimum requirements to enhance cyber security and resilience.

Official documents said critical national infrastructure was “increasingly vulnerable to cyber attack”.

“Current regulatory settings are not designed to drive a consistent uplift in cyber security across the critical infrastructure system”.

It was acknowledged New Zealand’s approach was not keeping pace with other countries.

This week, Australia flagged changes to criminal law to crack down on future breaches by artificial intelligence (AI) companies, after a frontier AI agent hacked government systems for sensitive information in OpenAI tests.

The European Union has mandated stringent cyber security measures for operators of critical infrastructure since 2024.

The EU has also moved to boost the ways consumers and businesses determine which products are cyber secure, with more measures coming in two months ago.

The Government’s “Enhancing the cyber security of critical infrastructure” work revolves around public consultation that ran from February to April.

The Department of Prime Minister and Cabinet (DPMC) said: “Submissions have since been worked through to refine policy options.”

It said the 2026 submissions from the public would be shared in due course. However, the website carries submission from three years ago.

“Our intention is that submissions would be published on the DPMC website around the same time in 2027.”

Since the consultation in early 2026, the threats globally and here have escalated rapidly, and morphed greatly, with the advent of frontier AI models that have launched unauthorised, autonomous swarm attacks on government and commercial targets in testing.

In June, Five Eyes cyber agencies warned that frontier models would fundamentally alter offensive and defensive capabilities.

“The timeline is not years, it is months.”

In New Zealand, the National Cyber Security Centre said that, by early 2027, “malicious actors may have access to advanced AI capabilities currently available only through leading frontier AI models”.

Attacks could occur with little warning, it said in September.

Early 2027 coincides with when some policy on enhancing cyber security for critical infrastructure might emerge.

The proposals have envisaged “a minimum level of cyber risk management by all critical infrastructure entities” and effective management of cyber threats affecting national security.

In addition, a category of critical infrastructure of national significance could have additional obligations beyond the minimum requirements.

As of early 2026, the documents said: “Cyber risks are generally not well understood or collectively managed to a consistent level across New Zealand’s critical infrastructure system.”

The critical infrastructure work was signed off by Christopher Luxon as the Minister for National Security and Intelligence. It is part of a cyber security strategy 2026-2030 the Government put out in February.

RNZ asked officials what concrete achievements there had been.

“Alongside work to explore options for mandatory measures to improve cyber resilience and reporting, there are multiple streams of work underway,” the DPMC responded, listing improving incident reporting and advice, more practical guidances and support to critical infrastructure providers, and expanding government collaboration with industry partners to prevent, detect and respond to malicious cyber activity.