Pūrongo Tuma ā-Ipurangi 2026 Cyber Threat Report 2026

Foreword | Whakapuakitanga

The cyber threat landscape is changing faster than ever

Catriona Robinson
Deputy Director-General National Cyber Security Centre

Prepare now for the impact of AI 

The 2026 Cyber Threat Report is being published at a time of particular  volatility and disruption in the global environment.

New Zealand businesses and organisations are operating in a more fragmented global and regional security environment, impacted by shifting power balances and ongoing conflicts.

Disruption isn’t new. But now, to well-known factors such as geo-strategic competition and economic rivalry, we can add a powerful new disruptor: the 
deployment of frontier AI tools, with the challenges and opportunities they bring.

Leaders are responsible for cyber security

This report provides the National Cyber Security Centre’s (NCSC) assessment of the key cyber security risks and threats facing New Zealand businesses and organisations. It is intended primarily for New Zealand leaders and decision makers, but it will also be relevant to anyone interested in cyber security. As you read, I encourage you to consider the potential implications of these threats for your organisation or business.

My message to leaders is that cyber security needs your attention now more than ever. Based on the harm and impact that the NCSC is seeing, many New Zealand businesses and organisations could do better. 

While Frontier AI features strongly in this year’s report, so do the familiar threats posed by cybercriminals, state actors, and issues around supply chains and social engineering. 

Government cannot protect your business or organisation from all the cyber threats identified in this report; that is your job. You are best placed to decide on the investments you make and how your staff and teams manage security. At the NCSC, we want to help you make informed decisions based on reliable threat information. This report aims to strengthen your understanding of the cyber threat environment and support efforts to improve your cyber security. 

Advanced AI is here 

Frontier AI models, the most advanced artificial intelligence systems, are putting reasoning and analytical capabilities previously accessible only to advanced nation states and the largest organisations, into the hands of individuals and groups. These models are supercharging existing trends in the global environment, with impacts that can be seen everywhere from the battlefield to the boardroom, and from global stock markets to the search engine on your mobile phone.

While the broader impacts of frontier AI are unpredictable, in the cyber security area we know it will enable faster identification of zero-day vulnerabilities, accelerate the reconnaissance of systems, automate brute force attacks and enhance the creation of phishing scams and deep-fakes.

At the NCSC we are focusing our efforts on understanding how these frontier AI models can support cyber defence, and developing actionable advice for New Zealand businesses, organisations and government about how to protect sensitive information and systems from malicious cyber actors.

Meanwhile leaders should be asking if their business or organisation is prepared for the impact of frontier AI on cyber security. Do you have the systems, processes and resources to patch systems more often, respond to vulnerabilities and breaches, and keep your people and their information safe and secure? If you are thinking about adopting AI tools for business purposes or to enhance cyber security, have you considered how to do this safely and responsibly?

State actors and cybercriminals are active in New Zealand

Much of this report focuses on the impact of AI now and into the future. But we must remember that state actors and cybercriminals are already causing significant harm to individuals, businesses and organisations. The number of reported incidents we classify as potentially of national significance increased last year, with an 18% increase in criminal or financially motivated incidents. 

We expect New Zealand businesses, organisations and individuals will continue to face a significant volume of malicious cyber activity driven by eroding global norms of behaviour, overseas conflict and rapid changes in technology. State actors and cybercriminals are rapidly adapting their tools and techniques, taking advantage of AI to deliver cyber threats at greater speed and scale using automated attacks, customised social engineering techniques, and exploitation of personal information and credentials.

Preparation is more important than ever

The NCSC’s assessment is that the threats described in this report are here, now, and represent a tangible risk of business disruption. Given the transformational effect of new technologies, there may be little warning of disruption before it happens, and some threats may not be preventable. If you think it can’t happen to you, you’re wrong.

This reshaping of the threat environment demands the attention of leaders including Boards, CEOs and CIOs. Organisations should prepare for cyber disruption, and you need to start making changes at a governance and operational level to be better prepared.

Fortunately, there are real, practical actions that organisations and businesses of all sizes and capabilities can put in place to defend your systems from cyber threat. Information about these actions is included in this report, together with guidance about the big issues which we believe leaders should be focusing on.

Too many New Zealand organisations still aren’t doing the basics of cyber security right. This is our greatest challenge and our greatest opportunity. The good news is we know what we need to do, and that taking action will protect you against last year’s human and this year’s AI-enabled threats.