24 September 2026
The Cyber Threat Report 2026, released today, assesses the cyber security risks facing New Zealand businesses and organisations and highlights the actions leaders should take to strengthen their cyber resilience.
“Cyber security is now a critically important consideration for every New Zealand business and organisation,” says Catriona Robinson, Head of the NCSC.
“The cyber threat landscape is changing faster than ever. Alongside familiar threats from cybercriminals and state actors, businesses and organisations face a powerful new disruptor in the form of frontier artificial intelligence.”
“We are also seeing new types of threat emerge, including that of a North Korean IT worker clandestinely obtaining remote IT work with a New Zealand business in order to earn foreign currency for the North Korean state. This kind of activity is subject to UN Sanctions which have effect under New Zealand law and also creates risks of espionage and extortion for businesses that are targeted.”
The report's leading judgement is that artificial intelligence is rapidly reshaping the cyber landscape and that frontier AI will supercharge both risks and opportunities.
“AI offers many opportunities, but it is already being used by malicious actors to increase the speed, scale and sophistication of cyber attacks,’ Ms Robinson says. ‘The next generation of frontier AI models could automate attacks, identify vulnerabilities and enable highly personalised targeting of organisations and individuals.”
The NCSC believes that the trajectory of AI development is such that, by early 2027, malicious actors may have access to advanced AI capabilities currently available only through leading frontier AI models. The report warns that disruptive incidents may occur with little warning and that organisations should prepare now.
“Boards, chief executives and senior leaders need to consider whether their businesses or organisations have the people, processes and resources needed to respond to a faster-moving cyber threat environment.”
The report also highlights the growing severity of cybercrime. Of the 369 incidents of potential national significance handled by the NCSC during 2025/26, 162 were linked to criminal or financially motivated actors, an 18 percent increase on the previous year.
“The severity of incidents has increased,” said Ms Robinson. “During 2025/26 the NCSC recorded four incidents classified as C2, or Highly Significant. That’s as many in one year as were recorded over the previous ten years.”
“Cybercrime has evolved into an industrialised global industry. Cybercriminals are becoming more persistent, aggressive and effective in their pursuit of payment through extortion and data theft. As well as the harm they cause to businesses, these attacks cause harm to New Zealanders whose personal information is stolen and potentially sold to other criminals or malicious actors.”
The report notes AI is becoming part of the cybercrime toolkit, enabling more convincing phishing campaigns, scams, and social engineering attacks. It concludes that strong cyber security fundamentals remain the best defence against both human and AI-enabled threats.
“Government cannot protect every organisation from every cyber threat. Leaders are responsible for cyber security within their organisations, and those who prepare now will be best placed to manage the challenges of frontier AI,” said Ms Robinson.