Artificial Intelligence Is Changing the Cybersecurity Landscape
Artificial intelligence is transforming how people work, communicate and manage their digital lives. From smart assistants and online banking to cloud-based business platforms, AI-powered technology is becoming part of everyday life in New Zealand. Yet alongside these opportunities, a new generation of cybersecurity risks is emerging, prompting businesses, government agencies and individual consumers to reconsider how they protect their information.
New Zealand’s National Cyber Security Centre (NCSC) released its 2026 Cyber Threat Report on 24 September, warning that advanced AI is accelerating the speed, scale and sophistication of cyberattacks. The report highlights familiar dangers, including cybercrime, phishing, data theft and state-sponsored activity, while explaining how increasingly capable AI systems could make these threats more difficult to manage.
The message is clear: cybersecurity can no longer be treated as an occasional technical task. For New Zealand organisations and households alike, protecting digital information requires continuous attention, sensible habits and preparation for risks that may evolve faster than expected.
Why New Zealand Businesses Cannot Afford to Ignore AI Threats
New Zealand’s economy relies on interconnected digital services. Small retailers process online payments, professional firms store customer records in cloud platforms, schools depend on digital learning tools, and healthcare providers use technology to manage sensitive information. These systems improve convenience and efficiency, but they also create opportunities for attackers.
According to the NCSC, 369 incidents of potential national significance were handled during the 2025/26 reporting year. Of these, 162 were associated with criminal or financially motivated actors, representing an 18 per cent increase compared with the previous year. Four incidents were classified as highly significant, matching the total recorded across the preceding ten years.
These figures demonstrate why cybersecurity deserves attention beyond large corporations and government departments. A small New Zealand business may not hold nationally sensitive information, but losing access to its payment systems, customer database or online storefront could still threaten its ability to operate.
AI makes the challenge more complicated by helping malicious actors automate parts of their work. Tasks that once required substantial technical expertise can increasingly be assisted by accessible tools, allowing attackers to research targets, generate persuasive messages and adapt their approaches more quickly.
For business owners, the practical question is no longer whether AI will influence cybersecurity. It is whether existing systems and procedures are prepared for the consequences.
AI Phishing Is Becoming More Convincing
Phishing remains one of the most recognisable cybersecurity threats, but artificial intelligence is changing how fraudulent messages are created.
Traditional scam emails often contained obvious spelling mistakes, awkward phrasing or suspicious requests. Modern AI tools can produce polished, personalised messages that closely resemble legitimate communications from banks, suppliers, delivery companies or colleagues.
Imagine a New Zealand retailer receiving an email that appears to come from a regular supplier. It refers to a recent order, uses the correct business terminology and requests an urgent change to payment details. Everything appears plausible, yet the message directs the payment to an account controlled by a criminal.
AI can help attackers create this kind of convincing scenario at scale. Translation tools can also make scams more natural across languages, expanding the range of potential victims.
Businesses should therefore avoid treating professional writing, familiar branding or accurate personal details as proof of authenticity. Staff should verify unusual payment requests through a separate, trusted communication channel. Email addresses, account changes and unexpected attachments deserve particular scrutiny, especially when a message creates pressure to act immediately.
Consumers need similar caution. Unexpected messages about parcel deliveries, account suspension, refunds or security alerts should be checked through the organisation’s official app or website rather than through links supplied in the message.
Deepfakes Are Turning Trust Into a Security Risk
AI-generated audio and video introduce another layer of complexity. Criminals can use synthetic media to imitate voices, manipulate recordings or make fraudulent communications appear to come from trusted individuals.
For a New Zealand business, the danger could involve a supposed manager asking an employee to make an urgent transfer during a video call. For a family, it could be a convincing voice message claiming that a relative needs money immediately.
These scenarios exploit a fundamental human instinct: people tend to trust familiar voices and faces. As synthetic media improves, visual recognition and voice familiarity may become less reliable as informal security checks.
The solution is not to assume that every call is fraudulent. Instead, organisations should establish verification procedures for high-risk decisions. A second authorised person can approve substantial payments, while employees can confirm unusual instructions through a previously verified phone number.
Families can adopt a simpler version of the same principle. Before transferring money in response to an emergency request, contact the person directly using a known number and ask a question that only the genuine individual is likely to answer.
Technology can imitate appearances and voices, but independent verification provides an additional barrier that makes impersonation harder to exploit.
Why Everyday Devices Matter in Cybersecurity
Cybersecurity discussions frequently focus on servers, sophisticated software and large corporate networks. However, the devices people use every day also form part of the wider security picture.
Laptops, smartphones, wireless routers, smart televisions and connected home appliances may all contain software that requires updates. When devices remain unsupported or use weak passwords, attackers may exploit them to gain access, collect information or establish a foothold in a network.
A compromised laptop can expose saved passwords, work documents, browser sessions and private communications. The risk is especially significant when the same device is used for both professional and personal activities without appropriate separation.
Physical reliability also matters. A healthy laptop battery helps a device remain usable during travel, power interruptions or periods away from a charging point. However, battery condition alone does not determine cybersecurity. A fully charged computer can still be vulnerable if its operating system is outdated, its accounts are poorly protected or its owner downloads malicious software.
New Zealand households should review the security settings of their connected devices rather than assuming that equipment works safely simply because it is relatively new. Automatic updates, strong authentication and the removal of unnecessary applications can reduce avoidable exposure.
Home routers deserve particular attention because they connect multiple devices to the internet. Owners should replace default administrator passwords, install available firmware updates and disable remote-management features when they are not needed.
Remote Work Creates New Opportunities for Attackers
Flexible working arrangements have become an important feature of modern employment. Many New Zealand professionals access company systems from home, shared workspaces, regional offices or while travelling.
This flexibility can improve productivity, but it also expands the number of locations and networks through which sensitive information is accessed.
Public Wi-Fi, unsecured personal devices and poorly managed remote-access tools can expose organisations to unnecessary risk. Employees may also receive fraudulent login prompts designed to steal authentication details or approve unauthorised access.
Businesses should establish clear rules for remote work. Staff should use approved devices, connect through authorised security tools and enable multifactor authentication wherever possible. Sensitive work should not be transferred to personal email accounts or unapproved cloud storage simply because doing so appears convenient.
Device maintenance is another part of a reliable remote-work routine. A dependable laptop battery can support uninterrupted work during a commute or unexpected power disruption, while regular software updates and secure backups help protect the information stored on the computer.
Employers should also consider what happens when a device is lost, stolen or compromised. Remote-wipe capabilities, encrypted storage and a straightforward incident-reporting process can limit the consequences of an individual mistake.
Small Businesses Need Practical Protection, Not Just Expensive Technology
Large organisations may have dedicated security teams, but small and medium-sized businesses often operate with limited budgets and technical resources. This does not mean they must accept greater exposure without taking action.
The NCSC’s 2026 assessment emphasises that fundamental cybersecurity measures remain essential, even as AI changes the threat landscape. Businesses can make meaningful progress by prioritising a few well-established controls.
First, keep software and operating systems updated. Security patches can address vulnerabilities that attackers may otherwise exploit. Delays are particularly risky when a flaw becomes publicly known and malicious activity increases.
Second, use multifactor authentication for email, financial systems, administrative accounts and remote access. A stolen password should not automatically provide unrestricted access to critical services.
Third, maintain backups of important information and test whether those backups can actually be restored. Backups should be protected from unauthorised access so that an attacker who compromises the main network cannot simply destroy every recovery copy.
Fourth, limit employee permissions. Staff should have access to the information necessary for their roles, rather than unrestricted access to every business system.
Finally, prepare a written incident-response plan. Employees need to know whom to contact if they click a suspicious link, disclose a password or notice unusual activity. Early reporting can make a significant difference to how quickly an incident is contained.
These measures are not glamorous, but they often provide more practical value than purchasing advanced security products without establishing basic controls.
The Hidden Risks of Using AI at Work
AI is not only a tool used by attackers. New Zealand organisations are increasingly interested in using AI assistants to summarise documents, draft communications, analyse information and automate routine tasks.
These applications can save time, but they also introduce questions about privacy, permissions and data handling.
An employee might paste customer records into an unapproved chatbot to produce a report. A company might deploy an AI-powered customer service assistant without adequately restricting the information it can access. In either case, sensitive data could be exposed or processed in ways the organisation did not intend.
Businesses should establish an approved-use policy before AI tools become deeply embedded in daily workflows. The policy should identify which services employees may use, what information can be submitted and who is responsible for reviewing security settings.
AI systems connected to internal databases or business applications need particular care. Access should be limited to what is necessary, and organisations should test whether malicious prompts can persuade a system to reveal restricted information or perform unauthorised actions.
Third-party suppliers also deserve scrutiny. Before adopting an AI service, businesses should understand its data-handling practices, access controls, security commitments and incident-reporting arrangements.
The goal is not to prevent employees from benefiting from AI. It is to ensure that productivity improvements do not come at the expense of customer privacy or business continuity.
What New Zealand Consumers Can Do Today
Individuals do not need to become cybersecurity specialists to make their digital lives safer. A few consistent habits can reduce exposure to common threats.
Start by using unique passwords for important accounts and storing them in a reputable password manager. Enable multifactor authentication, particularly for email, banking and accounts that can be used to reset other passwords.
Install operating system and application updates promptly. Replace devices that no longer receive security support when practical, especially if they are used to access financial or sensitive personal information.
Be careful with unexpected links, QR codes, attachments and requests for payment. When a message claims to come from a bank, government agency or delivery company, navigate to the official website independently instead of relying on the supplied link.
Review the applications installed on your devices and remove those you no longer need. Check permissions for access to contacts, microphones, cameras and files. These steps can reduce unnecessary exposure of personal information.
Consumers should also protect the physical equipment they depend on. Maintaining a reliable laptop battery, using appropriate charging equipment and avoiding damaged batteries can help keep a computer available for essential tasks. For cybersecurity, however, the most important protections remain updated software, secure accounts and careful handling of information.
If an account appears compromised, change the relevant password from a trusted device, revoke suspicious sessions where possible and contact the affected service provider. If financial information may have been exposed, contact the bank promptly and monitor transactions.
Preparing for the Next Phase of AI-Enabled Attacks
The NCSC’s report makes an important distinction: AI creates new opportunities for cyber defence as well as new opportunities for malicious activity.
Security teams can use AI to help analyse alerts, identify unusual patterns and prioritise vulnerabilities. Automated monitoring may help smaller organisations respond to suspicious activity more quickly than manual processes alone would allow.
Nevertheless, defensive AI should not be treated as a complete solution. Automated systems can make mistakes, generate false alarms or miss sophisticated activity. Human oversight, appropriate testing and clear accountability remain essential.
Organisations should also prepare for faster-moving incidents. This means understanding which systems are critical, knowing how to isolate compromised devices, identifying who can authorise emergency decisions and rehearsing recovery procedures before an actual attack occurs.
For New Zealand, resilience matters across the entire digital ecosystem. A disruption affecting one supplier, managed IT provider or widely used platform can have consequences for many connected organisations. Businesses should understand their dependencies and consider how they would operate if a critical service became unavailable.
Cybersecurity is therefore not simply an IT department’s responsibility. It involves leadership, staff training, supplier management, technology investment and the everyday decisions people make when using digital services.
A Safer Digital Future Starts With Better Habits
New Zealand’s 2026 Cyber Threat Report is a timely reminder that the country’s digital future depends on more than faster networks and smarter software. It also depends on the ability of businesses, public institutions and individuals to protect the systems and information they rely on.
AI-powered attacks may become more personalised, more automated and harder to recognise. Yet the fundamentals of good security remain remarkably consistent: update systems, restrict access, verify unusual requests, protect sensitive information and prepare for incidents before they happen.
For consumers, these habits can help protect personal accounts and connected devices. For businesses, they can reduce the likelihood that a single compromised password or deceptive message becomes a serious operational crisis.
The most effective response to emerging cyber threats is neither panic nor complacency. It is informed preparation. By combining sensible technology choices with consistent security practices, New Zealand can make the benefits of AI and digital innovation more accessible while reducing the risks that accompany them.