The NCSC is handling roughly one incident per day of potential national significance.
86 of the 369 incidents the NCSC handled in 2025/26 were linked to suspected state-sponsored actors, and 162 to criminal or financially motivated actors (up 18% from 137). Four were classified C2, highly significant.
Why New Zealand organisations are in the crosshairs
Five shifts shaping the New Zealand threat environment — what the NCSC is saying publicly, and what it means for local organisations.
"Not big enough" is a mistake, the NCSC says
NCSC COO Michael Jagusch has warned that many New Zealand organisations wrongly assume they are not big enough, wealthy enough or critical enough to be a target. The NCSC notes that in New Zealand a few successful incidents can cause outsized disruption.
Salt Typhoon activity has been observed in New Zealand
86 of the 2025/26 incidents were linked to suspected state-sponsored actors. Salt Typhoon compromised at least nine US telcos, and network devices at a Canadian telco in February 2025. The NCSC reports Salt Typhoon activity was observed in New Zealand, and ASIO Director-General Mike Burgess said in November 2025 that Salt Typhoon has been probing Australian telecommunications networks.
Finance, energy, health and telecommunications are named as attractive targets
The NCSC's Cyber Threat Report 2025 names large companies in finance, energy, health and telecommunications as attractive targets because they hold valuable data and run critical services, and warns that AI-driven attacks could overwhelm traditional security teams.
Supply chains and hidden dependencies are the NCSC's named 2025 judgement
The fourth of the NCSC's 2025 key judgements is that "threat actors are exploiting supply chains, hidden dependencies and organisational blind spots to cause impact." This mirrors Verizon's 2026 DBIR finding that a third party was involved in 48% of breaches, up 60% on the previous year, and maps directly to New Zealand's reliance on shared MSPs, outsourced IT, and Australian-headquartered providers operating trans-Tasman.
The regulatory floor is rising
The NCSC's Minimum Cyber Security Standards set ten baseline standards for GCISO-mandated agencies, aligning PSR policy, the NCSC Cyber Security Framework and NZISM controls. The first self-assessment round ran from 1 November 2025 to 30 April 2026 through the PSR assurance process.
What experts are saying
Many New Zealand businesses and organisations make the mistake of assuming they are not big enough, not wealthy enough or not critical enough to be a target. In the changing geostrategic environment there are a range of reasons – from financial motivation to espionage and hacktivism – why an organisation in New Zealand may be targeted.
AI offers many opportunities, but it is already being used by malicious actors to increase the speed, scale and sophistication of cyber attacks. The next generation of frontier AI models could automate attacks, identify vulnerabilities and enable highly personalised targeting of organisations and individuals.
My message to leaders is that cyber security needs your attention now more than ever. Based on the harm and impact that the NCSC is seeing, many New Zealand businesses and organisations could do better.
New Zealand cybercrime is escalating in severity
The Waikato DHB ransomware led to a $16.5M insurance claim. The Mercury IT compromise cascaded across government agencies and health bodies. NZX trading was disrupted for four days. Autonomous pentesting makes continuous security validation achievable.
New Zealand government agencies are expected to apply the New Zealand Information Security Manual (NZISM), maintained by the GCSB; Crown entities, local government and private organisations are encouraged to use it. The NZISM is a comprehensive standard covering 20+ chapters of security controls. The Essential Eight, while an Australian framework, is used by some New Zealand organisations as a practical baseline alongside the NZISM. Private sector entities may also be subject to sector-specific requirements — RBNZ's Guidance on Cyber Resilience for financial services, the Health Information Privacy Code for health data, and the Telecommunications (Interception Capability and Security) Act for carriers. The Privacy Act 2020 applies to all organisations handling personal information.
New Zealand's information security standard maintained by the GCSB. Applies to government agencies; Crown entities, local government and private organisations are encouraged to use it. Chapters covering governance, personnel security, physical security, media security, and communications security are outside the scope of autonomous penetration testing.
Used by some New Zealand organisations as a practical baseline alongside the NZISM. Coverage mapping is identical to the Australian Essential Eight analysis.
All NZ agencies handling personal information must comply with the Information Privacy Principles and mandatory breach notification requirements.
Where NodeZero applies
Widely adopted across NZ government and private sector as a recognised information security standard, particularly for organisations with international operations.
Where NodeZero applies
Applies to NZ organisations that store, process, or transmit payment card data — including government agencies accepting online payments.
Where NodeZero applies
Relevant for NZ technology providers and managed service providers serving government or regulated industry customers.
Where NodeZero appliesA cascade of new obligations
Multiple new regulatory requirements are hitting simultaneously — each increasing the compliance burden and the consequences of failure.
Privacy Act 2020 — Mandatory breach notification
In effectOrganisations must notify the Privacy Commissioner and affected individuals of privacy breaches that have caused, or are likely to cause, serious harm. The Commissioner received 1,093 breach notifications in 2024/25, up 27%. NodeZero shows what personal information an attacker could actually reach, as evidence for IPP 5 security safeguards.
RBNZ Guidance on Cyber Resilience
In effectRBNZ's principle-based Guidance on Cyber Resilience expects regulated entities to test their cyber resilience regularly and keep boards accountable, with a periodic cyber capability survey. Evidence-based testing gives that survey something concrete behind it.
NZISM and PSR — Government security baseline
In effectThe NZISM is the Government's information security manual for agencies; Crown entities, local government and private organisations are encouraged to use it. The PSR sets protective security requirements for mandated agencies, which self-assess through the PSR assurance framework.
Te Whatu Ora cyber uplift
Funded 2021Health NZ consolidated 20 DHBs in July 2022. After the 2021 Waikato DHB ransomware, the Government funded up to $75.7 million over three years for health-sector cyber security uplift.
Find your organisation
See how the changes affect you specifically
Government & local authorities
Central government agencies and 78 local authorities. NZISM and PSR compliance requirements, largely self-assessed rather than tested.
View details →Critical infrastructure & state-owned operators
Crown-owned and private operators of New Zealand's energy, telecommunications and transport services.
View details →Finance & health
RBNZ-regulated banks and Health New Zealand | Te Whatu Ora.
View details →Why security teams trust NodeZero
Move from self-assessment to tested evidence
See how NodeZero provides affordable, continuous security validation for your NZ organisation