Frontier AI’s next generation may automate incidents: cybersecurity centre head
The National Cyber Security Centre (NCSC) recently published its Cyber Threat Report 2026, which examines the cybersecurity risks encountered by New Zealand businesses and organisations amid the frontier artificial intelligence (AI) developments swiftly altering the cyber environment.
“Government cannot protect every organisation from every cyber threat,” said Catriona Robinson, the NCSC’s head, in a news release. “Leaders are responsible for cyber security within their organisations, and those who prepare now will be best placed to manage the challenges of frontier AI.”
Stressing the importance of cybersecurity for all businesses and organisations, the NCSC encouraged leaders to:
“Boards, chief executives and senior leaders need to consider whether their businesses or organisations have the people, processes and resources needed to respond to a faster-moving cyber threat environment,” Robinson said in the news release.
The report touched on the familiar threats posed by cybercriminals and state actors.
“We are also seeing new types of threat emerge, including that of a North Korean IT worker clandestinely obtaining remote IT work with a New Zealand business in order to earn foreign currency for the North Korean state,” Robinson said in the news release.
“This kind of activity is subject to UN Sanctions which have effect under New Zealand law and also creates risks of espionage and extortion for businesses that are targeted,” she added.
The report found that AI can help cybercriminals make their phishing campaigns, scams, and social engineering attacks more persuasive.
“AI offers many opportunities, but it is already being used by malicious actors to increase the speed, scale and sophistication of cyber attacks,” Robinson said in the news release.
Upon considering the growth of AI technologies, the NCSC expressed its belief that malicious actors may gain access by early 2027 to the advanced capabilities presently limited to frontier AI models.
“The next generation of frontier AI models could automate attacks, identify vulnerabilities and enable highly personalised targeting of organisations and individuals,” Robinson said.
According to the report, among the 369 incidents of potential national significance with which the NCSC dealt in the 2025–26 period, 162 had links to criminal or financially motivated actors, representing an 18 percent rise from the preceding year.
“During 2025/26 the NCSC recorded four incidents classified as C2, or Highly Significant,” Robinson said in the NCSC’s news release. “That’s as many in one year as were recorded over the previous ten years.”
Robinson emphasised that cybercrime can endanger not only businesses, but also individuals if cybercriminals steal their personal information and sell it to their fellow criminals or malicious actors.
Here are some other news stories relating to cyber incidents.
This month, Privacy Commissioner Michael Webster issued compliance notices to Manage My Health (MMH) and Health New Zealand for failing to adhere to the security requirements of r 5 of the Health Information Privacy Code 2020 during a cyber incident in late December 2025.
In July, the High Court of New Zealand acceded to MMH’s request for a permanent injunction over stolen patient data after previously issuing an interim injunction.
Enjoy this story? Read the latest TMT (telecoms, media, technology) news on the main page!
