The National Cyber Security Centre released its Cyber Threat Report 2026 on 24 September, covering 1 July 2025 to 30 June 2026. There’s one number in it that made me stop and read it twice.
The NCSC rated four incidents during the year as C2, or “highly significant”. That’s as many as in the previous ten years put together. (For context, the worst incidents the year before were rated C3, and C2 is only one step below a national cyber emergency.) In her foreword, NCSC head Catriona Robinson doesn’t sugar-coat it: “many New Zealand businesses and organisations could do better.”
The numbers in brief
- 4,673 reports in total: 3,627 from individuals and 671 from organisations. Overall reporting has been falling since 2021, partly because CERT NZ became part of the NCSC and more people now report scams straight to their bank.
- 369 incidents were flagged as potentially nationally significant.
- 162 were linked to criminal or financially motivated attackers (up from 137), and 86 to suspected state-sponsored actors (up from 82).
- About a third of the higher-impact incidents hit government, councils and defence. Attacks on health care, social assistance and education all doubled.
- Victims who shared their losses reported $23.8 million in direct financial losses, down from $26.9 million.
So fewer reports overall, but the serious ones are getting more serious.
AI is changing the game (for both sides)
The first of the report’s five key judgements is that frontier AI will “supercharge” both the risks and the opportunities. The NCSC expects the most capable AI tools to help attackers find zero-day vulnerabilities faster, automate reconnaissance and brute-force attacks, and make phishing and deepfakes far more convincing.
They also put a date on it. The NCSC thinks that by early 2027, criminals may have access to capabilities that today only exist in the leading frontier models, and that disruptive incidents could arrive with very little warning.
The other four judgements won’t surprise anyone who reads our posts: state-sponsored activity isn’t going away, cybercrime and extortion are getting more severe, digital supply chains are a big risk, and social engineering still works.
A North Korean IT worker in a New Zealand business
This one should get the attention of anyone hiring remote IT staff or contractors. The NCSC says it has seen a North Korean IT worker secretly land remote IT work with a New Zealand business, earning money for the North Korean state. Apart from breaching UN sanctions (which apply in New Zealand law), it puts the employer at risk of espionage and extortion, because the “employee” has legitimate access to internal systems from day one.
If you hire people you never meet in person, identity checks during recruitment and onboarding are now a security control, not just an HR box to tick.
The basics still matter most
For all the talk of AI, the report’s conclusion is refreshingly simple: strong security fundamentals are still the best defence against both human-led and AI-driven attacks. The NCSC also makes it very clear who is responsible. In Robinson’s words, “Government cannot protect every organisation from every cyber threat. Leaders are responsible for cyber security within their organisations.”
That’s the message we give every client. MFA set up properly, patching that actually happens, backups that have been tested, and staff who know what a phishing email looks like. Get those right and you’ve closed off most of the ways in.
Source: NCSC Cyber Threat Report 2026 and supporting key judgements and incident analysis.
Not sure if you’ve got the basics covered? Book a free health check, or call us on 0800 688 768.