New Zealand businesses are increasingly adopting Artificial Intelligence (AI) for productivity gains, but this rapid integration is exposing them to significant and escalating cyber risks. A growing number of cyber-attacks are leveraging AI vulnerabilities, while the unauthorised use of AI tools by employees, known as ‘shadow AI’, creates new blind spots and data sprawl, exacerbating existing security weaknesses.
Key Takeaways
- AI adoption is outpacing robust security measures, creating a significant vulnerability gap.
- "Shadow AI" and improper employee use of AI tools are major contributors to data breaches and increased cyber threats.
- Existing cyber threats like ransomware and phishing are being amplified in speed and sophistication by AI.
- Many New Zealand businesses lack basic cyber security practices and board-level attention to cyber risk.
- There’s a call for stronger government intervention, including updated legislation and mandatory reporting, to bolster national cyber resilience.
The AI Security Paradox
While AI promises enhanced efficiency and automation, its implementation in New Zealand is often occurring within environments already strained by legacy systems, cloud disruptions, and workforce shortages. This creates a "GenAI Divide" where investment in AI tools doesn’t translate into widespread transformation due to underlying security deficiencies. The unmonitored adoption of AI tools by staff, often to simplify tasks, leads to data sprawl and inconsistent workflows, adding complexity to already challenging IT landscapes.
Amplified Cyber Threats
AI is not only creating new vulnerabilities but also accelerating familiar cyber threats. Attackers are using AI to craft more convincing phishing emails, imitate voices, and automate attack stages, making them harder to detect. This has contributed to a significant increase in financial losses due to scams. Ransomware, business email compromise, and targeted phishing remain the most damaging threats, with AI making them faster and more scalable. The speed and scale of these attacks are increasing, catching more New Zealanders off guard.
Gaps in Basic Security
Research indicates a concerning trend: many New Zealand businesses are failing to implement fundamental cyber security measures. A significant portion of companies do not report cyber risks to their board or practice their incident response plans. Furthermore, a quarter of businesses lack any cyber security awareness or training programs. This oversight is particularly problematic as AI threats emerge, with almost half of businesses lacking policies to protect against AI data breaches.
The Need for Stronger Foundations
Experts stress that AI’s potential for productivity gains will be stalled if New Zealand businesses do not address their foundational security issues. This includes improving clarity, visibility, and control over their digital environments. Integrated security tools, a clear view across networks, and actionable processes are crucial. The call for onshore, connected security infrastructure is growing, ensuring data is held locally and providing a more complete view of network activity. Enhanced training, robust culture, and clear processes for reporting incidents are also vital safeguards.
Government's Role in Cyber Resilience
There is a growing consensus that government intervention is necessary to strengthen New Zealand’s cyber posture. Businesses are requesting more education programs on best practices, harsher penalties for data protection failures, and legislation to make ransom payments illegal. Mandatory reporting requirements for major cyber-attacks, similar to Australia’s model, are also being advocated for to improve transparency and understanding of the true impact of cybercrime. The government is currently consulting on measures to enhance the cybersecurity of critical infrastructure, acknowledging that current readiness is only "barely passable."
Sources
- Productivity gains from AI will stall unless New Zealand fixes its security foundations, SecurityBrief New Zealand.
- NZ businesses facing increased cyber risk from AI, Reseller News.
- Kiwi businesses lack basic security measures as AI threats emerge, Reseller News.
