Back in 2024, New Zealand was ranked behind Nigeria as one of the five worst-prepared countries in the world for cybersecurity, alongside Mexico, Egypt, Peru and Argentina.
Earlier this year, the GCSB stated that New Zealand struggles to meet even the foundational levels of cybersecurity that should be expected of organisations:
In 2024, an assessment by the Australian Federal Police (AFP) of New Zealand’s cybercrime capabilities identified numerous weaknesses and gaps.
“NZPol lacks the capability and capacity to undertake high-level cyber-dependent crime investigations,” stated the assessment, which was newly released under the Official Information Act (OIA).
This meant officers were quick to abandon cybercrime investigations or leave them to “technology enthusiasts amongst the ranks and those few with ‘an interest’ in technology”, the report said.
So NZ didn’t have a glowing report and since then the Threat landscape has evolved horribly.
So how do our Government organisations stack up to protect Kiwis?
NCSC
I’m not really sure what services the NCSC actually offers.
The Malware Free Networks (MFN) feed is a terribly low-confidence threat intelligence feed. It’s full of botnet IP addresses scanning the internet, mostly looking for open Telnet or SSH ports.
The NCSC claimed that the feed prevented $48 million worth of cyber harm, according to the GCSB Annual Report 2025. But how exactly do they arrive at this figure? I would love to see the formula.
In particular, organisations consuming the feed are expected to provide telemetry on the blocks it generates. Yet the vast majority (95%+) of this traffic consists of botnets attempting to access ports that were never open in the first place. How much of this can realistically be attributed to prevented cyber harm?
When malicious activity involving a compromised New Zealand domain is reported to the NCSC, rather than temporarily blocking the domain to prevent it from being used against the New Zealand public, they would seemingly rather leave it accessible.
Admittedly, doing so would impact the original New Zealand company whose domain has been compromised, but only for a short period. Surely the greater good would be protecting other New Zealanders from falling victim to the same activity.
Who knows, perhaps the telcos consuming the MFN feed are blocking this traffic before it ever reaches end organisations, which would explain why those organisations never see any hits. However, this hasn’t stopped security companies from trying to hawk this near-useless feed to customers for a fee.
Apart from that, the only real positive I can point to is Jordan Heersping, who does his best to provide useful assistance to New Zealand organisations.
CERT NZ did punch above its weight and tried to offer genuinely useful services to the New Zealand public. Unfortunately, that disappeared when it was absorbed into the NCSC at the behest of the government, ostensibly to save money.
Police
The cybercrime unit is under-resourced and under-supported, meaning that reporting cybercrime to the police is little different from having your car broken into.
You report the incident so that you can subsequently lodge a claim with your insurer. However, you wouldn’t seriously expect New Zealand Police to do anything particularly useful to assist you.
Since the 2024 Australian Federal Police assessment, the threats have continued to increase. An internal review in April 2026 found that police still lacked the tools to tackle what many stakeholders described as “the new front line” of crime.
Ministry Of Justice
Its a simple matter of looking at Barry Young the former Te Whatu Ora employee who rose to national attention in 2023 after accessing and disclosing Te Whatu Ora data without authorisation. He has since faced criminal charges, which STILL remain before the courts. Young has maintained that his actions were motivated by what he believed was the public interest. He doesn’t deny accessing or disclosing the data, just to why. The fact that this is dragging on 3 years says enough.
NZ Domain Name Commission
I truly hope the Domain Name Commission (DNC) is under-resourced, as at least that would explain why it seems to do so little to help.
Malicious entities that are being hounded out of other countries for abusing their domain registration services are seemingly free to re-register any New Zealand domain they want. They then use these domains to trick New Zealanders into visiting websites they had no intention of visiting, in an attempt to part them from their money.
All of this happens without any real attempt to hide their identities or their activities, yet the DNC appears to do little to prevent or clean up this activity.
Lodge a complaint and nothing happens. So why bother reporting it the next time?
Privacy Commissioner
Let’s look at the Manage My Health incident.
There was plenty of uproar and plenty of calls for greater fines to be imposed for serious privacy incidents such as this. But, as always, the noise quickly died down. Where are all those people calling for change now?
The best the Privacy Commissioner seems able to do is issue a compliance notice, which carries a penalty of $10,000 if it isn’t followed.
This is effectively what happened in the Manage My Health incident, with the Privacy Commissioner threatening to impose a $10,000 fine on both Health NZ and Manage My Health if they failed to complete certain actions.
Whether those actions will be properly audited six months down the track is another question. I however, very much doubt it.
If either organisation refused to comply, the Privacy Commissioner could then take the matter to the Human Rights Tribunal to pursue the penalty.
Bear in mind that the Human Rights Tribunal has a multi-year backlog. Suddenly, pursuing a $10,000 penalty becomes more of a penalty for the Privacy Commissioner themselves than a meaningful consequence for the organisations at fault.
Five Eyes
Let’s face it, New Zealand seems to wait for one of the other Five Eyes countries to publish something before NZ signs on the bottom of the Advisory saying, “Yes, us too!” Its like we thought the #MeToo movement was working so we adopted the five eyes #UsToo approach
I cannot recall New Zealand being the initial author of a single Five Eyes cybersecurity advisory. It makes me wonder what the other 4 countries thinks of us.
So, is New Zealand one of the least cyber-prepared countries in the world?
Well, yeah, probably.
All the evidence points to it.
Our best bet might be to proactively remove ourselves from world maps so that nobody knows we’re here.
Or maybe we join the Commonwealth of Independent States (CIS) alongside Armenia, Azerbaijan, Belarus, Kazakhstan, Kyrgyzstan, Russia, Tajikistan, and Uzbekistan. Hopefully all those Russian threat groups will exclude us from their attacks along with the other CIS members. We don’t have to contribute to anything proactively, very much like what we do for the Five Eyes partnership. When Qilin say we will exclude these countries from our ransom attacks, we can say “#UsToo”!
How do we fix it?
There are a few things we could do:
1. Demand defendable metrics for government cybersecurity spending.
Whoever receives the money should be required to provide defendable metrics explaining what they’re delivering. Then actually quiz them on those metrics. We need to know whether the money is making a measurable difference, rather than simply accepting whatever figures are presented.
2. Focus on sharing intelligence quickly and for free.
The NCSC should just dig a hole and bury the MFN service.
Take half the money we waste on it and offer it to the Australian Signals Directorate (ASD), in exchange for allowing New Zealand organisations to contribute to and consume its Cyber Threat Intelligence Sharing (CTIS) feed.
3. Disrupt cyberattacks wherever possible.
We need to be more proactive about disrupting cyberattacks, however we can. Break a couple of eggs in the process if we must, just try to keep the eggs small.
4. Consolidate the funding and resources we already have.
We don’t have enough money to throw $30 million at every government organisation to fix its cybersecurity issues (certainly not if MBIE gets its hands on it). If our first go to is alwasy we need more money then we will never achieve anything. There’s always something you can do.
The government likes creating mega-agencies, so why not create a dedicated Cyber Security Agency? (No, not the NCSC, they had their chance)
This agency should be responsible for:
- Providing threat intelligence services across all government organisations.
- Consuming and sharing malicious IOCs across those organisations.
- Vulnerability Information sharing. Enter in your technologies and we will watch the vendor advisories and vulnerability databases as communicate out at speed what ight impact your organisation.
- Championing cybersecurity forums and ensuring New Zealand actively participates in international cybersecurity collaboration.
- Delivering free cybersecurity training, guidance and documentation for all New Zealand organisations, not just government agencies. Yes there will be a wait list initially but this agency will just have to work out how to deliver to the needs.
We need to consolidate what we have, make better use of existing resources and focus on delivering practical outcomes that actually improve New Zealand’s cybersecurity posture.
If we do all of the above, I’m sure we can take the sixth-worst position away from Nigeria! Go team NZ!
