New Zealand Just Logged a Decade's Worth of Severe Cyber Incidents in One Year
I had a call last week with an infrastructure manager who told me, almost as an aside, that his org's "security team" is one person who also does the backups. He wasn't asking for sympathy. He said it the way you'd mention the lift's been slow for months. Just a fact of the building now.
Then the NCSC published its 2026 Cyber Threat Report and that conversation stopped feeling like an anecdote.
The Numbers
369 incidents of potential national significance in the 2025/26 year, up from 331 the year before. 162 of those had links to criminal or financially motivated actors, an 18 percent jump. Four were rated C2, the agency's "Highly Significant" tier, reserved for incidents that hit sensitive data or disrupt essential services at organisations the country actually depends on.
Four doesn't sound like much until you sit with the comparison the agency itself drew: that's roughly as many C2-rated incidents in one year as the decade before it produced combined. Not a bad quarter. Not a rough patch. A step change that the reporting period happens to have caught in the act.
Reported direct financial losses actually fell, to NZ$23.8 million from $26.9 million. Read that as good news for about four seconds, then remember these are only the losses organisations chose to report, in dollars, which is a fairly narrow definition of damage when the incident in question took down a service instead of draining an account.
The Part That Should Worry You More Than the Count
The NCSC's warning isn't really about this year's tally. It's about next year's. The agency is on record, alongside its Five Eyes counterparts, that frontier AI is now expected to let attackers identify and exploit vulnerabilities at a speed and scale security teams haven't had to plan for, and the capability gap between what today's criminal groups can do and what the leading AI labs can do is expected to close within months, not years.
Sit with what that actually means operationally. The attacker who currently needs a few skilled people and a few days to find your exposed RDP port or your misconfigured S3 bucket is about to need neither the people nor the days. The queue of things your two-person security function hasn't gotten to yet doesn't get smaller because the attacker got faster. It gets found sooner.
Nobody's Resourcing for This Yet
Here's the gap I'm actually watching from where I sit. The threat curve bent upward hard enough that the national cyber agency felt the need to say so publicly, twice this year. The hiring curve for the people who respond to this stuff didn't bend at all.
Most mid-sized NZ organisations I talk to still run security as a function bolted onto infrastructure, a shared responsibility rather than a staffed one, the kind of arrangement that works fine right up until the quarter it doesn't. That arrangement was always a bet that the bad year wouldn't land on your org specifically. The NCSC's numbers are telling you the odds on that bet just got worse, nationally, not anecdotally.
This isn't a pitch to panic-hire a SOC team by Friday. It's a smaller ask than that. Look at who in your organisation is actually accountable for noticing and responding to an incident, today, by name. If the honest answer is "the infrastructure manager, when he has time," you already know what the NCSC report is telling you. You just haven't said it out loud in the room where budget gets approved.
What I'd Actually Do With This Report
Don't lead with the AI warning in your next budget conversation. Executives have heard "AI will change everything" enough times this year that the phrase has stopped landing. Lead with the decade comparison instead. Four C2 incidents in twelve months, matching the previous ten years, is a number a board can hold in its head, and it's a number that happened to organisations that looked, on paper, a lot like yours.
Then ask the question the report is quietly forcing: if the frequency of serious incidents just stepped up a decade's worth in one year, does the headcount responsible for catching them reflect that, or does it still reflect how things looked three years ago when nobody expected this?
Most of the time the honest answer is the second one. That's not a failure of planning. It's just what happens when threat data moves faster than hiring cycles. The fix isn't complicated. It's just overdue.
Lexel places specialist security, cloud, and infrastructure talent across New Zealand, including the people organisations are about to realise they should have hired before this report came out.