Artificial intelligence is changing the way businesses work, but it is also changing the cybersecurity landscape.
New Zealand's National Cyber Security Centre (NCSC) has warned that artificial intelligence is being used by malicious actors to increase the speed, scale and sophistication of cyber attacks. Attacks can include more convincing phishing messages, personalised scams, deepfakes and automated reconnaissance.
The NCSC's Cyber Threat Report 2026, released in September, recommends that organisations strengthen their existing cybersecurity fundamentals and prepare for the changing threat environment.
For New Zealand businesses, this does not necessarily mean buying another security product. It means making sure the basics are working properly and reviewing whether existing protections are still suitable.
Here are seven practical areas businesses should focus on now.
1. Keep Systems and Software Updated
One of the most important cybersecurity measures remains keeping software and operating systems up to date.
Security vulnerabilities can be discovered in operating systems, applications, network equipment and other technology. Once a vulnerability becomes known, attackers may look for organisations that have not yet applied the available security update.
The NCSC has highlighted the importance of accelerating patching as AI can shorten the time between vulnerability discovery and exploitation.
Businesses should regularly check computers, servers, network equipment and important applications to ensure security updates are being applied.
2. Strengthen Your Identity and Access Controls
User accounts are an important part of business security. If an attacker gains access to a legitimate account, they may be able to access email, documents, applications and other business systems.
Multi-factor authentication (MFA) adds another layer of protection beyond a password.
Businesses should also regularly review:
- Who has administrator access
- Which users can access sensitive information
- Whether former employees still have active accounts
- Whether MFA is enabled where appropriate
- Whether unnecessary permissions can be removed
Good identity management can reduce the impact of a compromised password.
3. Be More Careful With Phishing and Impersonation
AI can make phishing and impersonation attempts more convincing. Messages can be written more naturally, personalised to the target, translated into different languages, and combined with convincing images, audio or video.
This means employees cannot always rely on spelling mistakes or obviously unusual wording to identify a scam.
Staff should be encouraged to stop and verify unusual requests, particularly requests involving:
- Bank account changes
- Urgent payments
- Passwords or authentication codes
- Confidential information
- Unexpected links or attachments
If a request appears unusual, verify it using a trusted communication method rather than simply replying to the original message.
4. Review Your Business's Attack Surface
Every internet-connected service or device can potentially provide another path into a business network.
The NCSC recommends reducing unnecessary system access and external connectivity.
Businesses should review whether they still need internet-facing services, remote access tools, unused accounts, old applications and other external connections.
Network equipment such as firewalls, routers, access points and remotely accessible services should also be reviewed regularly.
If something does not need to be exposed to the internet, consider whether it should be.
5. Replace Unsupported and Outdated Technology
Older technology can become increasingly difficult to secure when it reaches the end of its supported life.
Unsupported operating systems, outdated computers, old network equipment and legacy applications may no longer receive important security updates.
Businesses should maintain an up-to-date list of their technology and identify systems approaching the end of their useful or supported life.
Replacing equipment before it becomes an emergency can also make upgrades easier to plan and budget for.
6. Make Sure Your Backups Actually Work
Strong cybersecurity does not eliminate the possibility of a successful attack. Businesses also need a reliable way to recover if something goes wrong.
Backups are an important part of business continuity and recovery. However, simply having a backup job configured does not guarantee that the data can be recovered.
Businesses should regularly check:
- Whether backups are completing successfully
- Whether important systems are included
- Whether backup storage is available
- Whether backups are protected from unauthorised access
- Whether files and systems can actually be restored
A backup strategy should be tested rather than assumed.
7. Have a Plan for When Something Goes Wrong
Even well-protected businesses need to prepare for the possibility of a cybersecurity incident.
An incident response plan should make it clear who is responsible for taking action, how affected systems will be isolated, how important information will be protected, and who needs to be contacted.
The NCSC recommends preparing for incidents before they happen, including testing response plans and training teams.
A plan that has never been tested may not work as expected during a real incident.
AI Does Not Replace the Cybersecurity Basics
The arrival of more capable AI tools does not mean that businesses need to abandon their existing cybersecurity approach.
In fact, the fundamentals remain extremely important.
Keeping systems patched, using strong authentication, controlling access, protecting endpoints, maintaining reliable backups and educating staff can all help reduce the opportunities available to attackers.
The difference is that businesses now need to consider how quickly attackers can use new technology to improve their methods.
What Should NZ Businesses Do Next?
The latest NCSC guidance is a reminder that cybersecurity is an ongoing process rather than a one-time project.
Businesses should regularly review their technology, identify weaknesses and make sure their security controls are properly maintained.
You do not need to wait for an attack to discover that an important system was outdated, a backup was failing or an old account was still active.
How Imatec Can Help
At Imatec, we help businesses take a proactive approach to IT and cybersecurity.
From endpoint protection and Microsoft 365 to networking, backups, monitoring and ongoing IT support, our goal is to help businesses maintain reliable and secure technology.
We support businesses across Matamata, Tauranga, Waikato and the Bay of Plenty.
Is Your Business Ready for the Changing Cyber Threat?
AI is changing how cyber attacks can be created and delivered, but businesses can still take practical steps to reduce their exposure.
Review your systems, strengthen your security controls, educate your staff and make sure you have a reliable recovery plan.
If you would like help reviewing your business IT and cybersecurity, talk to the Imatec team today.
Matamata: 07 888 5627
Tauranga: 07 985 6255
Email: support@imatec.co.nz
Imatec — Your local IT experts in Matamata, Tauranga, Waikato, and the Bay of Plenty.