Confidence gap in cybersecurity readiness in New Zealand

Datacom's State of Cybersecurity Index has revealed a considerable gap between leadership confidence and employee readiness in New Zealand businesses regarding cybersecurity, bringing to light potential vulnerabilities in organisational defenses.

The survey results demonstrate a pronounced difference in perception between security leaders and employees. While 71% of security leaders in New Zealand expressed confidence that their employees are well-informed about cybersecurity issues, only 51% of employees shared this sentiment. This indicates a possible overconfidence among leaders regarding their organisation's cyber readiness.

Concerns over AI-based cyber-attacks are prominent among security leaders. Despite these concerns, many employees continue to use AI tools such as ChatGPT and Copilot, with only a minority engaging with their organisation's AI security policies. Chief Information Security Officer at Datacom, Collin Penman, noted the importance of closing this awareness gap in order to manage cyber risks effectively.

"Some organisations are getting this right, with business continuity and resilience plans in place, but they remain the exception rather than the rule. Leaders are overestimating employee preparedness, and that overconfidence increases cyber risk. With threats becoming more sophisticated and AI adoption rising, businesses need to double down on security investment and governance. The opportunity is there to leverage technology for growth, but it has to be done safely and responsibly," stated Penman.

Security burnout has emerged as a significant issue in New Zealand, with 61% of security leaders reporting feelings of fatigue, a figure that exceeds that of Australia at 58%. This burnout could potentially compromise the ability to maintain robust security measures.

"There is a real risk that businesses are operating with a false sense of security. Leaders believe their teams are ready to tackle threats, but this disconnect is leaving businesses exposed. Cybersecurity is only as strong as the organisation's weakest link, and if employees don't have the right training or awareness, security strategies won't hold up when they're most needed," commented Penman.

Data from The National Cyber Security Centre corroborates these findings, with a recorded 7,122 cybersecurity incidents in New Zealand in the last reported year, highlighting the growing challenge of cyber threats in the country.

"This demonstrates the pressing need for robust security frameworks and incident response capability," added Penman.

AI is increasingly being adopted by New Zealand businesses, with positive impacts reported by 80% of organisations, notably in automation and data analytics. However, the fast rate of adoption has not always been matched by the development of corresponding security governance frameworks, posing potential security risks.

"AI is proving to be a transformative force for businesses. The challenge now is to ensure security and governance keep pace with its adoption. A recent report projects an economic boost of NZD $76 billion by 2038 from generative AI, reinforcing its role in shaping the country's future economy," noted Penman.

There is a notable disparity in cybersecurity readiness between New Zealand and Australia, with New Zealand businesses less likely to have comprehensive cyber resilience strategies. This is coupled with lower employee awareness of AI security risks.

"New Zealand cannot afford to fall behind in cyber resilience. With AI adoption accelerating and cyber threats evolving, governance must be embedded into business and security frameworks. Cybersecurity investment supports business continuity, growth, and trust - because preventing a breach is always better than responding to one," emphasised Penman.

The survey contributing to these findings was conducted by TRA in November 2024, involving 211 security leaders and 506 employees from New Zealand and Australia.