Cyber Summit Korea (CSK) 2026. (Source: CSK 2026 Cyber Summit Korea website)

CSK 2026 Keynote 3

Catriona Robinson on New Zealand's cyber threat landscape and national cyber resilience

Navigating the cyber threat landscape – New Zealand's experience

As new technologies like artificial intelligence (AI), the cloud, the Internet of Things (IoT), and digital supply chains spread rapidly, cybersecurity is no longer a problem for just a specific company or security staff alone.

As reliance on digital technology grows — from government administrative systems to corporate work environments, and even critical infrastructure across healthcare, finance, and telecommunications — the potential for a single cyber incident to affect services and economic activity across society as a whole is growing too.

Amid this shift, Cyber Summit Korea 2026 (CSK 2026), held at COEX Seoul from September 16 to 18, 2026, featured a range of discussions on the theme of the international cyber threat landscape and national-level response. CSK 2026 was hosted by the National Intelligence Service and the National Security Research Institute, and Catriona Robinson, Director of New Zealand's National Cyber Security Centre (NCSC), took part as a keynote speaker.

This keynote's topic was "Navigating the Cyber Threat Landscape – New Zealand's Experience."

Looking at the cyber threats New Zealand is experiencing and its national-level response helps in understanding the direction cybersecurity is shifting in today.

1. Who is Catriona Robinson?

Catriona Robinson is a key figure responsible for New Zealand's cybersecurity policy and response.

As head of New Zealand's National Cyber Security Centre (NCSC), under the Government Communications Security Bureau (GCSB), she leads the country's national-level cybersecurity work.

New Zealand's government announced in March 2026 that it had appointed Robinson as Deputy Director-General for cybersecurity at the GCSB and head of the NCSC. Robinson previously held a senior role in immigration at New Zealand's Ministry of Business, Innovation and Employment (MBIE), and before that worked on national security systems at the Department of the Prime Minister and Cabinet (DPMC).

The NCSC is an agency that supports cybersecurity and cyber resilience for nationally significant organizations in New Zealand. The GCSB is likewise described as a core government agency responsible for New Zealand's signals intelligence (SIGINT) and cybersecurity.

In other words, this CSK 2026 keynote wasn't simply a venue for introducing cyberattack techniques — it carried the significance of offering a look at the current threat landscape and national-level response, as seen by a national cybersecurity chief.

2. How New Zealand sees the shift in cyber threats

New Zealand's government's "New Zealand's Cyber Security Strategy 2026–2030," published in 2026, treats cyber threats as an important national security issue.

The New Zealand government explains that as digital technology becomes widely used across society, the area that can become a target for attack is broadening too.

That's because as government agencies and companies, along with critical infrastructure, private services, and the daily lives of ordinary citizens, all become connected, a problem occurring in cyberspace can lead to real-world harm.

In particular, the threats New Zealand is focused on aren't limited to just one type.

Representative threats appearing at the same time include the following.

State-sponsored cyber activity
Financially motivated cybercrime
Ransomware and cyber extortion
Social engineering and phishing
Digital supply chain attacks
Attacks on critical infrastructure
Exploitation of known security vulnerabilities
Cyberattacks connected to geopolitical conflict
New attack methods that use AI

So modern cybersecurity is shifting away from an approach of simply blocking any one attack, and toward securing resilience — the ability to continuously respond to a changing threat landscape.

3. New Zealand's cyber threats, confirmed through real statistics

New Zealand NCSC's Cyber Threat Report 2025 analyzes cybersecurity incidents from July 2024 through June 2025.

During that period, the NCSC received reports of a total of 5,995 cybersecurity incidents.

Of these, 4,343 were reported by individuals and 1,321 were reported by organizations.

Of the incidents the NCSC separately classified for specialized technical support and analysis, 331 were potential nationally significant incidents.

Looking at these 331 incidents in relation to actor motivation,

incidents linked to a suspected state-sponsored actor: 82
incidents linked to a criminal or financially motivated actor: 137
incidents that were difficult to clearly classify: 112

were the numbers recorded.

What matters here isn't simply the number of incidents.

Cyber threats are shifting into a complex environment in which actors with different motives — state-sponsored attacks, cybercrime, and politically or socially motivated attacks — are all active at the same time.

4. Major threats New Zealand's NCSC flagged

The NCSC's 2025 cyber threat report organizes the threats New Zealand organizations should watch into a few key areas.

State-sponsored cyber activity

Attackers presumed to be state-sponsored can use cyberspace for a specific country's intelligence gathering or strategic purposes.

This kind of attack can differ in nature from crime that's simply financially motivated, and can target not just government agencies but a range of sectors, including telecommunications, finance, and technology.

The industrialization of cybercrime

In the past, many attacks required significant technical knowledge, but as the cybercrime ecosystem has become commercialized, a structure has developed in which attack tools and services are traded.

The NCSC explains that the commercialization of cybercrime — through things like ransomware-as-a-service models — is one factor spreading attack capability.

Supply chain attacks

As the software and cloud services companies use, along with external IT vendors and data-processing services, become interconnected, the scope of security responsibility has widened too.

Even without being directly attacked, a partner's or supplier's security problem can affect a connected organization.

The NCSC likewise identifies the supply chain and hidden dependency relationships, and their potential for exploitation in an attack, as a major risk.

Known vulnerabilities

It isn't only new hacking techniques that are dangerous.

Failing to patch already-known vulnerabilities in time, or continuing to use outdated systems, can provide attackers with a relatively easy point of entry.

In the end, this means that alongside adopting the latest security technology, basic security management still matters.

5. One of the biggest shifts: frontier AI

One part of this keynote worth noting in particular is the relationship between frontier AI and cybersecurity.

Frontier AI is used as a term for cutting-edge AI models that show a higher level of capability than existing AI systems.

Advances in AI can have a two-sided effect on cybersecurity.

On one hand, security professionals can use AI to analyze vast volumes of logs, find vulnerabilities, or detect anomalies.

On the other, attackers can use AI too.

That's because multiple stages of work — searching for information needed for an attack, analyzing code, finding vulnerabilities, and drafting social engineering content — could be automated or sped up.

In June 2026, New Zealand's NCSC joined the heads of cybersecurity agencies from the Five Eyes countries in issuing a joint call to action, urging preparation for the changing cyber risks brought on by frontier AI.

Director Robinson explained at the time that AI isn't a problem for the future — it's already affecting today's cybersecurity environment, and that AI can lower the barrier to entry for attackers and increase the speed and complexity of attacks.

At the same time, she also emphasized that AI is a powerful tool that can strengthen cyber-defense capability too.

6. AI is both an attack tool and a defense tool

It isn't enough to understand the relationship between AI and cybersecurity simply as "AI causes more hacking."

AI can be used in the defensive space too.

For example, security staff can get AI's support for work like the following.

Security monitoring

AI can be used to find suspicious patterns among the massive volume of logs and events generated.

Vulnerability discovery

AI can assist in the work of finding potential security problems in software code or system configuration.

Incident response

AI can be used to analyze relevant data when a security incident occurs, and quickly organize the information needed during the response process.

Threat intelligence analysis

AI can also be used to analyze newly discovered malware or attack patterns and connect them with existing threat information.

New Zealand's NCSC likewise doesn't view frontier AI merely as something to block — it sees it as technology that can be used to strengthen actual defensive capability. The NCSC stated that it is working with AI model providers and industry to understand the cybersecurity impact of this technology and prepare responses.

7. New Zealand's response direction is a 'whole of society' approach

One notable part of New Zealand's 2026–2030 cybersecurity strategy is that it doesn't treat cybersecurity as the government's responsibility alone.

New Zealand's government emphasizes a 'whole of society' approach involving government, businesses, institutions, communities, and individuals together.

That's because as digital services become interconnected, one organization's level of security can affect another organization's security too.

For example,

if multiple systems are connected — a company → an external IT service → the cloud → customer data → a public service —

a vulnerability in any one part can expand into a risk for the entire ecosystem.

So raising national cyber resilience isn't enough if only government agencies strengthen their security.

Companies and suppliers, critical infrastructure operators, and ordinary users all need to play their part.

8. New Zealand's Cyber Security Strategy 2026–2030

New Zealand announced its new Cyber Security Strategy 2026–2030 in February 2026.

This strategy sets out a long-term national direction for responding to cyber threats, and is broadly organized around four goals.

① Understand

This is the stage of understanding cyber risk and identifying what needs to be protected.

Organizations and individuals need to know the information and systems they have, and the risks connected to them, in order to build effective security measures.

② Prevent & Prepare

This is the stage of reducing risk before a cyber incident occurs, and being ready to respond when one does.

This can include vulnerability management, security policy, training, backups, and incident response plans.

③ Respond

This is about strengthening the ability to respond quickly and effectively when a cyber incident actually occurs.

Rather than aiming only to perfectly block every attack, the ability to minimize damage and quickly restore service when an attack does occur matters.

④ Partner

This is about government, industry, and international partners cooperating to strengthen cyber resilience.

Because cyberattacks today don't occur along national borders, international information sharing and joint response are important elements too.

9. The core of national cyber resilience is 'the basics'

Even as cutting-edge AI and new cyberattack techniques emerge, the starting point for security is still basic security management.

For example, consider items like the following.

Security updates for operating systems and software
Multi-factor authentication for important accounts
Cleaning up unnecessary accounts and permissions
Regular backups of important data
Network and system monitoring
Employee training on phishing and social engineering attacks
Checking the security level of external suppliers
Preparing response procedures for when an incident occurs
Access control for critical systems
Continuous management of assets and data

The AI era doesn't make these basics any less important.

In fact, as attack automation and attack speed increase, how quickly and reliably a basic defense system can be operated may matter even more.

10. Why supply chain security matters

In a modern company's IT environment, it's rare for every system to be built entirely in-house.

Cloud services, SaaS, external developers, payment systems, data analytics services, security solutions, and countless other external services are all connected.

So checking internal systems alone may not be enough to assess a company's security level.

For example, consider a structure like this.

Our company

↓

An external IT vendor

↓

A cloud service

↓

Software and APIs

↓

Customer data

If any one of these components is attacked, the damage could potentially spread to the other systems.

New Zealand's NCSC likewise views the supply chain and third-party dependencies as a major cyberattack risk factor, and in August 2026 published separate supply chain security guidance for organizations that use third-party suppliers.

11. Social engineering is still a major threat too

Even with all the talk about AI, the most basic attack methods haven't disappeared.

Social engineering attacks — using phishing, impersonation, fake messages, and malicious links to get users to enter important information themselves — remain an important security problem.

Looking by type at the cases New Zealand's NCSC handled as general incidents in 2024/25, there were 2,111 incidents related to fraud and financial crime, and 1,994 incidents related to phishing and credential theft.

This shows that cybersecurity isn't simply a matter of firewalls or antivirus software alone.

People, too, are an important security factor.

12. What the NCSC sees as a 'prepared organization'

In the view of cybersecurity that New Zealand's NCSC presents, what matters isn't completely eliminating attacks — it's building an organization that can limit damage and recover quickly even when an attack occurs.

For example, it's necessary for an organization to continuously check questions like the following internally.

Which systems matter most?

Where is the most important data stored?

Who can access it?

What systems and data are external vendors using?

How quickly can action be taken when a vulnerability is found?

Who makes decisions when an incident occurs?

Can actual recovery be achieved from backup data?

How will operations continue if a core service goes down?

Being able to answer these questions brings an organization closer to having genuine cyber resilience.

13. The core message of the CSK 2026 keynote

The topic of Director Catriona Robinson's presentation isn't limited to simply introducing New Zealand's cyberattack cases.

Summarizing the core of the presentation, it can be understood as the following flow.

A changing global environment

Geopolitical conflict and international tension are affecting cyberspace too.

↓

Expanding digital connectivity

As the systems of government, companies, suppliers, and individuals become interconnected, the attack surface is widening.

↓

Diversifying cyber threats

State-sponsored activity, cybercrime, supply chain attacks, and social engineering attacks are all appearing at the same time.

↓

The emergence of frontier AI

AI has the potential to expand an attacker's capability, while also being able to strengthen a defender's ability to detect, analyze, and respond.

↓

The importance of national cyber resilience

Not just technology, but policy, organizations, personnel, international cooperation, and basic security management all need to work together.

14. What this means for us

New Zealand's experience offers Korean companies and institutions something worth reflecting on too.

In particular, companies actively adopting AI need to consider not just the productivity gains from using AI, but the new security risks that come with it as well.

For example, when entering internal company information into an AI service,

what information is being entered?

where is that information processed?

who can access that AI service?

does a person verify the results AI generates?

how will operations continue if a problem occurs with the AI service?

these questions need to be asked.

Especially when using the cloud and external AI services, it's necessary to look at where data is stored and how it's processed, access permissions, contract terms, and the supplier's security level together.

15. Cybersecurity in the AI era is, in the end, a matter of people and organizations

As AI advances, the methods of cyberattack and defense will keep changing.

But advancing technology doesn't make the basic principles of security disappear.

Identifying your assets,

protecting important information,

managing access permissions,

fixing vulnerabilities quickly,

detecting anomalies,

preparing for incidents,

and recovering quickly from incidents that do occur.

These basic security activities form the foundation of a nation's and a company's cyber resilience.

New Zealand's 2026–2030 cybersecurity strategy, too, is pursuing this approach at the national level through four directions: Understand, Prevent & Prepare, Respond, and Partner.

Conclusion

Cybersecurity: shifting from 'blocking perfectly' to 'the ability to continuously recover'

CSK 2026's keynote, "Navigating the Cyber Threat Landscape – New Zealand's Experience," is a topic that prompts reflection on how a nation should view and respond to cyber threats in an era where AI and digital technology are advancing rapidly.

One important shift that can be confirmed through New Zealand's case is that the scope of cybersecurity keeps expanding.

Where protecting a company's network used to be the central issue, national infrastructure, the supply chain, the cloud, AI, data, and citizens' daily lives are now all connected into a single cybersecurity ecosystem.

In particular, the emergence of frontier AI is increasing the potential for both attack and defense to speed up.

So going forward, cybersecurity is likely to need basic security controls, responsible leadership, continuous preparedness, supply chain management, and domestic and international cooperation just as much as it needs to rapidly adopt new technology.

The New Zealand experience Director Catriona Robinson shared at CSK 2026 ultimately points to a single direction.

Even as cyber threats keep changing, what matters is building a structure that lets organizations and nations continuously respond and recover.

Cybersecurity in the AI era isn't a problem solved by any single technology.

Sustainable cyber resilience can only be built when technology and people, policy and organizations, government and business, and international cooperation all work together.

Please refer to the Cyber Summit Korea (CSK) 2026 website (https://cybersummit.kr)