Ransomware is rising fast, but New Zealand's cyber insurance is still easy to buy
Ransomware activity across Australasia has jumped more than 600%, Insurance Business NZ reported on 14 October. In the same article, it said broker Aon rated New Zealand's cyber insurance market as soft in the first quarter of 2026, with plenty of capacity and wider cover on offer.
A soft market means insurers are competing for customers, so buyers get good terms. Right now New Zealand businesses can buy cover easily, even though the risk it covers is climbing.
The article doesn't say exactly where the 600% figure comes from. It sits next to findings from a new threat report by Ensign InfoSecurity, a security firm that operates in Australia through Vectra Corporation. Most of the evidence in the story comes from security vendors and insurance brokers: Ensign, Aon, Adelphi Insurance Brokers and Commvault. All of them sell into the market they are describing.
The official New Zealand figures point the same way, less dramatically. The National Cyber Security Centre (NCSC) handled 369 incidents of potential national significance in 2025/26, Insurance Business reported. Of those, 162 were linked to criminal or financially motivated actors, up 18%. The NCSC puts 23% of nationally significant incidents down to suspected state actors.
Since March 2023, Lloyd's has required standalone cyber policies under its CY and CZ codes to exclude losses from certain state-backed attacks. A New Zealand business holding one of those policies could have a claim refused if its incident is blamed on a state.
The claims data is more mixed. Adelphi found New Zealand ransomware claims fell slightly in number in 2025 but rose in severity and cost, mostly because of business interruption.
Paying the criminals is no reliable way out. Commvault found 34% of ransomware-hit organisations in Australia and New Zealand paid, and 36% of those payments failed.
Cheaper attacks
Ensign reviewed more than 150 AI models and tested 10 generally available ones over 160 runs, covering eight stages of a simulated attack on a company. Every model could steal login credentials and move from one compromised system to others, at least to some degree. None could reliably get past detection tools.
Z.AI's GLM-5.2 performed about as well on attack tasks as GPT-5.6 Sol, at roughly one-fifth of the running cost. Open-source models from Eastern developers produced more attack output per dollar than Western ones, Ensign found.
"With frontier AI capabilities advancing on a roughly two-month cycle, security controls will need to evolve just as quickly," said Charles Spencer, Vectra's general manager for Australia and New Zealand.
Jeffrey Gonlin, chief underwriter at Emergence Insurance, put it more bluntly, as quoted by Insurance Business: "It might be that AI just makes everybody a super cyber criminal, and that turbocharges everything."
Tim Johnson of law firm Browne Jacobson noted that many policies define a hacker as a person, so some may not cover an attack carried out by AI. Casper Rogers, a senior broker at Assured, said insurers might revisit wording like Chubb's former Widespread Vulnerability Exclusion, which was meant to limit insurers' exposure when one flaw triggers many claims at once. A business renewing cover while the market is soft should check how its policy defines a hacker, and whether it excludes losses from widespread vulnerabilities or state-backed attacks.
The way in
Criminals are getting into systems by new routes. Sales of initial access, meaning a foothold in a victim's network sold to other attackers, rose fivefold, the Ensign report found. Supply-chain compromise and insider access became more important entry points.
New Zealand has already been hit this way. In May 2026 a supply-chain attack on Canvas, a US-owned, cloud-hosted learning platform, hit more than 30 New Zealand tertiary institutions and schools. They lost access to essential services for several days.
"Stronger cyber maturity does not remove the incentive to attack," Spencer said. "The region has mature, highly digitalised and well-insured organisations, connected through extensive outsourcing and cloud infrastructure."
Stolen personal data is also getting more valuable. The highest listing price seen in Australasia for a full stolen identity package rose from US$60 in 2023 to US$280 in 2026, Ensign found.
The NCSC's Cyber Smart Week runs this month. This year its message is "find a scam before it finds you". The centre warned that New Zealand's threat environment is shifting as criminals become more aggressive and make more use of AI, ChannelLife reported.
"Organisations need to be doing basic preventative measures including data back-ups, multi-factor authentication, and having an incident plan," said Catriona Robinson, the NCSC's Deputy Director-General.
Robinson said the NCSC's research showed new AI tools were making people feel more vulnerable to attack, and that public coverage of cyber incidents can encourage organisations to act.