Two numbers from the same speech point in opposite directions.
The share of New Zealand directors who say their board discusses cyber risk now sits at 57.2 per cent, down from 62.2 per cent in 2024. The share of boards that say they receive complete breach and cyber-risk reporting sits at 55.2 per cent, and that figure has barely moved in three years. Both come from the Institute of Directors' own sentiment survey, cited in a speech published by the Office of the Privacy Commissioner in March 2026 [1].
Five points off the discussion. Nothing off the reporting.
A falling number like the first one usually gets read alongside an assumption that the second one fell with it. Boards talk about cyber less because they are told less, the thinking goes, so the answer is better reporting: a cleaner dashboard, a tighter paper, a standing item with a chart on it. That reading is available to anyone who sees only the first figure. The second figure closes it off.
Hold the reporting line flat and the fall means something else entirely. The papers arrived. The same proportion of boards received the same complete reporting they were receiving three years ago, and the conversation about it shrank by five points. The information supply held. What changed is what happened in the room after the papers landed.
That distinction decides what a director does about it, which is why it is worth more than the headline figure on its own. An information failure is fixed by improving the reporting. A failure of attention is not fixed by improving the reporting, because the reporting was never the constraint. It is fixed by changing what the board does with a paper it has already received, and that is a governance process question with a different set of answers.
What the second number removes
Survey figures about boardroom behaviour are self-reported, and self-reported figures about one's own diligence tend to run optimistic rather than pessimistic. That cuts in an uncomfortable direction here. If 57.2 per cent is the flattering number, the real discussion rate is lower, and the fall from 62.2 is a floor rather than a ceiling.
It also matters that the reporting figure and the discussion figure come from the same instrument and the same respondents. They are not two different surveys with two different methodologies that happen to disagree. They are two answers from the same directors about the same board year, which is what makes the comparison between them load-bearing rather than decorative.
The content of what boards are being told has not become gentler either. The same speech reports that 61 per cent of serious privacy breaches were due to intentional or malicious activity, against 36 per cent from human error [1]. Both figures are independently reproduced in trade coverage of the same address [2][3]. The accidental email to the wrong recipient, the failure mode that shaped a decade of privacy training, is now the minority case. The majority case is somebody who meant it.
That shift changes what a clean report is worth. A report covering accidental disclosure describes a problem that training and process can largely contain. A report covering deliberate intrusion describes an adversary who adapts to whatever the previous report said. The two documents can look identical, with the same headings and the same green indicators, while meaning quite different things about the year ahead.
So the picture is a board receiving the same volume of reporting about a threat that has become more deliberate, and discussing it less often than it did two years ago. Nothing in the information supply explains that.
Attention is the control
I use a framework with boards called Fiduciary Risk Exposure. It sets the cost of remediating a breach against the probability of one occurring, and adds the loss that follows if it does. The arithmetic is useful mostly because it forces three separate estimates into the open where directors can argue about them, rather than leaving a single uneasy feeling about whether the organisation is covered.
The refinement these two numbers add is about which input moved. Nothing in the figures says New Zealand organisations got worse at remediation, or that the probability of a breach changed in either direction over the period. What moved is the board's engagement with the information it already had. That makes the exposure an attention exposure rather than a capability one, and attention is not a control most governance frameworks name, measure or report on.
The three estimates behave differently under pressure, which is the useful part. Remediation cost is usually the one an organisation can produce, because somebody has priced an incident response retainer and knows what forensic work costs by the day. Probability is the contested one, and an honest answer is a range with reasons attached rather than a single figure. Potential loss is the estimate boards consistently pitch low, because it is where regulatory consequence, contractual exposure and the cost of running the business manually for a fortnight all arrive together. Put the three on one page and a board argues about the inputs, which is the argument worth having. Leave them off and the board argues about nothing, which produces minutes indistinguishable from agreement.
Consider how a diligence question is actually answered after an incident. The organisation is asked what it knew, when it knew it, and what it did about it. The evidence is the record: the minutes, the papers, the follow-up actions, the dates on which somebody asked for something and the dates on which it arrived. A board that received a clean report and moved on has a record showing it received a clean report and moved on. A board that received the same clean report and asked three questions about what was not in it has a different record, built from the same paper.
That is the whole practical difference, and it does not cost a cent of additional security spend. The reporting was identical. The record is not.
The year the duty arrived from several directions
The fall in discussion happened in a twelve-month window in which the obligations pointing at the board table got noticeably firmer.
In September 2026 the National Cyber Security Centre published its Cyber Threat Report 2026. The accompanying announcement puts the preparation question to boards, chief executives and senior leaders rather than to technical staff, asking whether organisations have the people, processes and resources to respond to a faster-moving threat environment [4]. The report is the agency's own published assessment, and the sentence that matters for a director is the one naming who is being asked.
In October 2026 the Reserve Bank of New Zealand and the Financial Markets Authority set out supervisory expectations on cyber and artificial intelligence risk for the entities they regulate. Three risks are named: increased cyber risk, evolving governance and oversight challenges, and growing third-party and concentration risk. The regulators state that these expectations build on existing prudential, conduct, cyber and operational resilience obligations [5]. That framing is the part worth reading twice. The duty is described as already owed. Nothing was created on 15 October; something was made explicit, which means a board cannot date its own obligation from the announcement.
And in September 2026 a compliance notice issued under the Health Information Privacy Code turned on rule 5(1)(b), the limb that requires an agency to do everything reasonably in its power to prevent unauthorised use or disclosure of health information before it hands that information to a service provider [6]. The remediation deadline runs to 29 January 2027. The significance for any board, in any sector, is structural rather than sectoral: the obligation attaches before the data moves, so it is answered from the diligence record made at the time, not from an assessment produced afterwards. There is no version of that question a board can answer retrospectively by commissioning a review.
Read those three together and the asymmetry with the survey figures is sharp. The duty became more explicit, more specific about who carries it, and more clearly anchored to decisions made before anything goes wrong. Board discussion went the other way.
There is a point in the sequencing that matters more than any of the three documents on its own. Each one locates the decision before the event. The threat report asks whether an organisation already has the people, processes and resources it will need, which is a question about preparation. The supervisory statement describes duties as already owed, which removes the announcement date as a starting line. The compliance notice turns on what was checked before information moved, which only a contemporaneous record can answer. None of the three can be satisfied by commissioning a document afterwards. All three can be satisfied by a board that has been asking the same questions quarterly for two years and writing down what it was told.
The sharpest agentic rule in the country is a bank's contract
There is a second strand running through the same twelve months, and it tests the attention point harder than the first one does, because it concerns a risk category that will not appear in a standard board paper at all.
On 14 September 2026 ASB's FastNet Business Terms and Conditions took effect carrying a defined term, Automated Agent. Clause 17.1 defines it to cover software, scripts, bots, automated tools and agentic artificial intelligence models including large language models, together with the providers of those tools, where they act for the customer or at the customer's instruction to access or use a Function. Clause 10.3 lets the bank cancel FastNet Business access where it believes on reasonable grounds that the service is being accessed or used by an Automated Agent in a way the terms do not authorise, or where that use could compromise the security, integrity, availability or performance of the bank's systems, data or services. A new section of the terms governs the use of automated agents, covering transparency and approval, responsibility and liability, and restrictions on use [7].
That is a binding rule about machine access to a New Zealand business's banking, and it did not come from a regulator. It came from a bank's standard terms, which a company accepts by continuing to use the service.
Eight to nine days later, six banks published a shared set of principles to support the development of trusted agentic commerce. The Commonwealth Bank of Australia, ASB Bank, Bank of America, Capital One, ING Group and NatWest Group are named in both banks' own announcements [8][9]. Voluntary industry principles are usually assumed to arrive first and binding rules to follow. Here the contractual term was already in force when the principles were published.
Set that against where the regulatory vocabulary currently sits. The Privacy Commissioner's generative artificial intelligence guidance is dated June 2023 and its parent resource page September 2023; neither uses the words agentic, AI agent or autonomous [10]. The Financial Markets Authority's thematic review on artificial intelligence in financial advice, dated 6 August 2026, does use the term, referring to emerging agentic AI systems, and the review's own page describes it as "exploratory and fact-finding in nature" [11].
For a director, the practical consequence is specific and immediate. If something in your organisation has been given credentials to a bank portal so it can pull statements, reconcile transactions or trigger payments, the enforceable rule governing that arrangement is probably in a contract nobody on your board has read, and the remedy available to the counterparty is withdrawal of access rather than a fine. That is a continuity risk with a cyber label on it, and it is precisely the kind of item that will not surface in a complete cyber-risk report, because the report covers the organisation's own controls rather than the terms under which its machines reach somebody else's systems.
The question to put to the finance team is narrow enough to come back answered within a week. Which systems hold credentials to an external provider's portal? Who approved each of those arrangements, and when? What is each arrangement permitted to do, and what does the provider's own agreement say happens if the provider decides that access is not authorised? The last of those is the part nobody has read, and it decides whether a disagreement costs a phone call or a fortnight of manual reconciliation. The answer belongs on the risk register with an owner's name against it and a review date, rather than in a conversation that closes with somebody offering to look into it.
Which brings the two strands together. The reporting is holding steady and the discussion is falling, in a period when the newest category of risk is the one the reporting was never designed to cover.
What a board can do on Monday
None of this requires a new framework, a new committee or a new line item. It requires a change in what happens when a clean paper arrives.
Kaitiakitanga, the principle of guardianship and stewardship, is the standard I find most useful here, because it treats the data an organisation holds as something held on behalf of others rather than owned outright. A guardian does not discharge the duty by receiving a report. A guardian asks what the report does not say.
Four questions, asked every quarter, against the same paper the board already receives.
What changed since last quarter? A report that reads the same as the previous one is either describing a stable environment or describing a process that has stopped looking. Those two produce identical documents. Only a question separates them.
What are we not being told? Every report has a scope, and the scope is a decision somebody made. Ask who set it, what sits outside it, and what would have to happen for something outside it to be brought in.
Who or what holds access? The question is about identities rather than headcount: which identities, human and otherwise, can reach the systems that matter, who approved each one, and what happens when the arrangement that created one of them ends. Non-human access is the category most likely to be missing entirely.
Where is the evidence? A management response that something is on the roadmap is not an answer; it is a deferral with a pleasant name. Ask for the date, the owner and the resourcing, and record what you were told.
Then record what was asked and what came back, specifically. "The board discussed cyber risk" tells a future reader nothing at all. "The board asked what had changed since the previous quarter and was told the scope was unchanged" tells them a great deal, and so does "the board asked who held non-human access and was told that work was under way, due in March". Minutes written that way cost a few extra lines and do two jobs at once. They give the next meeting something concrete to test rather than a blank page, and they are the only evidence that will exist if somebody asks, two years from now, what this board knew and when it knew it.
The discipline is in the repetition rather than the cleverness. A board that works through the same four questions every quarter can see the gaps that persist, because the persistence becomes visible across minutes in a way it never is within a single meeting. A board that works through them once has produced an event. A board that works through them twelve times has produced a record.
The record is the evidence
The figure that should worry a director is the one that did not move.
A five-point fall in discussion could be a measurement artefact, a definitional change, a bad year. Flat reporting across three years, against a threat landscape in which most serious breaches are now deliberate, is a stable condition. It says the information kept arriving in the same form and at the same frequency, and that somewhere in the last two years a number of boards quietly concluded that receiving it was the same thing as governing it.
The non-human access question already has working answers in the open, and they are worth knowing about because they define what good looks like. SPIFFE, the Secure Production Identity Framework for Everyone, and its reference implementation SPIRE are graduated projects of the Cloud Native Computing Foundation. They issue short-lived, cryptographically attested identity documents to workloads, rather than handing a script a shared credential and trusting that somebody wrote it down somewhere [14]. The governance value sits in the record rather than the cryptography: every machine identity is issued, scoped and expired by a system that can be asked what it did and when. No director needs to read the specification. A director does need to know whether the organisation can answer the question the specification exists to answer, and whether anyone has asked it this year.
What this means for sovereign capacity
The same gap has a trans-Tasman reading. In April two thousand and twenty-six the Australian Prudential Regulation Authority told the institutions it supervises that identity and access management capabilities have not yet adjusted to non-human actors such as artificial intelligence agents, and called for controls over agentic and autonomous workflows [12]. Independent legal analysis read that letter as a move from general framework to targeted expectation [13]. New Zealand's financial regulators named growing third-party and concentration risk as a supervisory concern six months later [5]. Banking is critical national infrastructure, and concentration in it is a sovereignty question as much as a prudential one: when a small number of providers carry the machine access to a country's payment systems, the instruments governing that access form part of national resilience. On the evidence here, the most concrete of those instruments in New Zealand today is a private contract.
When your board last received a clean cyber report, what question did somebody ask that was not on the agenda, and what happened to the answer?
If your board wants an independent AI and cyber risk briefing, or a review of what your vendor's assurance actually verified, message me and I will send the scope and the fixed fee.
The views expressed in this article are entirely my own, informed by more than 30 years of professional experience in architecture, security, and technology leadership in New Zealand. I write as director of Te Pono Limited; the views are personal and do not represent the position of any client, any government agency, or the New Zealand government. My commentary on legislation and policy is analytical, drawing on publicly available sources and my professional expertise in architecture, security, and AI governance, and it is politically neutral.
Andreas Hamberger is a New Zealand leader in Architecture & Security and Associate Member of the Institute of Directors. The Cyber Guide for New Zealand Boards, a board-level cybersecurity governance book, releases on 12 December 2026. Through Te Pono he provides independent AI and cyber risk briefings and vendor assurance reviews to boards; contact andreas@thehambergerreport.com for the scope and fixed fee.
This article was produced with AI assistance under my direction. Research, drafting and images pass through a pipeline I built and govern: automated gates for source verification, forbidden language and political neutrality, and my own review before anything is published. The tools include Claude, Gemini and Openart. The frameworks, arguments and editorial judgements are mine and are the same discipline I apply to the AI systems I audit for clients. AI accelerated the work; the thinking, and the responsibility for it, are mine.
References
[1] Office of the Privacy Commissioner. "Commissioner's speech to the 2026 National Cyber Security Summit." 17 March 2026. https://www.privacy.org.nz/tuhono-connect/statements-media-releases/commissioner-speech-to-the-2026-national-cyber-security-summit/
[2] NZ Lawyer. "Privacy Commissioner lists expectations for those facing super-charged cyber threat landscape." 22 March 2026. https://www.thelawyermag.com/nz/practice-areas/tmt-telecoms-media-technology/privacy-commissioner-lists-expectations-for-those-facing-super-charged-cyber-threat-landscape/569381
[3] International Association of Privacy Professionals. "Notes from the Asia Pacific region: cyber risk is outpacing organizational response." 16 April 2026. https://iapp.org/news/a/notes-from-the-asia-pacific-region-cyber-risk-is-outpacing-organizational-response
[4] National Cyber Security Centre (New Zealand). "Cyber Threat Report 2026: leaders need to prepare now for the impact of AI." 24 September 2026. https://www.ncsc.govt.nz/news/cyber-threat-report-2026-leaders-need-to-prepare-now-for-the-impact-of-ai/
[5] Reserve Bank of New Zealand and Financial Markets Authority. "RBNZ and FMA outline supervisory expectations on cyber and AI risks." 15 October 2026. https://www.rbnz.govt.nz/news-and-events/news/2026/10/rbnz-and-fma-outline-supervisory-expectations-on-cyber-and-ai-risks
[6] Office of the Privacy Commissioner. "Privacy Commissioner issues compliance notices to Manage My Health and Health NZ." 23 September 2026. https://www.privacy.org.nz/tuhono-connect/statements-media-releases/privacy-commissioner-issues-compliance-notices-to-manage-my-health-and-health-nz/
[7] ASB Bank. "FastNet Business Terms and Conditions." 14 September 2026. https://www.asb.co.nz/content/dam/asb/documents/termsandconditions/2026/asb-fastnet-business-terms-and-conditions-sept-2026.pdf
[8] Commonwealth Bank of Australia. "Agentic commerce principles paper launch." 23 September 2026. https://www.commbank.com.au/articles/newsroom/2026/09/agentic-commerce-principles-paper-launch.html
[9] NatWest Group. "Global banks collaborate on principles for trusted agentic commerce." 22 September 2026. https://www.natwestgroup.com/news-and-insights/news-room/press-releases/2026/global-banks-collaborate-on-principles-for-trusted-agentic-comme.html
[10] Office of the Privacy Commissioner. "Generative artificial intelligence." 15 June 2023. https://www.privacy.org.nz/resources-and-learning/a-z-topics/ai/generative-artificial-intelligence/
[11] Financial Markets Authority. "Thematic review: AI in financial advice." 6 August 2026. https://www.fma.govt.nz/library/reports-and-papers/thematic-review-ai-in-financial-advice/
[12] Australian Prudential Regulation Authority. "APRA letter to industry on artificial intelligence (AI)." 30 April 2026. https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai
[13] Clayton Utz. "APRA's AI letter: a shift from framework to targeted expectations." 5 May 2026. https://www.claytonutz.com/insights/2026/may/apras-ai-letter-a-shift-from-framework-to-targeted-expectations
[14] SPIFFE (Cloud Native Computing Foundation). "SPIFFE Overview." https://spiffe.io/docs/latest/spiffe-about/overview/