The Prevention Test: Fifteen Questions Every New Zealand Board Should Answer Before the Breach Arrives
Return to Part 0: Table of Contents
Next Article: Part 6, The Hour-Zero Protocol: Navigating the Fog of WarSunday 22 March 2026
Forty-four percent of New Zealand businesses were targeted by cyber attacks last year. That sounds like progress. Down from 59 percent the year before. Fewer organisations hit.
The losses tell a different story. Direct financial impact jumped 118 percent in the same period, reaching $12.4 million in the third quarter of 2025 alone. The average breach now costs a New Zealand SME $173,000. Fewer attacks, nearly double the damage.[1]
The Kordia 2026 NZ Business Cyber Security Report, released this month, identifies the mechanism. Eighty percent of phishing attempts are now AI-generated. Click-through rates for AI-crafted phishing sit at 54 percent, against 12 percent for traditional attacks. The attacks landing now are more targeted, more convincing, and more precisely aimed at the gaps in each organisation's specific defences. And 43 percent of New Zealand business leaders identify the source of their greatest risk not as ransomware groups or nation-state actors, but as their own employees using AI tools the organisation has not authorised, verified, or governed.[1]
This is the governance pincer boards have not yet named. External threats are becoming sharper and more damaging. Internal threats, specifically ungoverned AI tools spreading through workforces without detection, are creating the attack surface those external adversaries exploit. The two converge at exactly the point where governance is weakest: the gap between what boards think their people are doing and what they are actually doing.
The question facing every New Zealand board is not whether this convergence will reach them. It is whether they can measure their readiness before it does.
This article gives you the measurement tool.
The Two-Front Environment
Shadow AI is the operational term for AI tools and workflows deployed by staff without formal authorisation, security review, or governance oversight. It covers consumer AI assistants used to draft documents containing sensitive data, third-party plugins connected to corporate systems, and automated workflows operating entirely outside sanctioned architecture.
In 2024, 16 percent of New Zealand businesses cited Shadow AI as a top-three challenge. By 2025, that figure had reached 24 percent, according to the Kordia report. AI-related attacks as a category doubled, from six percent to 14 percent of businesses surveyed across the year.[1]
The mechanism is not complicated. An employee uses an AI assistant to summarise a file containing patient records, commercial contracts, or financial projections. The assistant is a consumer product with its own data retention policies the employee has not read and the organisation has never assessed. The data leaves the organisational environment without triggering a security alert, because the employee holds legitimate access to the data and the AI tool does not appear on any threat register. The breach is invisible until it surfaces elsewhere.
This matters most for New Zealand health, government, and financial services organisations. These sectors hold the most sensitive data, carry the most significant Privacy Act 2020 obligations, and employ large workforces under sustained productivity pressure. That combination is precisely the environment in which ungoverned tool adoption accelerates fastest.
The external environment is not staying still while organisations manage internal pressures. The National Cyber Security Centre issued an advisory in early March 2026, urging New Zealand organisations to increase their vigilance following the escalation of the US-Iran conflict.[4] Dozens of hacktivist groups became operationally active in the region in the days following the conflict's outbreak. The UK's National Cyber Security Centre assessed that organisations in allied nations face a heightened risk of indirect cyber threat from the conflict.[5] New Zealand's Five Country Council obligations mean we are not observers to these dynamics.
The practical read for boards: your threat surface is expanding from two directions simultaneously. Adversaries outside are more capable and more precisely targeted. AI tools inside are creating data flows and access patterns that legacy security frameworks were not designed to detect. A board that has not measured its prevention posture recently is operating on an assumption of readiness that neither the internal data nor the external environment supports.
That measurement starts with fifteen questions.
The Boardroom Readiness Quiz
The Boardroom Readiness Quiz is a structured fifteen-question assessment introduced in The Hamberger Report: Cyber Guide for New Zealand Boards. It is designed for completion during a board meeting. Directors score each question Yes or No. Management must provide verifiable evidence for every affirmative answer. The questions are governance questions, not IT technical ones. They test whether the organisation has built the frameworks, oversight mechanisms, and cultural foundations that prevent breaches from occurring.
The quiz is organised into four sections. Understanding each section's logic matters as much as the final score.
Section A: Cultural Security and Māori Data Sovereignty (Questions 1 to 4)
These four questions ask whether Māori data, or taonga, is governed as a distinct category from other personal information; whether Māori partners hold actual decision authority over taonga, rather than advisory roles; whether the organisation has quantified the social licence cost of a Māori data breach differently from a standard technical data loss; and whether AI systems have undergone bias assessment by Māori data experts.
This is not symbolic inclusion. The Māori Data Sovereignty framework recognises that iwi data carries cultural, genealogical, and relational dimensions that a standard privacy framework does not address. A "Yes" on Section A requires documented evidence: decision logs showing Māori representatives declined or modified proposals, terms of reference demonstrating governance authority rather than consultation, and bias assessment reports produced by Māori data experts for deployed AI systems.
A "No," or an unverifiable "Yes," leaves a significant gap. The ManageMyHealth breach illustrates the consequence. The documents accessed included health records belonging disproportionately to older Māori and Pasifika communities across the 45 general practices in Northland and the wider network of referral-originating practices implicated by the breach.[7] The Cultural Security Envelope that would have flagged bulk exfiltration of data belonging to those demographic groups did not exist in the platform's architecture. As Part 3 of this series established, Māori data sovereignty is not a values statement; it is a security layer. The Section A questions are the operational test of whether that layer has actually been built.
Question 1: Cultural GuardrailsHave we mapped all data flows against Māori taonga principles, ensuring that cultural checks are integrated into our fraud detection protocols?
Evidence required: data inventory showing which datasets contain Māori data, documentation of Kaitiakitanga review processes, and evidence that authentication systems include cultural appropriateness verification alongside technical checks.
Question 2: Iwi IntegrationAre Māori partners involved in the governance of our high-stakes AI decision points with actual decision authority rather than advisory roles?
Evidence required: decision logs showing instances where Māori representatives declined or modified proposals, terms of reference demonstrating governance authority not consultation, meeting minutes documenting active Māori participation in technology decisions.
Question 3: Social Licence QuantificationHave we quantified the reputational cost of a Māori data breach compared to a standard technical data leak?
Evidence required: risk assessment explicitly modelling differential social licence impact, stakeholder analysis showing Māori community trust metrics, comparison of remediation costs for taonga breaches versus general data breaches.
Question 4: Algorithmic Bias AssessmentDoes our risk register include the threat of biased AI enabling targeted scams against neurodiverse or marginalised groups, and have our AI systems undergone a bias review by Māori data experts?
Evidence required: risk register entries documenting algorithmic bias threats, bias assessment reports from Māori data experts for deployed AI systems, and remediation plans for identified bias patterns.
Section B: Audit of Intent and Technical Capability (Questions 5 to 7)
Section B moves to the technical architecture: does authentication scan for behavioural and linguistic anomalies, not just technical credentials? Is the organisation running AI-era workloads on infrastructure that can support real-time telemetry? And, critically, can the board produce minutes demonstrating it has reviewed and addressed its architectural debt?
Question 7 is the one most likely to produce silence. Section 137 of the Companies Act 1993 requires directors to exercise reasonable care and diligence in the performance of their duties.[2] The standard the courts apply is whether the director exercised the care that a reasonably diligent person with the director's knowledge and experience would have exercised. "We did not know there was a vulnerability" is not a defence when a governance process would have revealed it. Directors should seek independent legal advice on how these obligations apply to their specific circumstances.
The ManageMyHealth case adds a dimension that makes Question 7 more pointed than it already was. The Office of the Privacy Commissioner confirmed publicly that it received an anonymous email in June 2025, six months before the breach, alleging that passwords and email addresses were exposed in the ManageMyHealth platform.[3] That warning did not generate a governance response. A board that could answer "Yes" to Question 7, supported by documented architectural debt reviews and board minutes reflecting genuine director enquiry, would have had a mechanism to surface and act on that kind of signal. The minutes would show what was known, when it was known, and what was decided in response.
Question 5: Intent VerificationDoes our AI authentication scan for synthetic intent and behavioural cues rather than just technical signatures?
Evidence required: technical architecture documentation showing natural language processing integration, demonstration of how systems flag culturally inappropriate or behaviourally anomalous communications, and metrics on detection rates during testing.
Question 6: Architectural Debt AuditAre we running 2026-level AI agents on legacy systems that cannot support real-time telemetry or zero-trust authentication?
Evidence required: system inventory identifying legacy infrastructure, assessment of which systems lack modern security capabilities, fiduciary risk exposure calculations quantifying the debt, remediation roadmap with timeline and budget.
Question 7: Section 137 Care DocumentationCan we produce board minutes that prove to a court that we have reviewed our architectural debt and prioritised remediation to meet our duty of care?
Evidence required: recent board minutes explicitly addressing architectural debt, records of director questions about vulnerabilities and management responses, and documentation of budget decisions allocating resources to remediation.
Section C: Once-Only Resilience (Questions 8 to 10)
As Part 4 of this series established, New Zealand's digital service architecture depends on federated data sharing across agencies, health providers, and commercial platforms. This architecture creates propagation risk: compromised or falsified data entering the federated system can contaminate multiple downstream consumers before detection. Questions 8 through 10 test whether the organisation has documented its correction loop architecture, whether it has identified informal data-sharing arrangements operating outside formal governance, and whether its kill-switch capability has been tested in the previous twelve months.
The word that matters in Question 10 is "tested." A kill-switch on paper, with no record of actual disconnection exercises, is a different capability from a tested kill-switch with documented results, identified gaps, and a reconnection protocol. Most organisations that have attempted this exercise for the first time have been surprised to discover how far the theoretical capability is from the operational one.
Shadow AI makes Question 9, the shadow OOP discovery question, directly relevant to the governance challenge introduced in Section B. An employee uploading data to an AI assistant has created a data-sharing arrangement that does not appear on any formal dependency inventory, cannot be terminated by a sanctioned kill-switch, and will not be caught by anomaly detection tuned to known patterns. For most New Zealand organisations currently experiencing Shadow AI adoption, the honest answer to Question 9 is "No."
Question 8: OOP Vulnerability MappingDo we have a documented plan for how "bad data" from other agencies is identified and quarantined within our systems?
Evidence required: Correction Loop architecture documentation, anomaly detection rules and thresholds, quarantine protocols with defined review timeframes, upstream feedback mechanisms, and metrics on prevented propagation events.
Question 9: Shadow OOP DiscoveryHave we conducted discovery exercises identifying all informal data-sharing arrangements, and are these arrangements now governed with appropriate controls?
Evidence required: Shadow OOP inventory from discovery exercise, assessment results showing which arrangements meet governance standards, and formalisation plans for arrangements requiring additional controls.
Question 10: Kill-Switch ReadinessCan we immediately suspend compromised data feeds and operate critical services using local caches? Have we tested this capability in the last 12 months?
Evidence required: technical architecture supporting rapid disconnection, test results from actual disconnection exercises (not hypothetical procedures), trigger condition documentation including Red Line Matrix, and reconnection protocols.
Section D: Sovereignty and Governance Integration (Questions 11 to 15)
The final five questions address the systemic dimensions of prevention governance. Can the architecture quickly replace a compromised vendor without collapsing core services? Does the organisation maintain a current inventory of all data-sharing dependencies, including informal ones? Have directors reviewed guidance on architectural debt liability and assessed their posture against relevant regulatory expectations? Is the correction loop producing measurable outcomes rather than theoretical capability? And has the organisation established quarterly governance routines to keep prevention frameworks current as threats evolve?
Question 11 is where Shadow AI converges directly with the readiness framework. An ungoverned AI tool is, in functional terms, an undisclosed dependency. It receives organisational data, processes it under external retention policies, and represents a connection the organisation cannot monitor, audit, or terminate through standard channels. The dependency inventory that Question 12 tests for is the mechanism that makes this visible. Without it, the organisation does not know what it does not know.
For the technical architecture behind Audit of Intent protocols and Zero Trust identity verification that underpin Sections B and D, see Thursday's Zero Trust in the Agentic Era series.
Question 11: Sovereignty AgilityCan our architecture quickly swap out a compromised vendor or registry without collapsing our core services?
Evidence required: vendor dependency inventory, documented exit strategies for critical dependencies, evidence of data portability mechanisms, alternative supplier relationships, and time-to-recovery estimates for vendor replacement scenarios.
Question 12: Dependency VisibilityDo we maintain a current inventory of all Once-Only connections, including both formal and informal data-sharing arrangements?
Evidence required: a complete dependency map showing upstream data sources and downstream consumers, quarterly updates to this inventory, and critical service dependencies for each federated connection.
Question 13: 2026 Readiness and Regulatory AlignmentHave we reviewed the Law Commission's latest guidance on director liability for persistent architectural debt, and does our cyber resilience posture align with FMA expectations?
Evidence required: review documentation of Law Commission guidance, gap analysis against regulatory expectations, compliance roadmap addressing identified gaps.
Question 14: Correction Loop EffectivenessCan we demonstrate that our correction loop mechanisms are functioning with measurable outcomes rather than theoretical capability?
Evidence required: quarterly metrics on data flagged by anomaly detection, average quarantine review times, resolution outcomes, upstream feedback transmitted, and recent examples of prevented propagation events.
Question 15: Continuous ImprovementHave we established governance routines to ensure that prevention frameworks are reviewed and updated quarterly based on emerging threats and lessons from incidents?
Evidence required: a governance calendar showing scheduled prevention reviews, evidence of framework updates based on intelligence or lessons learned, and board reporting cadence on prevention posture.
Scoring
The scoring bands are:
| Score | Rating | Action |
|---|---|---|
| 12–15 | Strong Fortress | Document frameworks as sector practice; shift to maintenance and enhancement. |
| 8–11 | Building Momentum | Prioritise "No" responses in sequence; require remediation plans with timelines. |
| 4–7 | At Risk | Escalate to Risk and Audit Committee; require a comprehensive remediation plan at next meeting. |
| 0–3 | Fragile Foundation | Convene an immediate board meeting; emergency remediation plan; seek legal advice on personal director liability. |
The ManageMyHealth score, assessed retrospectively against these fifteen questions using publicly available information, sits in the 0 to 3 range across the sections most relevant to its governance posture at the time of the breach — as inferred from public reporting by the Office of the Privacy Commissioner, media coverage, and the organisation's own disclosures.[3][7] No MFA on the Health Documents module. No documented architectural debt review visible in public board governance records. No tested correction loop or kill-switch capability described in any public statement. No Cultural Security Envelope capable of detecting bulk exfiltration by demographic profile. A warning received and not actioned. That is not hindsight. That is what the framework makes visible before the breach, if the board is willing to ask the questions and demand the evidence.
The New Zealand Context
The Kordia 2026 data provides the sector-level picture that makes this assessment material for New Zealand boards right now.
The $173,000 average SME breach cost sits against a legal backdrop where the maximum Privacy Act penalty is $10,000.[8] The Australian equivalent, following reforms enacted there in 2022, reaches $50 million.[9] The gap reflects different regulatory maturity levels, and it creates a different risk calculus for boards across the Tasman. New Zealand organisations currently face substantially lower financial penalties for governance failures than their Australian counterparts. A public petition seeking stronger penalties closed in February 2026; whether that progresses is a matter for Parliament. What boards can control is whether they are acting as if consequences are proportionate to the harm a breach causes, rather than proportionate to the current maximum fine.
The supply chain data warrants specific board attention. Twenty percent of New Zealand businesses experienced a supply chain interruption from cyber attack in the past year, according to the Kordia report.[1] That figure intersects directly with the Once-Only architecture questions. When a supplier, a platform provider, or a data partner suffers a breach, the question is not just what happened to them. It is what propagated into your systems as a result, whether you would know, and how quickly you could contain it. The dependency inventory that Question 12 requires is the instrument through which supply chain cyber risk becomes legible to boards before it becomes a crisis.
The NCSC's posture is also shifting in ways boards should register. In early 2026, the NCSC moved to proactive public notification, directly alerting New Zealanders about active malware infections threatening passwords and banking credentials — a material change from the reactive advisory model that had been standard practice.[4] The Iran conflict advisory of March 2026 follows the same pattern. Boards should read both signals as indicators of the threat environment they are governing within: the NCSC is operating as a whole-of-society partner, not just an incident responder.
For health sector boards specifically, the timing creates a concentrated period of accountability. A review commissioned by the Health Minister following the MMH breach has a final report due by 30 April 2026.[10] Privacy Act Information Privacy Principle 3A takes effect 1 May 2026, requiring organisations to take active steps to verify that personal information collected through third parties was collected lawfully.[7] A "Yes" on Question 8, supported by documented correction loop architecture, is the evidence base that satisfies that obligation. Organisations that cannot produce it by May will have a compliance gap directly testable against the new standard.
The Fortress Maturity Model and First 90 Days
The Boardroom Readiness Quiz produces a score. The Fortress Maturity Model translates that score into a governance trajectory.
The model positions the organisation across three resilience pillars (Prevention, Response, Accountability) and three maturity levels (Fragile, Resilient, and Leading). The governance value is not in the initial positioning. It is in the quarterly tracking: is the organisation moving up, holding, or slipping back as priorities shift and resources are redirected?
Trajectory analysis is the practical board conversation the model enables. An organisation with strong prevention capability but untested response protocols has an asymmetry that prevention alone cannot resolve. Prevention will typically fail at some point. When it does, the weakest pillar determines the outcome, and a board that has not tested its response posture has no way of knowing how weak that pillar is until the moment it is needed.
For boards approving prevention architecture investment after completing the quiz, the 90-day implementation checklist provides the management accountability structure.
Days 1 to 30 cover foundation and assessment: a Māori governance partnership agreement signed with a specific iwi or Māori organisation; a data inventory completed identifying all taonga datasets and their current governance status; architectural debt quantified as a financial figure and placed on the balance sheet where directors can see it.
Days 31 to 60 cover architecture remediation: Audit of Intent protocols deployed to flag behavioural and linguistic anomalies, not just technical signature matches; a shadow OOP discovery exercise commenced, identifying every AI tool used across the organisation, the data those tools access, and the retention policies those tools apply to processed information.
Days 61 to 90 cover integration and testing: kill-switch capability exercised with documented results; a war room simulation scheduled; quarterly prevention review routines established in the governance calendar.
The shadow OOP discovery exercise in Days 31 to 60 is the mechanism that makes Shadow AI governable. Most organisations that have completed this exercise have been surprised by what they found: AI tools accessing sensitive data, consumer applications processing commercial information, automated workflows that no-one sanctioned and no-one was monitoring. That surprise is operationally valuable. A court, a privacy commissioner, or a select committee will assess not just what the organisation did after it discovered a vulnerability, but whether it had the processes in place to discover vulnerabilities it did not yet know about. The shadow discovery exercise is the documented answer to that question.
For the enterprise adoption dynamics behind Shadow AI — including the governance frameworks that distinguish the Heaven Vector from the Skynet Vector in AI deployment — see Tuesday's series on Generative AI in the Enterprise.
The 90 days are not the end of the programme. They are the evidence base that answers Question 15 of the readiness quiz: whether continuous improvement routines exist. A board that can point to a documented 90-day programme, with management accountability, measurable milestones, and board minutes reflecting genuine director enquiry at each stage, has created the Section 137 documentation record that the quiz is designed to produce.
The Question the Score Answers
The fifteen questions in the Boardroom Readiness Quiz do not require technical expertise. They require governance intent. Management provides the evidence. Directors ask whether the evidence is credible. That exchange, documented in board minutes and repeated quarterly, is the structural defence against both the external adversary and the internal Shadow AI risk.
The ManageMyHealth case will reach its conclusions through the Ministry of Health review, the Office of the Privacy Commissioner inquiry, and whatever legal proceedings follow. Those conclusions will assess, among other things, whether the board had adequate visibility of the vulnerabilities that made the breach possible. The governance record — what was asked, what was documented, what was funded, and what was deferred — will be the evidence base. Every New Zealand board that handles sensitive personal information should read that process not as a cautionary tale about someone else, but as a preview of the standard they will be held to.
The Kordia data tells us the threat landscape is changing shape. Fewer attacks, but harder-landing ones. AI accelerating both the adversarial capability and the internal exposure surface. The convergence is not a future scenario. It is the current operating environment.
The choice this series returns to every week is whether New Zealand boards are choosing the Heaven Vector, transparent, accountable, culturally grounded governance, or whether they are drifting toward the Skynet Vector through deferred investment and insufficient oversight.
The fifteen questions tell you exactly where you stand.
Where does your board score?
Next week in Part 6: When a breach occurs, the first 24 hours define your legacy. Part 6 introduces the Hour-Zero Protocol, the governance framework for the fog-of-war decisions that determine whether an organisation recovers or collapses.
The views expressed in this article are entirely my own, informed by more than 30 years of professional experience in architecture, security, and technology leadership in New Zealand. They do not represent the views of my employer, any government agency, or the New Zealand government. My commentary on legislation and policy is analytical, drawing on publicly available sources and my professional expertise in architecture, security, and AI governance. I follow the Public Service Commissioner's Code of Conduct for the Public Sector and social media guidance.
Andreas Hamberger is a New Zealand leader in Architecture & Security and Associate Member of the Institute of Directors. The Hamberger Report: Cyber Guide for New Zealand Boards is the definitive board-level cybersecurity governance guide.
I acknowledge the role of AI tools, such as Sudowrite, Claude, Perplexity AI, DeepSeek AI, ChatGPT, Grok, Copilot, Openart and Gemini, which assisted in drafting, editing and reviewing. They accelerated the process, but the first draft, revisions, vision, voice and final decisions were mine alone.
References
[1] Kordia Group (2026). NZ Business Cyber Security Report 2026. Kordia Group. Retrieved from https://www.kordia.co.nz/
[2] Companies Act 1993 (NZ), s.137 (Directors' duty of care and diligence). New Zealand Parliamentary Counsel Office. https://www.legislation.govt.nz/
[3] Office of the Privacy Commissioner (2026, January). Statement on the ManageMyHealth data breach and OPC inquiry. https://www.privacy.org.nz/
[4] National Cyber Security Centre NZ (2026, March). Advisory: Heightened vigilance following regional conflict escalation. https://www.ncsc.govt.nz/
[5] National Cyber Security Centre UK (2026). Cyber threat assessment: Allied nation risk from regional conflict. https://www.ncsc.gov.uk/
[6] Wikipedia (2026). ManageMyHealth data breach. Retrieved March 2026. https://en.wikipedia.org/wiki/ManageMyHealth_data_breach
[7] ManageMyHealth (2026, January). Cyber breach update — ManageMyHealth. https://managemyhealth.co.nz/mmh-cyber-breach-update/
[8] Privacy Act 2020 (NZ), s.212 (penalty provisions). New Zealand Parliamentary Counsel Office. https://www.legislation.govt.nz/
[9] Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 (Australia). Australian Parliamentary Counsel. https://www.legislation.gov.au/
[10] The Register (2026, January 5). New Zealand government commissions review following ManageMyHealth breach. https://www.theregister.com/