Cybersecurity Governance: The Threat Actor Had an Invoice Address
A sanctioned, listed vendor sold the tools. No standard check would have caught it.
The Rule That Has Been Live Since May
A board that still reads either as coming has not checked where it stands
The Questions Are Now Addressed to the Board
New Zealand's cyber watchdog can question your board. It cannot fine it.
Vendor Assurance: Contracted, Not Confirmed
What a buyer must now hold before a provider ever sees a patient's data
Nobody Put the Reporting Tool on the Register
One open-source tool, six breaches, and the register that only tracks what you bought
The Advisory Was Published. Nobody Escalated It.
One CVE, 1.08 million records, and a regulator about to lose 15% of its staff
They Signed the Letter, and the Weights Went Up Anyway
A pledge is not a control, and one platform just learned the difference twice
The Control Your Insurer Requires Would Not Have Stopped This
A CVSS 10.0 flaw in Microsoft Entra ID sat beneath every control on the checklist
The Backup You Have Not Tested Is a Ransom You Have Already Agreed to Pay
New ANZ Research Ties the Ransom Decision to a Backup Nobody Has Actually Tested
Cybersecurity Governance: New Zealand's Light-Touch Era Is Ending
What Four Regulators Moving at Once Means for Board Liability
The Ransomware That Needed No Human: JadePuffer and the Machine-Speed Boardroom Problem
Thirty-one seconds: the self-correction speed that breaks the Hour-Zero Protocol's clock
Ransomware Now Hunts the NZ Mid-Market: The $10-to-$100 Million Bullseye
Why 42% of attacks target NZ$10M to $100M firms, and the exposure boards never priced
The Systemic Risk Has a Name: When the Reserve Bank Called a Frontier Model a Threat to Financial Stability
In its May 2026 Financial Stability Report, the Reserve Bank of New Zealand named a specific frontier AI model as a source of systemic risk, and in the same chapter disclosed a three-hour outage in the high-value payment rail it operates itself
The Router Nobody Audits: When the State Walks Past Your Firewall
The nineteen-agency advisory, the edge router, and the Audit of Intent no board has run
Within Months, Not Years: The Five Country Council Just Made AI Cyber Risk a Board Liability
On 22 June 2026 five allied cyber intelligence agencies, New Zealand's GCSB among them, signed a public statement telling boards that AI cyber risk is a leadership responsibility, not a technical one
Your Face Is Not Your Password: The Biometric Code Deadline NZ Boards Just Ran Out of Runway On
The 3 August 2026 deadline under the Biometric Processing Privacy Code turns nine months of quiet non-compliance into documented governance failure
Cyber Governance: New Zealand's C2 Incidents Are Back After Five Years
Three highly significant breaches in one quarter, and the architectural debt behind them
From $10,000 to Millions: The Privacy Commissioner Asks for Teeth
New Zealand's enforcement gap: 43 per cent more breaches, the same $10,000 fine
The $409 Million Lesson: When Deleting the Logs Costs More Than the Breach
The cover-up multiplier: South Korea's record privacy fine is a verdict on board conduct.
Before You Touch Frontier AI: The Advisory Every NZ Board Needs to Read Now
Executive Accountability for Frontier AI: NCSC-NZ Names the Compliance Floor