New Zealand launches Cyber Smart Week with scam warning

The National Cyber Security Centre has launched Cyber Smart Week 2026 in New Zealand under the message: "find a scam before it finds you".

The public awareness campaign comes as the agency warns that the country's cyber threat environment is shifting, driven by more aggressive criminal activity and the growing use of artificial intelligence by malicious actors.

Cyber Smart Week is New Zealand's annual cyber security awareness campaign, aimed at helping individuals and organisations strengthen their online security. Running for a week in October, this year's campaign uses scams as its central theme to encourage discussion about everyday online risks.

The campaign is intended to help people recognise suspicious activity and adopt basic security habits. It also targets business and organisational leaders with a warning that preparation is essential as the threat environment changes.

That warning reflects broader concern among public agencies and businesses about how artificial intelligence is reshaping cyber risk. New AI tools are making people feel more vulnerable to attack, while public coverage of cyber incidents can prompt organisations to review their own readiness.

Business focus

For organisations, the NCSC is urging a focus on preventative measures rather than complex technical responses. It highlighted data back-ups, multi-factor authentication, and an incident plan as basic steps businesses and other organisations should have in place.

The message comes as cyber attacks continue to harm organisations through data loss, financial damage, and reputational risk. By linking those threats to routine preparation, the campaign frames cyber security as an operational issue rather than a specialist one.

Catriona Robinson, Deputy Director-General at the National Cyber Security Centre, said the campaign is designed to make cyber risk easier to discuss in practical terms.

"People are our strongest line of defence. We are using 'scams' this Cyber Smart Week as an easy way for New Zealanders to talk about the risks they face every day. This will help people recognise suspicious activity and build simple cyber security habits that can protect them. When more New Zealanders know how to protect themselves online, we help make all of New Zealand more cyber resilient," Robinson said.

Her comments place individual behaviour at the centre of the campaign, with the agency arguing that stronger public awareness can improve resilience across the wider economy and society. Using scams as the campaign's framing device also reflects how many cyber threats are first encountered by staff, consumers, and citizens through messages, emails, and other online approaches that appear ordinary at first glance.

Changing threats

The agency's warning about artificial intelligence points to a shift in how attacks may be crafted and delivered. While the campaign material does not detail specific tactics, its reference to AI and increasingly aggressive criminal activity suggests concern about the scale, speed, and realism with which scams and other malicious approaches can now be created.

For business leaders, that raises questions about internal controls, staff awareness, and the ability to respond quickly when an incident occurs. The NCSC's emphasis on back-ups and incident planning indicates a focus on limiting disruption as well as preventing compromise in the first place.

Robinson also set out the agency's message to businesses and organisations more directly.

"Cyber security is a critically important consideration for every New Zealand business and organisation. Organisations need to be doing basic preventative measures including data back-ups, multi-factor authentication, and having an incident plan," Robinson said.

The campaign also draws on research cited by the NCSC about public perceptions of cyber risk. According to the agency, people report feeling more exposed as new AI tools become available, and prominent reporting of cyber incidents can trigger organisational action.

That link between awareness and action is central to the campaign's approach. Rather than waiting for a breach, fraud event, or service disruption, the agency wants organisations to review basic protections before they suffer direct harm.

Robinson added: "Our research tells us that new artificial intelligence tools are making people feel more vulnerable to attack, and that coverage of cyber incidents in the public arena can encourage organisations to take action.

However, don't wait until another organisation has lost valuable data, money, and had its reputation damaged; take action now. We have resources and guidance to assist individuals and organisations to be better prepared."