AI drives smarter, converged cybersecurity across New Zealand

Artificial intelligence is rapidly becoming central to cybersecurity strategies across New Zealand, with almost all large organisations now deploying AI-powered tools for detection, response, and workforce development. New data highlights the growing maturity of AI adoption, as businesses shift from traditional reactive defence towards more predictive and automated security operations.

Operational integration

AI is now embedded across security environments, with 95% of organisations in New Zealand using AI to some degree.

Usage extends from basic threat detection to more complex roles such as automated response and predictive threat modelling. Automated intelligence now supports incident response, threat analysis, and behavioural monitoring. These developments enable enterprises to respond to cyber threats at greater speed and scale, but they also present new risks as cyber attackers begin to use AI for more adaptive and elusive targeting.

Generative AI is particularly finding its way into tasks that benefit from automation, including monitoring playbooks, updating security policies, and guiding investigations. Trust in full autonomy, however, remains low. Remediation activities and decision-making are still largely overseen by human operators, indicating that organisations remain cautious about delegating critical security controls entirely to algorithms.

Talent priorities

Workforce transformation is underway, with AI expertise now prioritised in recruitment.

The most in-demand positions include security data scientists, AI security engineers, and professionals skilled in AI-driven incident response. Organisations are not just adopting AI technology; they are restructuring entire cybersecurity teams to build around these capabilities.

"The findings of this survey reflect the growing maturity of cybersecurity across the region. Organisations are no longer experimenting with AI; they are embedding it across threat detection, incident response, and team design. This signals a new era of security operations that is smarter, faster, and more adaptive to the evolving risk landscape. AI is fundamentally reshaping how threats are identified, prioritised, and acted upon, and this evolution demands a parallel shift in cybersecurity strategy and talent," said Simon Piff, Research Vice-President, IDC Asia-Pacific.

Budget allocations

Security budgets are rising, but increases remain modest, with most organisations reporting growth of less than 5%. Spending is being carefully allocated, mainly to address operational costs and hire qualified talent. The primary investment areas for the next year include identity security, network security, cyber resilience, cloud-native applications, and the implementation of SASE and Zero Trust frameworks.

This demonstrates a shift in focus from heavy infrastructure spending to more targeted, risk-oriented priorities as the threat landscape continues to evolve.

Resource constraints

Despite the increased adoption of AI solutions, many IT and security teams remain under-resourced.

Only 6% of an organisation's total workforce, on average, is dedicated to internal IT, with barely over one-tenth of that focused on cybersecurity functions. Fewer than one in six businesses have a dedicated Chief Information Security Officer, and just 6% have teams specifically tasked with security operations and threat hunting. As a result, many teams face high workloads, risk burnout, and experience difficulty retaining talent amid an ongoing increase in cyber threats and tool sprawl.

Convergence strategies

Organisations are moving towards a unified cybersecurity model that consolidates tools and blurs the lines between network and security operations. Ninety percent of respondents are integrating or considering the integration of security and networking functions in a single framework. Vendor consolidation is also gaining traction, with 63% evaluating fewer suppliers to reduce complexity, improve integration, and achieve better overall security.

This move is no longer seen merely as a way to contain costs, but as a core strategy for maintaining a secure and manageable environment.

"CISOs across New Zealand are entering a more advanced phase of cybersecurity planning one where AI is not just augmenting defences but influencing how organisations structure teams, allocate budgets, and prioritise threats. At Fortinet, we are helping customers embrace this shift by embedding AI across the platform, enabling faster detection, smarter responses, and more resilient operations as cyber risks become more complex and distributed. As this complexity grows, so does the need for converged, intelligent, and adaptive security models that can keep pace," said Matt Harrison, Sales Manager New Zealand.