Division Zero launches continuous cyber testing platform

Division Zero has launched a continuous penetration testing platform for New Zealand companies, saying the move responds to a sharp rise in serious cyber incidents.

The Wellington cybersecurity firm says PTaaS+ is designed to replace the traditional annual penetration test with a model that combines continuous automated checks and on-demand human testing. Customers can add assets to the platform, request a test and begin work the next business day.

The launch comes as National Cyber Security Centre data points to a marked increase in cyber activity. Figures cited by Division Zero show New Zealand recorded as many highly significant cyber incidents in a single year as in the previous decade combined.

That has intensified scrutiny of how often organisations assess their technical security. Many businesses still rely on a single annual penetration test to meet compliance, insurance or internal governance requirements, even though software changes, cloud configuration updates and third-party integrations can alter risk exposure throughout the year.

Founder Chris Berry said the pace of attacks has changed as artificial intelligence tools become more common in offensive cyber operations.

"AI isn't necessarily creating entirely new attack techniques, but it's certainly speeding up the process from discovery to exploitation. It's essentially reducing the time a company has to react," Berry said.

Division Zero argues that a yearly assessment leaves long gaps in visibility. A test carried out at one point in time may identify weaknesses present that day, but it does not account for changes introduced later through code releases, revised access permissions or new application interfaces.

That means organisations can pass an audit and still develop new weaknesses in the months that follow. At the same time, automated systems used by attackers can continue scanning internet-facing services without interruption.

Human oversight

Berry said the company built the platform to reduce the administrative delays that often surround conventional security testing engagements, including procurement steps, scheduling bottlenecks and static reports that are out of date soon after delivery.

"A customer can add assets to our platform, order a test, and we'll start the next business day rather than weeks later," Berry said.

Division Zero is not presenting automation as a full substitute for specialist security researchers. Automated tools can identify known weaknesses and exposed services, but they are less effective where testing depends on judgement about how a system is meant to operate.

That includes business logic flaws and access control problems, where the question is not simply whether a software issue exists, but whether a particular type of user can reach data or functions they should not be able to access.

"Even on the frontier models, the reasoning is still not quite human-grade. Out of the box, they don't understand the context of what each user is supposed to be able to do. Human testing still fills that gap pretty neatly," Berry said.

The company was founded in 2018 and is based in Wellington. According to Division Zero, Berry has worked in the cybersecurity sector for two decades.

Division Zero's pitch reflects a broader shift in cybersecurity from periodic review to ongoing monitoring and testing. As attack methods become more automated, security teams face pressure to shorten the time between identifying a weakness and fixing it.

For boards and technology leaders, that has implications beyond compliance. It changes how they measure security exposure, how quickly they can validate fixes, and how much confidence they can place in assessments produced months earlier.

In New Zealand, where the latest national figures suggest a more severe threat environment, the debate is likely to focus on whether older testing cycles still match current attack speeds. Division Zero is betting companies will move away from fixed annual reviews towards a model that treats penetration testing as an ongoing operational function.