Key takeaways
- New joint guidance co-authored by New Zealand’s National Cyber Security Centre shows how AI can strengthen cyber defence across governance, identification, protection, detection, response and recovery.
- The same AI systems can introduce new attack paths if they are given excessive access, rely on untrusted inputs or take automated actions without sufficient safeguards.
- Agentic AI increases that risk because it can independently plan, access tools and systems, and take actions with limited human intervention. Organisations should apply least privilege, human oversight, sandboxing, auditability and strong testing before increasing autonomy.
AI is increasingly being positioned as part of the answer to a difficult cyber-security problem. Security teams are dealing with growing volumes of alerts, vulnerabilities, logs and threat intelligence, while attackers are using AI to work faster and at greater scale. It is therefore understandable that organisations are looking at AI to help analyse risk, identify threats and automate parts of their response.
New joint guidance, Opportunities for AI in cyber defence, provides a useful view of where that opportunity is heading. While published by the Australian Signals Directorate’s Australian Cyber Security Centre, the guidance was co-authored by New Zealand’s National Cyber Security Centre alongside its Australian, Canadian and United Kingdom counterparts. That New Zealand involvement makes the guidance particularly relevant for local organisations considering how AI should fit within their cyber-security strategy.
The guidance outlines how AI can support cyber security across the full lifecycle of Govern, Identify, Protect, Detect, Respond and Recover. At the same time, it makes an important point that should shape how organisations approach adoption: the more authority an organisation gives AI to defend its systems, the more important it becomes to secure and govern the AI itself.
AI is moving into operational cyber security
The potential uses described in the guidance go well beyond asking a chatbot to summarise a security report. AI could help organisations analyse supply-chain risks, discover assets, prioritise vulnerabilities, identify attack paths, review source code, detect anomalous activity, investigate incidents and plan recovery.
During an incident, AI could correlate alerts, logs and forensic artefacts into a coherent explanation, help sequence response actions or execute multiple response playbooks in parallel. During recovery, it could analyse restoration options, verify that systems have returned to a known-good state and identify weaknesses in recovery plans before they are encountered during a real incident.
This represents an important shift from AI as an information tool towards AI as part of the operational security environment. That creates considerable potential value, but it also changes the risk profile because an AI system with access to sensitive security data, tools and workflows can itself become a point of vulnerability.
The security tool can become a security risk
A cyber-security AI system may need access to some of an organisation’s most sensitive information, including network telemetry, identity information, system architecture, vulnerability data, source code, logs and incident artefacts. More capable systems may also be given permission to interact directly with security tools or operational environments.
That creates a straightforward governance problem. An AI system designed to protect the organisation may itself become a valuable target. The guidance identifies risks including excessive system access, reliance on untrusted inputs and automated actions occurring without adequate safeguards, alongside AI-specific threats such as prompt injection, model evasion, model extraction and poisoning.
The implication is that AI cannot simply be placed on top of existing security systems and assumed to make them safer. The AI itself needs to be treated as part of the attack surface, with controls over what it can access, what it can influence and what actions it is permitted to take.
Agentic AI raises the stakes
This becomes more important as organisations move towards agentic AI. Unlike a conventional generative AI tool that produces information for a person to consider, an AI agent can be connected to tools, data, memory and workflows so it can plan and take actions towards a defined objective with less ongoing human involvement.
ASD has separately highlighted the need for careful adoption of agentic AI in cyber defence and points organisations to Five Eyes guidance on Careful adoption of agentic AI services. New Zealand’s NCSC was also a co-author of that guidance, alongside cyber-security agencies from Australia, the United States, Canada and the United Kingdom.
The concern is not simply that an agent may produce an incorrect answer. An over-privileged or manipulated agent may be capable of acting on that answer. It could access information, interact with systems, invoke tools or initiate actions before a person has an opportunity to intervene. Increased autonomy also creates a larger attack surface because external tools, data sources, memory and system integrations introduce additional places where an attacker may influence behaviour.
The practical message is to increase autonomy gradually. Agentic systems should begin with clearly defined, lower-risk tasks, minimal privileges and strong monitoring, with broader access or operational authority introduced only as confidence and assurance improve.
Human oversight still matters
One of the clearest themes in the guidance is that AI should support cyber defenders rather than replace human accountability, particularly where AI is capable of taking actions rather than simply making recommendations.
Human approval should be retained for high-impact or state-changing actions, while autonomous activity should be narrowly scoped, pre-approved and reversible. Using AI to analyse a suspicious login is different from allowing it to disable an account, just as recommending that a server be isolated is different from automatically disconnecting it from the network.
For New Zealand professional services firms, this is particularly relevant where systems contain confidential, privileged or commercially sensitive client information. Human oversight should not be treated as a generic statement in an AI policy. Organisations need to decide in advance which actions AI may take independently, which require approval and who has the authority to intervene.
Least privilege applies to AI too
The guidance applies familiar cyber-security concepts to AI systems, and one of the most important is least privilege. AI tools should have only the access and authority required to perform their intended role, while their behaviour should be constrained through sandboxing, scope restrictions and execution limits.
Technical guardrails should prevent high-impact or irreversible actions occurring without appropriate control. AI-assisted actions should also remain traceable and reviewable so the organisation can understand what occurred and, where necessary, investigate or roll back activity.
These are conventional security principles, but their application to AI is significant. The question is no longer simply what a user can access. Organisations increasingly need to ask what their AI can access, what it can change and what it can execute.
Do not rely on the vendor demonstration
Another useful part of the guidance deals with testing and assurance. Vendor claims, demonstrations and limited testing are not enough to establish whether an AI security product will perform reliably within a real organisation.
The tool needs to be tested in the environment in which it will actually operate, including with incomplete information, noisy data and malicious activity. Organisations should validate whether recommendations are accurate and useful, whether staff can confidently act on them and what happens when the AI produces unreliable outputs.
They should also test failure. Security operations need to continue if the AI becomes unavailable, the model is compromised or outputs become unreliable. Organisations should know whether AI functionality can be isolated or disabled without interrupting core services and whether previous configurations or models can be restored if behaviour changes unexpectedly.
AI creates another supply-chain dependency
An AI-enabled security product may depend on third-party models, external datasets, cloud infrastructure, APIs and other services that the organisation does not directly control. The guidance recommends maintaining visibility across these dependencies and understanding how organisational information moves through the AI supply chain.
It also refers to an AI bill of materials, or AIBOM, alongside more familiar software bills of materials. For buyers of AI-enabled security products, the procurement principle is straightforward: do not evaluate only what the product does. Understand what it depends on, where information is processed, which third parties sit behind the service and how those dependencies affect security and resilience.
What this means for your organisation
New Zealand organisations considering AI-enabled cyber-security tools should treat them as part of the security architecture rather than simply another software feature. Start by defining the security outcome the AI is expected to improve and whether that improvement can be measured. Apply least privilege to its access to information, systems and actions, and establish clear human control points for decisions that could disable services, alter data, change permissions or affect recovery.
Testing should take place in the organisation’s own environment using realistic data, malicious inputs, incomplete information and failure scenarios. AI inputs, recommendations and actions should be logged sufficiently to reconstruct what happened after an incident, while compromise, hallucination, degradation and unexpected behaviour should be incorporated into existing incident-response and recovery planning.
For agentic AI, add another question: how much authority does the system genuinely need? Autonomy should increase because the organisation has demonstrated that the system can operate safely within defined boundaries, not simply because the technology is capable of doing more.
Better cyber defence requires better AI governance
The central message from this New Zealand co-authored guidance is not that organisations should automate cyber security as quickly as possible. It is that AI can strengthen established cyber-security practices when it is introduced deliberately, securely and with appropriate human control.
An AI system capable of discovering an attack path more quickly can be extremely valuable, but the same system can create new risk if it has excessive permissions, unreliable inputs or authority to act without oversight. Agentic AI makes that distinction even more important because an error or malicious instruction may result in an action rather than merely an incorrect response.
As AI becomes more deeply embedded into security operations, organisations will need to think about it in two ways at once: AI is becoming part of the defence, but it is also becoming part of the attack surface.
General information disclaimer
This article provides general information and commentary only. It is not legal, cyber-security, technology or other professional advice. Organisations should obtain advice appropriate to their circumstances, systems and intended use of AI.
Sources
New Zealand National Cyber Security Centre, Opportunities for AI in Cyber Defence, 12 August 2026.
Australian Signals Directorate, Careful adoption of Agentic AI in cyber defence, 24 July 2026.
KiwiGen.AI 