“Autonomous systems will increasingly manage infrastructure, analyse security events, and trigger operational responses,” said Vinayak Sreedhar, highlighting the implications of a recent data breach that exposed private medical details of more than 120,000 individuals in New Zealand.
This cyber incident marks one of the largest breaches in New Zealand’s history, prompting officials to reevaluate their cybersecurity strategies. Following this event, the government announced the New Zealand Cyber Security Strategy for 2026-2030, aiming to bolster defenses against future threats.
The National Cyber Security Centre introduced Minimum Cyber Security Standards to enhance protections across government agencies. These standards focus on essential controls such as risk management, secure configuration, patching, multi-factor authentication, and least-privilege access.
As AI systems become more autonomous—making decisions without human intervention—the need for robust governance becomes critical. Sreedhar emphasized, “The autonomy you build must be safe.” Yet many organizations still view AI risk primarily as a model problem, neglecting the governance challenges that arise when these systems interact with live environments.
The shift towards agentic AI brings forth new categories of risk, especially in identity and access governance. This situation underscores a significant concern: the global shortage of cybersecurity and AI specialists complicates the deployment of advanced technologies.
Evelina Galaczi noted that while remote testing can enhance access and flexibility, it must meet high-security standards when determining crucial decisions. “When test results determine high-stakes decisions, the bar for security must be exceptionally high,” she stated.
This breach serves as a wake-up call for all stakeholders involved in technology management. The urgency for improved governance in AI systems is clearer than ever as they begin to autonomously manage critical infrastructure.
