Every Dollar After an Incident Buys Less Than Half

Having heard Paul Connolly of Kiwibank on agentic attack and Wenzel Huettner of DEFEND on why New Zealand organisations need to share more, the summit’s moderator opened the floor through Slido and joined them on stage.

The questions were practical, and the best answers came when the panel stopped talking about threats and started talking about money.

Is AI going to kill us?

The moderator used their privilege to ask first, and asked the question most cyber panels avoid. Where do you sit on the spectrum between AI as an existential threat to humanity and AI as a tool that can go wrong?

Huettner started with the cultural baggage: WarGames, Skynet, Terminator, computers taking over the world.

"AI is a tool that can be used for good and for bad. I don't think it's suddenly going to take over the world."

What matters, he argued, is learning to use the tool effectively, and his reasoning was national rather than technical. New Zealand is a small country. It needs to use every single advantage available to it, and AI is clearly one of them. Throwing up our hands and stepping back from the technology is the one option the country cannot afford.

Can we win a race with quantum coming?

The first audience question asked whether this is a race New Zealand can win at all, with quantum computing approaching, and whether sensitive data should be disconnected from the global internet.

Huettner’s answer was short. We cannot hide from it. Keep working, keep evolving the technology and the processes. Quantum will change things when it arrives, and the response is to stay on top of it and go hard.

Connolly gave the technical version, and it is the most immediately actionable advice in the session for anyone buying systems right now.

The core concern is that traditional encryption algorithms will likely become breakable. Quantum-resistant algorithms already exist and are available in most modern digital technology. So if you are deploying new digital systems, or you have been putting off replacing old ones, this is the moment to make that decision, and to check that what you are buying uses quantum-resistant cryptography.

He was equally clear about the scale of what follows. Making that change across an existing estate will be an enormous piece of work, requiring cryptographic processes and protocols to be updated across every system and every data store an organisation holds. Which is why the other half of his answer was about knowing what you have: where the data is, and who has access to it.

On the suggestion of disconnecting everything, his answer was no, with one important exception.

From an incident response perspective, and particularly for a smaller organisation, make sure you have a basic incident response process, and make sure that process includes knowing how to disconnect. If a system is online and being compromised, you need to be able to take it off the network fast so you can contain it. That is not a philosophy of isolation. It is a fire door.

What does “up to date” even mean now?

The next question was about keeping systems and people current when the industry changes this fast, and whether being up to date is still a useful concept.

Connolly went back to fundamentals: do not carry legacy you cannot defend, work with your partners, and make sure you do not leave anything exposed for an attacker to find.

Huettner’s answer was more interesting because he disagreed with the premise.

The underlying technology landscape has not really changed, he said. It is just moving faster. And like everyone else, he cannot personally keep up with all of it, so he does not try. He has AI agents that go out daily, gather the new stories and curate them for him each morning.

Then he reached for an analogy that landed well with a room of people who manage technology estates.

"I grew up with a manual car. You had to know everything about the car to drive out the door. Now you hop in and push the go button."

It is about working smarter rather than harder. He would love everyone to understand their systems the way he once understood a carburettor, but the realistic move is to take the advantage on offer, and to stand on the shoulders of giants by learning from what others have already worked out.

Windows XP, and whose fault it is

An audience member described working inside organisations that grew from small beginnings and never prioritised replacement, still running a critical piece of software on an instance of Windows XP. Is this just about how much organisations prioritise proactive replacement, or is there more to it?

Connolly’s answer was sympathetic and then firm. A lot of it is budget and busyness: everyone is delivering something, and currency slips. Some legacy process systems genuinely have to run on equipment that cannot be updated, for reasons that are real.

But in most cases, he said, the choice is between weighing the risk and quietly accepting it, and too many quietly do the second because the business case for replacement never gets made. The last thing anybody wants is for that particular system to be the one that gets compromised.

What a small business can do

The question the room most needed answered came next. Given small organisations do not have the resources, what are the key things they can do to stay ahead in an attacker-versus-defender arms race?

Huettner had a list of seven resilience points he walks through with organisations, and the first was the least technical.

Name someone. In a small organisation, whose job is security? Whose job is it to look after it? It sounds trivial, he said, and it is the thing most often missing. Visibility comes before capability.

Have a basic incident response process, and know who to call when something goes wrong.

Know what technology you have, keep it simple, and keep it current. His warning here applies to everyone: the more technology you introduce, the more you have to manage and maintain, so use the managed services available rather than running everything yourself.

Then he got to money, and this was the answer worth writing down.

Security spending should be an ongoing investment rather than a sporadic one. Even a small organisation should be able to allocate a budget, and the amount matters less than the regularity.

"Even if that's only $5,000, it's better to have an amount you're willing to spend every single year than to wait until you have an incident and are trying to recover from it."

And then the line that reframes the whole business case.

"Every dollar spent post-incident buys you less than half the return of a dollar spent before it."

Connolly added the practical companion for the organisation where one person owns all of the ICT and the liability. If there is a small amount of money available, put it into a modest retainer with a response provider. Then if the worst happens, there is someone to call who can give advice and real help, rather than a scramble to find a stranger mid-incident.

Is the government helping?

A Slido question asked whether government is responding in the right way as the threat environment changes, with a pointed aside about whether the National Cyber Security Centre is still the backstop people assume it is.

The panel’s answer was more critical than conference panels usually get.

The government, they noted, still has not released its cyber security strategy, which went out for consultation around March. They referred to commentary at the time that the draft did not contain much that was new.

More awkwardly, they said it can be unclear what the NCSC’s role really is. Connolly put it in operational terms: if there were a major incident in banking, the NCSC would certainly be called, but is it the first call you would make? The honest answer in the room was that people are not sure, and that uncertainty is itself a problem when minutes matter.

The gap, in an election year

The closing question noted that the gap between the organisations that can defend themselves and the ones that cannot is not unique to New Zealand, and asked what needs to change here in an election year.

Huettner went straight back to his opening argument. What needs to change is sharing: helping each other, working together, and distributing what we learn.

Then he put a question back to the room, which is the one worth carrying into the next few months of campaigning.

Yes, we can ask government to do more. But what are we asking for? Preventive advice and guidance, or reactive support when something has already gone wrong? Having someone to call matters, and he was clear he wants that capability to exist. But the real leverage sits in prevention, and in the information that stops a threat landing in the first place.

Which leaves a duty on the sector itself. We have an accountability to inform ourselves, educate ourselves, and share what we know as a community.

"Are we turning to government to provide all of those answers, or is there an expectation that we find some of them ourselves?"