The Attackers Are Working Together. Are We?

Wenzel Huettner has spent more than thirty years in technology, and he does not think AI is a revolution. He thinks it is a change of pace.

The founder of DEFEND, now its chief technology officer after handing the chief executive role on in 2025, told the Tech Users Summit that one question has mattered to him throughout that career: how do we use technology to let people and organisations do more?

The answer, in his view, is why trust and prosperity belong in the same sentence. New Zealand should be leaning harder on digital systems to build prosperity, and he believes the country has the capability to compete globally. But none of that happens unless people can trust the systems enough to use them.

And trust, he observed, is going the other way for some people.

The teenager who has had enough

"Every time I show him something, he turns around and says: this is AI, don't use it, it's not worth it, don't touch it. And stop talking about AI."

It got a laugh, and then it did not. Huettner’s point was that a growing number of people, younger ones especially, are actively turning away from AI. Not because they have assessed the risks, but as a reaction to everything being labelled AI at once.

For a room full of people trying to drive adoption, that is a more immediate problem than any threat actor.

He offered two things to do differently about it. One for organisations. One for each person in the room.

The organisational one: we are not sharing

New Zealand faces a digital threat landscape that no single organisation can handle alone, and Huettner’s framing of why was uncomfortably simple.

"The attackers are working together against us. Are we working together against the attackers?"

Are we sharing the intelligence, he asked. Are we sharing the learnings, and distributing them? The estimates of how much money New Zealand loses to cyber crime vary, but no version of the number is small.

Then he described the structural problem underneath, which is specific to this country’s shape.

New Zealand has a handful of genuinely large organisations and a very large number of small ones. The small ones do not have the funding to defend themselves against what is now coming at them, particularly at the speed and volume the previous speaker had just described. And those small organisations are the supply chain the large ones run on.

Which means the large organisations’ security is, in practice, partly determined by the security of businesses that cannot afford any.

His example of what that looks like when it goes wrong was from France, where a cyber attack took supermarket systems offline and food sat spoiling. It is the kind of consequence that does not read as a technology failure to anybody standing in the shop.

For an island economy at the end of a long supply chain, he argued, protecting that fragility is not optional. It requires businesses working together as a community, sharing threat intelligence and the capability to act on it, rather than each buying their own defences and hoping.

The personal one: truthiness

The second half of his talk was about information rather than infrastructure, and he built it around a word he clearly enjoys.

He often presents on misinformation, disinformation and malinformation, and always finishes on the same term. It is a real word, he insisted, and worth looking up: truthiness.

Truthiness is believability without truth. The insight he drew from it is the one that makes modern influence operations work.

"They don't have to convince you it's real. They only have to convince you to the point that it seeds doubt in your mind."

An attacker does not need you to believe the claim. They need you to find it plausible enough that it sits there. A rumour gets denied as fake news, and the denial leaves most people somewhere in the middle: well, it could have happened, there might be something in it. That residue is the product.

His answer was not media literacy lectures. It was that the same tools everybody is nervous about are extremely good at this particular job.

Nine times out of ten, he said, when someone asks him whether a site is legitimate, whether something is real, whether a request is valid, he puts it to an AI tool and checks. The technology that makes deception cheaper also makes verification cheaper, and most people are using only the first half of that trade.

So his ask of the room as individuals was deliberately small and repeatable. Take a little more time before you click on something, before you buy something, before you hand over details, and before you believe something, however true it feels.

Two words each

He closed by compressing it into two instructions, one for each half of the talk.

For businesses: share. For individuals: trust, but check.

Neither requires a budget, which was rather the point. In a country where most organisations cannot buy their way to safety, the things that scale are the ones that cost attention rather than money.