October 7, 2026

AI and Cyber Security: Are Your Policies and People Ready?

6 min read

Picture a finance officer who gets a voice message from the CEO asking for an urgent payment. The voice is right. The tone is right. The request is plausible. It’s also fake.

AI is now a part of everyday work. Microsoft Copilot, ChatGPT, Claude and Gemini (to name a few) are helping people draft content, analyse information and get through routine tasks faster than ever. The same technology is making cyber threats quicker to produce and harder to detect, and it’s creating new risks inside businesses that haven’t set rules for it.

So, are your policies, systems and people keeping up with how AI is actually used?

What AI changes about cyber risk

Phishing, impersonation, social engineering and data leakage are old problems. AI makes them cheaper to run and harder to spot. Phishing emails used to give themselves away through clumsy wording, spelling mistakes or requests that didn’t add up.

Now AI can write a polished message in your organisation’s tone, mention a real project, and appear to come from a senior leader, colleague or supplier. Deepfake audio, video and images take impersonation further. An urgent request can look and sound completely legitimate, which makes pausing to verify more important than it has ever been.

That’s the message of this year’s Cyber Smart Week: threats are getting more sophisticated, but people remain one of your best defences. An employee who feels able to question an odd request, check it through another channel and report it quickly can stop a convincing attempt becoming a costly incident.

The risk inside your business

Not every AI risk starts with a criminal. Often, it starts with someone trying to finish a task.

An employee pastes source code, customer data, financial figures or meeting notes into a public AI tool without knowing how that information might be stored or used. Another trusts an AI-generated answer without checking whether it’s accurate or secure. Most of the time this isn’t carelessness. Nobody has told them where the line is.

The National Cyber Security Centre’s guidance on engaging with artificial intelligence sets out an informed, secure and responsible approach. It identifies threats to AI systems and offers mitigations for organisations using self-hosted and third-party tools.

Informal AI use is still AI use. If you don’t know how your people are using these tools, you can’t manage the risk.

Your existing policies might not cover this

Most organisations already have policies on acceptable technology use, privacy, information security and data handling. Many were written before generative AI became part of daily work. A blanket ban isn’t the answer either, because it tends to push AI use onto personal accounts and unapproved tools, where you can’t see it.

A usable AI policy answers these questions:

Which AI tools are approved?
What information can go into them?
How do privacy, confidentiality and intellectual property requirements apply?
When does an output need human review?
Who approves new use cases, receives incident reports and owns AI governance?

It also has to change over time. Microsoft’s article on responsible AI in 2026 argues for adaptive governance, ongoing risk management and controls such as permissions, monitoring and employee training. That matters more as AI tools start to retain information, access data and take action on a user’s behalf. A policy written once and filed away won’t cover that.

Technology won’t catch everything

Access controls, monitoring and approved platforms matter, but they can’t see every decision an employee makes. Your people are both where things can go wrong and your strongest protection.

Digital literacy now includes using AI securely, questioning what it produces, and recognising when something is misleading or malicious. In practice, employees need to be able to spot unusually convincing phishing, verify unexpected requests for payments, information or system access, and judge what is safe to put into an AI tool. They also need to question realistic-looking audio, video and images and check AI outputs before acting on them. Just as important, they need to be able to report a mistake straight away without worrying about blame. People who fear blame tend to hide mistakes.

Training should fit the role. A developer using AI to write or review code faces different risks from a finance analyst working with company figures or a leader summarising a confidential strategy paper. The closer training is to the decisions people actually make, the more of it sticks.

Five questions to ask before you add more AI tools

Here’s where I would start.

1. How are your people already using AI?

Look past the approved systems. Anonymous surveys and open team conversations will show where staff are using personal accounts or unapproved platforms. Treat it as research, not an investigation. You want to see how work really gets done so you can offer better tools and clearer limits.

2. Do your people know what safe AI use looks like?

Test whether they know what must never go into a public AI tool, when to verify an unexpected request, and who to ask when they’re unsure. Cyber Smart Week’s advice is simple: think twice before putting information into an AI tool, and if in doubt, leave it out.

3. Who is responsible?

Name who approves tools, owns AI governance, monitors risk and responds when something goes wrong. Your technology team will be involved, but accountability needs to reach senior leadership and the wider business.

4. Where are the capability gaps?

Check your depth across cyber security, data governance, privacy, cloud security, architecture, technology risk and responsible AI.

5. Does your workforce plan match your AI strategy?

Decide which skills you can build internally and where you need specialists, whether permanent, contract or project-based. Powerful new tools are wasted if you don’t have people who can introduce and govern them securely.

Closing the capability gap

Last year we looked at the pressure New Zealand organisations face in finding specialist cyber talent, in our blog on navigating New Zealand’s cyber security talent gap. It covered workforce planning, retention, training and flexible resourcing. AI adds another layer.

Some employers will focus on upskilling existing teams and lifting digital literacy across the business. Others will need specialists in AI governance, cyber security, cloud security, data, architecture or technology risk. A permanent hire isn’t always the answer. Contract or project-based specialists can cover a particular implementation, assessment or uplift programme, while permanent staff hold the organisational knowledge that keeps AI well managed over the long term.

Find the gap before it becomes an emergency.

Where to start

AI adoption is as much a people and governance question as a technology one. The organisations that get the most from it will be the ones whose people know the rules, have training that fits their role, and work under governance that changes as the technology does.

If you’re preparing for AI adoption or assessing whether your team has the skills to use it securely, give me a call or get in touch. I can help you understand the talent market, identify capability gaps and plan the permanent or contract hires you need.

Justin Kissling

Branch Manager

Justin Kissling enjoys understanding the impacts of new technologies in the market and following the trends across technology.

Tech Workforce Planning: The Value of Contractors

4 min read

In my last blog I talked about why in today’s market, more Kiwi tech professionals are choosing contract work over permanent positions, a move that’s picked up pace this year. That’s a signal, and it changes what employers should be doing too. Instead of treating contractors as a backup resource, it’s a smart move to build them into your overall workforce plan. In this blog, I’ll cover what’s driving contractor demand right now, and how to bring contractors into your organisation strategically, rather than reactively.

Contractor demand is real, and it’s strategic

Contractor hiring picked up noticeably in 2025. In our 2026 IT Job Market & Salary Report, 64% of tech employers told us they’d hired contractors that year, up from 44% the year before. Twelve percent hired 21 or more contractors. The reasons employers gave weren’t about filling gaps. Project work topped the list, followed by business flexibility and skills availability, then the ability to start quickly. That’s a deliberate resourcing choice, not a stopgap mindset.

We’re seeing signs of economic recovery in the back half of 2026, and the organisations that were cautious last year are now getting prepared. Contractor hiring is part of that shift.

Why contractors fit this specific moment

A few pressure points are showing up across the market right now: AI adoption, cybersecurity uplift, cloud modernisation, and the ongoing challenge of modernising ageing systems. Each one is creating a skills gap that’s opening up faster than in-house teams can close it, which is exactly the kind of gap contractors are built to fill.

AI adoption isn’t just a roadmap item anymore. Teams are being asked to actually implement it, and that takes specific experience with tooling and integration that many in-house teams haven’t built up yet. Cybersecurity is under similar pressure, threats move faster than internal capability can always keep pace with, so it often means bringing in someone who’s already dealt with the exact risk in front of you. Cloud modernisation projects tend to be time bound too, which suits a contract engagement far better than a permanent hire you’d need to keep busy once the migration wraps up. And with ageing systems, the people who understand the legacy tech are often a different pool entirely from the people building what replaces it, so for a while you need both skill sets at once.

Last year’s conversation was about recovery timing. This year, it’s about matching your resourcing to where the market’s actually moved. Contractors give you access to specialist skills without the commitment of permanent headcount, which matters when a lack of specific skills in the NZ market is one of the top hiring challenges employers report.

A blended workforce, not either/or

The real opportunity for Kiwi employers isn’t perm versus contract, it’s both working together.

Different role types suit different parts of the work. A six-month cloud migration doesn’t need a permanent hire sitting idle once it’s done, but a two year platform overhaul might need a permanent lead who knows the business, plus contractors brought in for specific technical pieces along the way.

Getting this mix right also protects your permanent team from burnout. Contractors can absorb surge work, tight deadlines, and unexpected scope, while your core team stays focused on what keeps the business running day to day. And because any contractor spend moves with actual workload, your spend doesn’t sit fixed on the books no matter what’s happening

How you get ahead of the need

Some employers get more out of contracting simply because they plan for it. They build it into the same conversations as budget and headcount planning, rather than scrambling once a gap’s already appeared. That starts with the relationship; talk to your recruiter before the need hits, even if it’s just flagging what might be coming up next quarter. A quick conversation now beats a rushed brief in six months.

Reactive hiring has a real cost. Good contractors get snapped up fast, so if you’re only calling when you’re stuck, you’re competing for whoever’s left. Employers who’ve built the relationship early get first look instead.

How Absolute IT can help

We hold and actively manage a deep, vetted contractor network, which means faster access and less friction when you need someone. We can also advise on the practical side such as engagement terms, market rates, and what’s realistic for your budget.

One thing we’re increasingly asked about is skills availability itself. We can tell you honestly whether the specific skills you need for a project are readily available in the current market, or where you might need to widen your search, or adjust your timeline. That’s part of the value of partnering early, rather than finding out mid-project.

We’re seeing a growing pool of contractors who are genuinely committed to the contracting path, not just between permanent roles. It’s worth building a relationship with these contractors early, before your need arises.

Ready to talk contractor workforce planning?

Get in touch with me to talk through your project resourcing needs, or to start building a contractor strategy that works alongside your permanent team.

Simon Meehan

Senior Consultant

Having worked in various roles within the New Zealand Telco industry, Simon decided a change was needed and joined the Absolute IT team as a Consultant in 2021.