Every security budget we have ever reviewed rests on the same bet: attacking is expensive.
A human attacker has a limited number of hours. Give them a thousand ways into an organisation and they’ll look for the easiest one. If they can’t find it quickly, they move on to someone softer. Defenders know this, so they don’t try to close every gap. You close enough of them that you cost more to break into than the organisation next door, and you spend the rest of the budget on detection and response for the attacker who decides you’re worth it anyway.
We’ve spent ten years breaking into systems for a living and running the teams that defend them. That bet held the whole time. This year it stopped holding, and faster than anything we’ve seen.
The attacker’s time is no longer the limit
An AI agent doesn’t get tired and doesn’t bill by the hour. It can work through every exposed system, every leaked password and every small supplier at once, and work that was never worth a criminal’s evening now costs a few dollars of compute.
In late October, Anthropic reported that its model built a working remote exploit for a flaw in the Linux kernel’s TCP code and took over a lab server without credentials. Leaking the first kernel address took about 48 minutes, and getting root took another five. We have been tracking the patches since. Red Hat shipped fixed kernels on 1 November. Ubuntu still had none on 3 November. The exploit took under an hour, and the fixes are taking weeks.
That gap was already closing before AI. Google’s Mandiant measured the average time from disclosure to exploitation at 63 days in 2018. By 2025 it estimated minus seven days, meaning exploitation usually starts before a patch exists. The same report found that the time between an initial access broker getting in and handing the access to the next group fell from over eight hours in 2022 to 22 seconds in 2025.
To be fair to the other side of the argument, Mandiant also wrote that 2025 was not the year breaches were the direct result of AI. Attackers were using it for reconnaissance, phishing and malware development, and the humans still did the hard part. We don’t think that lasts. Anthropic described a state-sponsored group in November 2025 that used its tools to carry out most of the work in intrusions against about thirty organisations, with people stepping in only at a handful of decision points. New Zealand’s NCSC now calls what’s coming a “vulnerability storm”, its words, in guidance it published for government agencies in June.
Stolen data used to sit unread
Here is a concrete example of what changes when the attacker’s time stops being scarce.
Infostealers are cheap malware that quietly copy saved passwords, browser cookies and files off a computer. The haul is packaged as a “log” and sold. Flashpoint counted 7.4 million infected devices and 1.7 billion stolen credentials in the first half of 2026 alone. On the biggest market, a log sells for about $10.
Most of those logs used to go unread. Think of a teenager who downloads a cracked game and gets infected. Their PC holds Discord logins and a Steam account, which isn’t worth an afternoon of a human attacker’s time. An agent goes through it anyway. It can link the teenager to their parents and siblings from the same browser history, work out where each of them is employed, and find the saved session for a parent’s work email in the same log. A low-value infection becomes a way into an employer. Flashpoint’s report describes criminals already running automated pipelines that ingest new logs as they arrive and start testing the credentials straight away.
Small suppliers hold big companies’ data
The second example is the small company that holds a big company’s data.
A large organisation usually spends its security money on its own systems. The hot-desk booking app, the staff survey tool and the payroll add-on get a vendor questionnaire and a pass, because they were judged too small to attract an attacker. They hold the staff list anyway.
New Zealand has seen how this goes. In late 2022, ransomware hit Mercury IT, a small Wellington managed IT provider. The Ministry of Justice lost access to around 14,500 coronial files and 4,000 post-mortem reports, and Te Whatu Ora lost access to bereavement and cardiac data. Neither agency was the target. Their supplier was.
That attack still took a human crew. Today, given only a company’s name and public information, our own agent maps its third, fourth and fifth-party suppliers in an afternoon. An attacker’s agent would then try to break into the weakest of them, and a compromised hot-desk app hands over a list of every employee who ever logged in. The same work can run against every government agency, cloud provider and lines company in the country at the same time.
These weaknesses have been around for years. Agents can now find them, connect them and act on them across thousands of targets at once.
Why this lands hard here
About 97% of New Zealand businesses have fewer than 20 staff. Most of them have no security person at all, and plenty of them hold data for larger organisations and government agencies. Many of those agencies also share the same small group of IT suppliers.
The NCSC’s own numbers are already moving the wrong way. It received 5,995 reports in 2024/25, and direct financial losses reported to it rose from $21.6 million to $26.9 million. Those figures cover the year before agentic tools were widely available, and not every loss gets reported.
We think cyber security posture is now part of national security, and it has to hold at every level: central and local government, large enterprises and the SMEs that supply them.
What we think should change
Defenders have to do what attackers now do: hunt for weaknesses at scale, before someone else finds them. The difference is permission. Four changes would help.
- A legal safe harbour for good-faith security research. Section 252 of the Crimes Act 1961 makes accessing a computer system without authorisation an offence, and it gives no protection to someone who comes across a flaw and reports it responsibly. That discourages people from reporting what they find. The UK is rewriting its Computer Misuse Act for the same reason, and the argument there is now about how wide the defence should be. New Zealand hasn’t started that conversation.
- A national programme of authorised offensive testing, coordinated by the NCSC. Government agencies, critical infrastructure operators and SMEs could opt in, and New Zealand security firms and researchers would do the work under a clear scope and clear rules. Attackers already test everyone. The defenders should too, with consent.
- Mapping and testing the suppliers that hold government data, down to the fourth and fifth party. Most agencies can name their direct suppliers. Very few can name their suppliers’ suppliers.
- Monitoring criminal markets for New Zealand credentials stolen by infostealers, and warning the affected people and organisations before an attacker uses them. The logs are cheap to buy for criminals and they are cheap to buy for defenders.
What to do with this
If you run security for an organisation, start with the list you probably don’t have: every outside company that holds your staff or customer data, and who they in turn rely on. Then ask how many of them you have ever tested, or seen tested. Check whether your staff’s work credentials are showing up in infostealer logs; several services will tell you. And measure your patch time for anything facing the internet in days, because the attackers are now measuring theirs in hours.
If you’re in government, the NCSC’s frontier AI guidance asks agencies to confirm who is accountable for this risk and to fix material gaps now. That’s the right first step. It won’t be enough on its own when the same tools that find the gaps are available to anyone.
A disclosure, since it matters here: we sell offensive testing, including the kind described in this post, so weigh our recommendations with that in mind. We only test systems whose owners have authorised it. If you want to talk about any of this, get in touch.