Official reviews released under the Official Information Act show New Zealand Police lack the capability to investigate high-level cybercrime, RNZ has reported, meaning businesses hit by a cyber incident should not assume a police investigation will follow.
The AFP assessment, which police did not make public, found NZ Police "lacks the capability and capacity to undertake high-level cyber-dependant crime investigations", RNZ reported. It found officers looked for opportunities to end cyber matters when triggers were reached, such as a need for overseas enquiries or a reduced chance of a result, and that fragmented reporting left the cybercrime team unaware of many incidents. The April 2026 review said the gaps persist and that police would not keep pace with the volume of traditional and digital crime with their current tools, systems and data.
The April review estimated more than 70% of cybercrime targeting New Zealanders originates offshore, while the AFP described police contributions to overseas investigations as limited. Taken together, those findings suggest the cases most common in practice are the ones least likely to be pursued.
Police told RNZ they have been developing initiatives and exploring the capabilities they need. RNZ reported that an initial review of cybercrime and fraud capability has been completed to set a baseline and that the uplift work is on a two-year track, though most initiatives remain at planning or start-up stage and the wider police technology programme is not fully funded. The April documents said police were poised to set up a 15-person National Economic Crime Team. RNZ said police had not detailed the most significant capabilities still needed.
The threat picture is moving the other way. The National Cyber Security Centre's Cyber Threat Report 2026 recorded 369 incidents of potential national significance in 2025-26, 162 of them linked to criminal or financially motivated actors, up 18%, and said malicious actors may have advanced AI capabilities by early 2027 that are currently limited to leading frontier models. NCSC head Catriona Robinson said "Government cannot protect every organisation from every cyber threat."
Insurance cover is far from universal: some cyber brokers have reported penetration of about 10% among New Zealand SME clients and about 40% among large corporates, leaving many smaller businesses with neither a likely police investigation nor an insurer's response team to call.
For brokers, the practical points are to set clear expectations that criminal justice outcomes are unlikely to be quick, and to check how clients' policies would respond. IB New Zealand has reported two structural questions worth confirming: whether cover responds regardless of whether a ransom is paid, and whether it gives access to incident response expertise rather than only indemnifying loss afterwards. It is also worth checking what each policy's conditions say about reporting incidents to police, and encouraging clients to report to the NCSC and police regardless, since the AFP found gaps in reporting leave police without a full picture.
