Cyber resilience systems and people are closely connected in New Zealand. Across the country, serious effort is going into strengthening the cyber security of critical infrastructure — communications, energy, health systems, finance, and transport.
That work matters.
Ultimately, resilience depends on how well people and systems work together.
And it’s clear that across the country, there is already meaningful activity under way to support people online — from organisations like Netsafe, national awareness campaigns such as those led by the National Cyber Security Centre through initiatives like Own Your Online and Cyber Smart Week, and a wide range of community-based efforts.
However, there is still a gap — not in effort, but in connection.
What we are seeing on the ground
In our digital inclusion work in Whanganui, we spend time alongside people in everyday settings — libraries, community spaces, informal conversations.
What we see is consistent.
People are not being defeated by highly technical cyber-attacks.
They are being caught out by:
- messages that feel real
- systems that are confusing
- situations where they feel uncertain or under pressure
People hesitate. They avoid action at times, and at other times act when they shouldn’t — or don’t act when they should.
This is not a failure of intelligence.
It is the reality of navigating an increasingly complex digital world without enough support.
New Zealand already has strong pieces in place
It’s important to acknowledge that New Zealand is not starting from scratch.
There is already significant work happening:
- national cyber awareness initiatives
- support services for people experiencing harm online
- education programmes across different age groups
- growing recognition of online safety as a public good
These are valuable and necessary parts of the system.
Where the gap still sits
At the same time, however, the way we think about critical infrastructure resilience is still largely structured around:
- systems
- organisations
- compliance
- reporting
What is less visible is how human capability and community-level experience fit into that model.
We understand that infrastructure is interconnected.
A disruption in one area can cascade across others.
But there is another layer of interdependence:
👉 how people experience, interpret, and respond to what is happening.
If people:
- don’t trust what they are seeing
- don’t understand what to do
- or withdraw from digital systems altogether
then the impact of any cyber incident is amplified.
Community insight as part of the system
There is also something happening quietly, and often locally.
Across communities, there are real-time signals:
- the types of scams people are encountering
- the questions they are asking
- the points at which they hesitate or disengage
This is not abstract — it is lived experience.
And it has value.
The opportunity is not to replace national efforts — but to better connect this community-level insight into the broader cyber resilience system.
From parallel efforts to connected resilience
New Zealand already has:
- national capability
- community capability
What is less developed is the bridge between them.
If we can connect:
- national systems and strategy
with - community-level understanding and support
we move from a model that is primarily technical
to one that is human-centred and system-aware
A practical next step
This does not require building something entirely new.
It may be as simple as:
- recognising community-based work as part of the resilience ecosystem
- creating clearer pathways for insight to flow upward
- strengthening partnerships between national organisations and local initiatives
Final thought
Cyber resilience is not only about protecting infrastructure.
It is about ensuring people can safely and confidently use the systems that infrastructure enables.
New Zealand has many of the pieces already in place.
The next step is to connect them.
The piece was developed collaboratively, blending Alistair’s lived experience with AI-assisted reflection.