Listen to this Post
Introduction:
For the third consecutive year, New Zealand business leaders have identified one threat above all others—not sophisticated nation-state actors, not zero-day exploits, but their own employees accidentally exposing sensitive data. The 2026 Kordia New Zealand Business Cyber Security Report reveals that 43% of organisations now rank accidental employee data exposure as their biggest cyber risk, yet one in four large businesses still operate without any formal cybersecurity awareness programme. This paradox—acknowledging the risk while failing to act—represents the single greatest vulnerability in modern enterprise security, compounded by the explosive growth of “shadow AI” where staff copy confidential information into unsanctioned AI tools without understanding the consequences.
Learning Objectives:
- Understand the shifting threat landscape where human error and AI misuse now outweigh external attacks
- Identify the technical and behavioural indicators of shadow AI and accidental data exposure
- Implement practical controls, training frameworks, and technical guardrails to transform employees from liabilities into defenders
You Should Know:
1. Shadow AI: The Unseen Data Exfiltration Channel
The 2026 Kordia report found that attacks exploiting AI vulnerabilities more than doubled from 6% in 2024 to 14% in 2025. Patrick Sharp, GM of Aura Information Security, warns that “individual staff members are copying confidential data into AI systems—information they would never put into Google—without understanding the risks and without guidance from their organisation”. This represents a fundamental breakdown in data governance.
Step-by-Step Guide: Detecting and Blocking Shadow AI
Step 1: Audit Outbound Traffic for AI Platform Patterns
Monitor network egress traffic for connections to known AI platforms (OpenAI, Anthropic, Google Bard, DeepSeek, etc.). On Linux, use `tcpdump` or `nftables` to log outbound traffic:
Log all outbound HTTPS connections to AI platform IP ranges
sudo nft add table inet ai_monitor
sudo nft add chain inet ai_monitor output { type filter hook output priority 0\; }
sudo nft add rule inet ai_monitor output ip daddr {14.xx.xx.0/24, 34.xx.xx.0/24} tcp dport 443 log prefix "AI_OUTBOUND: " accept
Step 2: Deploy Data Loss Prevention (DLP) Rules
Configure DLP policies to detect and block sensitive data patterns (credit cards, NZ tax IDs, health records) being uploaded to any unapproved cloud or AI service. On Windows Server, use PowerShell to audit file access and potential exfiltration:
Audit file access to sensitive directories
auditpol /set /subcategory:"File System" /success:enable /failure:enable
Monitor for large outbound transfers via BITS
Get-BitsTransfer | Where-Object {$_.JobState -eq "Transferring"}
Step 3: Implement Browser Extension Controls
Use Group Policy or MDM to restrict which browser extensions can be installed, blocking unapproved AI writing assistants and code copilots.
Step 4: Create an Approved AI Tool Whitelist
Publish a formal AI Usage Policy listing sanctioned tools with clear use cases. Require all employees to sign an acknowledgement that using unapproved AI tools for work data constitutes a security incident.
Step 5: Deploy CASB (Cloud Access Security Broker)
Tools like Microsoft Defender for Cloud Apps or Netskope can detect and block shadow IT usage in real time, alerting security teams when confidential data is pasted into AI prompts.
- Building a Security Awareness Programme That Actually Works
Despite 43% of leaders identifying employee error as their top risk, 24% of large businesses have no cybersecurity awareness or training programme in place. The gap between board-level recognition and operational action is costing organisations millions. The NCSC reported $12.4 million in direct financial losses in Q3 2025 alone—up 118% from the previous quarter.
Step-by-Step Guide: Designing an Effective Human Cyber Risk Programme
Step 1: Conduct a Baseline Phishing Simulation
Before training, establish a baseline. Use open-source tools like GoPhish or commercial platforms to run a simulated phishing campaign. Measure click rates, credential submission rates, and report rates.
Deploy GoPhish on Linux for internal phishing simulations wget https://github.com/gophish/gophish/releases/latest/download/gophish-vX.X.X-linux-64bit.zip unzip gophish-vX.X.X-linux-64bit.zip sudo ./gophish Access admin console at https://localhost:3333
Step 2: Segment Training by Role and Risk Profile
Not all employees face the same risks. Finance teams need spear-phishing awareness; developers need secure coding and AI prompt injection training; executives need business email compromise (BEC) simulations.
Step 3: Deliver Microlearning, Not Annual Compliance
Replace hour-long annual videos with 3-5 minute microlearning modules delivered weekly. Use real-world examples from your industry—not generic scenarios. Mindshift’s approach customises programmes “built for your people, your culture and your industry”.
Step 4: Implement Just-in-Time (JIT) Coaching
When an employee fails a phishing simulation or triggers a DLP alert, deliver an immediate, non-punitive coaching message explaining what went wrong and how to avoid it next time. Platforms like usecure combine “automated security awareness training, phishing simulations, dark web monitoring and policy management into one easy-to-manage solution”.
Step 5: Measure and Report Key Metrics
Track:
- Phishing susceptibility rate (and improvement over time)
- Reporting rate (percentage of simulated and real phishes reported)
- DLP incident rate by department
- Completion rates for training modules
Step 6: Board-Level Reporting
Translate technical metrics into business risk language. Report not just “click rates” but “estimated financial exposure from human error” and “risk reduction achieved through training.”
3. Technical Controls to Mitigate Accidental Data Exposure
While training is essential, technical guardrails must back it up. The Kordia report found that 17% of cyber incidents resulted in personal information being accessed or stolen, and 19% of affected organisations faced financial extortion—up from 14% in 2024.
Step-by-Step Guide: Hardening Endpoints and Data Flows
Step 1: Enforce Endpoint Encryption
Ensure all laptops and mobile devices use full-disk encryption. On Windows, use BitLocker:
Enable BitLocker via PowerShell Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -TpmProtector Backup recovery key to Active Directory Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId (Get-BitLockerVolume -MountPoint "C:").KeyProtector[bash].KeyProtectorId
On Linux (Ubuntu/Debian), use LUKS:
Encrypt root partition with LUKS sudo cryptsetup luksFormat --type luks2 /dev/sdaX sudo cryptsetup open /dev/sdaX encrypted_root Add to crypttab for automatic unlock at boot
Step 2: Implement Conditional Access Policies
Restrict data access based on device health, location, and user risk score. Use Azure AD Conditional Access or Google BeyondCorp principles:
Example: Block access from non-compliant devices (Azure AD PowerShell)
New-AzureADMSConditionalAccessPolicy -1ame "Block Non-Compliant" -Conditions @{DeviceStates=@{IncludeStates=@("All"); ExcludeStates=@("Compliant")}} -GrantControls @{BuiltInControls=@("Block")}
Step 3: Deploy Network Segmentation
Segment your network to limit lateral movement. If an employee’s credentials are compromised, attackers should not be able to reach critical systems. Use VLANs and firewall rules:
Example nftables segmentation rules
sudo nft add table inet segmentation
sudo nft add chain inet segmentation forward { type filter hook forward priority 0\; }
Allow HR VLAN to access HR server only
sudo nft add rule inet segmentation forward iifname "vlan10" oifname "vlan20" ip daddr 192.168.20.0/24 accept
sudo nft add rule inet segmentation forward iifname "vlan10" oifname != "vlan20" drop
Step 4: Enable MFA Everywhere
Require multi-factor authentication for all external-facing applications and privileged access. Phishing-resistant methods (FIDO2/WebAuthn) are strongly preferred over SMS or TOTP.
Step 5: Deploy Endpoint Detection and Response (EDR)
Use EDR tools to detect unusual behaviour—large outbound data transfers, unexpected process executions, or credential dumping attempts. Configure automated response actions for high-confidence alerts.
- Incident Response: When Human Error Becomes a Breach
The Kordia report reveals that 21% of businesses hit by a cyber-attack suffered disruption such as inability to access systems or serve customers. A third (32%) of businesses said they would consider paying a ransom. Sharp emphasises: “Organisations need to work out a response strategy long before they’ve suffered an incident, and they need to spend time practising it”.
Step-by-Step Guide: Building an Incident Response Playbook for Human-Caused Incidents
Step 1: Define Severity Levels
Create a matrix classifying incidents by impact (data type exposed, number of records, regulatory implications) and assign clear decision-making authority for each level.
Step 2: Establish a Communication Plan
Define who communicates with staff, customers, regulators (Privacy Commissioner, NCSC), and the board. The Kordia report notes that 36% of businesses have called for mandatory reporting requirements—prepare now.
Step 3: Run Tabletop Exercises
Simulate scenarios: “An employee pasted customer PII into ChatGPT. What do we do?” Test your playbook quarterly. Include legal, PR, and HR in these exercises—not just IT.
Step 4: Preserve Evidence
If a breach occurs, preserve forensic evidence for investigation and potential legal action:
Linux: Capture memory and disk image sudo dd if=/dev/sda of=/external/evidence.dd bs=4M status=progress sudo avml /external/memory.lime
Windows: Collect forensic artifacts Get-WinEvent -LogName Security,Application,System -MaxEvents 1000 | Export-Csv -Path "C:\forensics\events.csv"
Step 5: Engage the NCSC and Privacy Commissioner
“Engaging with Government entities like the NCSC and the Privacy Commissioner isn’t just about being transparent. It also helps the New Zealand Government and businesses understand the scale and impact of this criminal activity”.
5. The AI Governance Framework Your Organisation Needs
With one in six cyber incidents now involving AI misuse or vulnerabilities, organisations must move beyond ad-hoc policies. The Kordia report found that 24% of business leaders say improper AI use is a top barrier to improving their cyber security posture.
Step-by-Step Guide: Implementing AI Governance
Step 1: Classify Data by Sensitivity
Create a data classification scheme (Public, Internal, Confidential, Restricted). Clearly define which data categories can be processed by AI tools and which cannot.
Step 2: Build an AI Acceptable Use Policy
Document:
- Approved AI tools and their permitted use cases
- Prohibited actions (e.g., pasting source code, customer PII, financial data)
- Reporting requirements for AI-related incidents
- Consequences for policy violations
Step 3: Implement Technical Enforcement
Use API-based proxies that intercept AI tool traffic, applying DLP filters before data reaches the AI provider. This allows you to block sensitive data from ever leaving your network.
Step 4: Train Employees on AI-Specific Risks
Cover prompt injection, data poisoning, model inversion attacks, and the risks of relying on AI outputs without verification. The Kordia report highlights “shadow AI” as “the unauthorised use of AI tools by employees” that “is growing into a massive problem”.
Step 5: Audit AI Usage Quarterly
Review logs of AI tool access, data volumes processed, and types of queries made. Look for anomalies—unusual data volumes, queries containing sensitive terms, or access from unexpected locations.
What Undercode Say:
- Human error is not an IT problem—it’s a leadership problem. The Kordia report’s finding that 24% of large businesses have no security awareness programme is not a technology failure; it’s a governance failure. Boards recognise the risk but fail to fund and mandate the solution.
- Shadow AI is the new shadow IT—and it’s more dangerous. Employees are using AI tools to process data they would never put into a public search engine. Without clear policies, technical controls, and training, organisations are bleeding sensitive data into models they don’t control.
- The decline in attack volumes masks a rise in severity. While fewer businesses report being attacked, the financial impact is soaring—118% quarterly increase in direct losses per the NCSC. Extortion is up, disruption is widespread, and supply chains are being compromised. This is not a reason to relax; it’s a reason to prepare.
- Training must be continuous, contextual, and non-punitive. Annual compliance videos don’t change behaviour. Effective programmes use real-world simulations, just-in-time coaching, and role-specific content. The goal is to build a security culture, not check a box.
- Technical controls and human controls must work in tandem. DLP, MFA, encryption, and segmentation reduce the blast radius when humans make mistakes. But they cannot replace the judgement that only well-trained, security-conscious employees provide. The human firewall is real—but it must be maintained.
Prediction:
- +1 Organisations that invest in comprehensive human cyber risk programmes will see their breach costs drop by 40-60% within 18 months, as measured by reduced phishing susceptibility, faster incident detection, and lower extortion payouts.
- +1 AI governance will become a mandatory compliance requirement within 24 months, with regulators in Australia and New Zealand following the EU’s lead on AI Act-style data handling rules for workplace AI tools.
- -1 Shadow AI incidents will continue to rise sharply over the next 12 months as more employees adopt generative AI tools without organisational oversight, leading to at least one major public breach in New Zealand involving customer data fed into an unapproved AI system.
- -1 The 32% of businesses willing to consider paying ransoms will face escalating demands as cybercriminals become more sophisticated in targeting organisations they know will pay—creating a vicious cycle of extortion that training and technical controls could have prevented.
- +1 The convergence of security awareness training with technical DLP and CASB tools will create a new category of “human risk management” platforms that provide real-time risk scoring for individual employees, enabling proactive intervention before mistakes become breaches.
▶️ Related Video (72% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Melonie Cole – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
