![](\"https:\/\/www.newsbeep.com\/nz\/wp-content\/uploads\/2025\/10\/8L8zgwlQPAPDB8jESgyG1dmlm5wOYpED6j3pPvE2.jpg\")
Nyuk Loong Kiw, Spark\u2019s Centre of Excellence Lead for Cyber Security<\/p>\nArtificial intelligence has the potential to become both a lifeline and a liability for modern organisations, as a revolutionary tool capable of spotting threats at lightning speed, but also the ultimate weapon in the hands of cybercriminals.\u00a0<\/p>\n
That\u2019s why Spark, the country\u2019s largest telecommunications and digital services provider, has a 100-person strong team employed to help keep its networks and customers safe from complex and evolving cyber threats.\u00a0<\/p>\n
\u201cToo many people assume that they can just spend a million dollars and the job is done,\u201d says Nyuk Loong Kiw, Spark\u2019s Centre of Excellence Lead for Cyber Security, and a 23-year veteran of the company.\u00a0<\/p>\n
\u201cBut in cyber security, the defender must get hundreds of things right, while the attacker needs only to take advantage of one slip \u2013 one stolen credential or one overlooked vulnerability.\u201d\u00a0<\/p>\n
Nyuk Loong Kiw, Spark\u2019s Centre of Excellence Lead for Cyber Security<\/p>\n
\u00a0<\/p>\n
Short-circuiting malicious attacks\u00a0<\/p>\n
The result can be a data breach or ransomware attack that\u2019s costly to fix and erodes trust in the hacked organisation. The rise of generative AI tools like intelligent chatbots able to spin up computer code and fake messages in seconds has only made it easier for hackers to supercharge their efforts to infiltrate networks and dupe victims into divulging their login credentials.\u00a0<\/p>\n
\u201cMany Fortune 100 companies have invested billions in cyber security. They all eventually still get compromised in some way,\u201d says Kiw.\u00a0<\/p>\n
For Spark, this hard truth means that detection is all-important, since no defence is infallible. Visibility and rapid anomaly detection are essential. This is where automation and AI become the cyber security team’s best friend.\u00a0<\/p>\n
\u201cHaving a good security monitoring detection capability in place allows us to know that something’s happened and do something about it quickly.\u201d\u00a0<\/p>\n
Spark\u2019s approach: Guardrails, testing, and automation\u00a0<\/p>\n
Spark\u2019s cyber stance on AI includes technical guardrails around both commercially available AI like Copilot and ChatGPT, and their internally developed systems. \u00a0<\/p>\n
\u201cBefore we release our AI apps into production, we actually go through white box testing. We penetration test the heck out of it, handing the code to a \u2018white hat\u2019 hacker and telling them to go and find the loopholes.\u201d\u00a0<\/p>\n
Spark doesn\u2019t block staff from using unauthorised tools, knowing this only fuels the \u2018shadow AI\u2019 problem. \u201cWe know that people are looking to boost productivity with these generative AI tools. So we embrace good governance, publishing policies that offer clear guidance around the dos and don\u2019ts if they are using these tools,\u201d says Kiw.\u00a0<\/p>\n
Kiw stresses that cyber security is no longer just the domain of IT teams. Boards and executives need to view resilience as a business enabler \u2013 central to protecting trust, reputation and continuity in an unpredictable environment.\u00a0<\/p>\n
There\u2019s a strong focus at Spark on automation, taking the mundane, repetitive tasks off the plate of the cyber security team so it can focus on detecting unusual, suspicious activity and responding to threats. \u00a0<\/p>\n
Spark\u2019s efforts to detect phishing attacks \u2013 which see malicious actors try to trick victims into revealing sensitive information, such as passwords or bank details \u2013 have had dramatic results.\u00a0<\/p>\n
\u201cLike most large New Zealand companies, we received a large volume of phishing emails,\u201d Kiw says. \u201cPrior to us putting our new automated solutions in, every single reported phishing incident took our Security Operations Centre people 10 minutes to analyse.\u201d\u00a0<\/p>\n
Now, AI takes care of 50% of cyber incidents, intercepting malicious emails and messages. For the rest, AI-powered analysis means the cyber team can evaluate a suspicious message in one minute, rather than ten.\u00a0<\/p>\n
\u201cAutomation and AI have saved 10,000 hours of human effort since we embarked on this journey,\u201d says Kiw. \u201cAnd that\u2019s at a small cost. It is very real how AI can help us with security.\u201d\u00a0<\/p>\n
![](\"https:\/\/www.newsbeep.com\/nz\/wp-content\/uploads\/2025\/10\/IGPeMDWV7Mw3InLMeZQ6XFvTcmMiy0enZZmFA7yn.jpg\")
Spark won WIS Best Place to work in Security 2023<\/p>\n
\u00a0<\/p>\n
Zero Trust and the changing perimeter\u00a0<\/p>\n
Kiw highlights the importance of modern architectural approaches, especially the Zero Trust practice widely advocated by cyber security experts.\u00a0<\/p>\n
Zero Trust doesn\u2019t assume you are a trusted person just because you\u2019ve successfully logged on to the device or network. \u201cUsing an analogy, Zero Trust is like having a security guard at every door inside your office, checking ID every time \u2013 because in today\u2019s world, you can\u2019t assume someone is safe just because they\u2019re already inside,\u201d says Kiw.\u00a0<\/p>\n
Kiw\u2019s advice for New Zealand enterprises is to invest in people \u2013 to make cybersecurity awareness and training the first line of defence, and adopt Zero Trust methodologies when refreshing your technology lifecycle.\u00a0<\/p>\n
He also points out that regulatory and compliance obligations are tightening in New Zealand and abroad. Spark\u2019s role is not only to help organisations defend against attacks, but also to meet evolving governance standards with confidence.\u00a0<\/p>\n
Talent, burnout, awareness\u00a0<\/p>\n
The complexity from cloud, IoT, and AI, especially at the edge of networks where people are working from home, makes it \u201c100% way harder and more complicated than it used to be,\u201d says Kiw.\u00a0<\/p>\n
The global talent shortage makes cyber security especially demanding, with attacks often landing outside office hours.\u00a0<\/p>\n
\u201cThe talent shortage is very real,\u201d says Kiw. \u201cEven with a team of 100, there\u2019s always more than enough to do.\u201d \u00a0<\/p>\n
Spark invests in career growth and partnerships with academic institutions to keep its talent pipeline strong.\u00a0<\/p>\n
Ultimately, says Kiw, AI-enhanced attacks, data leakage, and evolving threats are real and rising. Yet with diligent governance, technical guardrails, robust testing, and a mindset of continuous adaptation, Spark sees AI as a necessary ally. \u00a0<\/p>\n
\u201cEveryone needs to embrace it. We are on that journey and learning every day what works at scale to help keep our people and our systems secure.\u201d<\/p>\n