{"id":625455,"date":"2026-10-09T14:42:24","date_gmt":"2026-10-09T14:42:24","guid":{"rendered":"https:\/\/www.newsbeep.com\/nz\/625455\/"},"modified":"2026-10-09T14:42:24","modified_gmt":"2026-10-09T14:42:24","slug":"quantum-threat-timeline-raises-cyber-insurance-questions-for-nz-brokers","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/nz\/625455\/","title":{"rendered":"Quantum threat timeline raises cyber insurance questions for NZ brokers"},"content":{"rendered":"<p>\n                        Current policy wordings may not account for encrypted data stolen today and decrypted years from now\n                    <\/p>\n<p>                            <img decoding=\"async\" src=\"https:\/\/www.newsbeep.com\/nz\/wp-content\/uploads\/2026\/10\/0381_639271468674472140.png\"   width=\"1000\" height=\"600\" alt=\"Quantum threat timeline raises cyber insurance questions for NZ brokers\" fetchpriority=\"high\"\/><\/p>\n<p>A global cyber security firm has warned New Zealand organisations to prepare for quantum computing threats that could render current encryption obsolete by 2030, raising questions about whether cyber insurance policies are equipped for the fallout.<\/p>\n<p>Fortinet senior executives visited New Zealand last week to brief organisations across health, finance, energy, and utilities on the combined risks of AI and quantum computing, as reported by <a href=\"https:\/\/www.rnz.co.nz\/news\/business\/1799757\/alarm-sounded-over-double-risk-of-ai-and-quantum-threat\" target=\"_blank\" rel=\"nofollow noopener\">Radio New Zealand (RNZ)<\/a>.<\/p>\n<p>For brokers, the compressed timeline puts a new category of long-tail exposure on the agenda.<\/p>\n<p>How harvest now, decrypt later creates coverage uncertainty<\/p>\n<p>The core concern is a strategy known as Harvest Now, Decrypt Later (HNDL). Cyber criminals are collecting encrypted data now with the intention of decrypting it once quantum computing reaches sufficient capability.<\/p>\n<p>Filippo Cassini, senior vice president and global chief technical officer at Fortinet, told RNZ that bad actors were already preparing for what the industry calls Q-Day.<\/p>\n<p>This creates a problem for cyber insurance. Data harvested in 2026 could become a fully realised breach in 2030 or later. Does the policy in force at the time of data theft respond, or the one active when decryption occurs? Brokers advising commercial clients will need to consider how current wordings address that gap.<\/p>\n<p>Duncan Morrison, cyber practice leader at <a href=\"https:\/\/www.insurancebusinessmag.com\/nz\/companies\/aon\/61630\/\" rel=\"nofollow noopener\" target=\"_blank\">Aon<\/a> New Zealand in Auckland, has previously noted the importance of boards understanding their financial exposure from cyber events. \u201cWithout that financial lens, cyber risk can be underestimated or deprioritised,\u201d Morrison said, as previously reported by <a href=\"https:\/\/www.insurancebusinessmag.com\/nz\/news\/cyber\/nz-cyber-rules-put-director-liability-on-the-broker-agenda-589476.aspx\" target=\"_blank\" rel=\"nofollow noopener\">Insurance Business<\/a>. The quantum dimension adds a new layer to that calculus.<\/p>\n<p>Wei Ling Neo, vice president of product management at Fortinet, said investment had shortened the quantum timeline. \u201c(It) has been shortened by a lot of investments into quantum computing, which has brought the timeline much closer to 29 and 2030, for when we will have a viable quantum computer that will be able to decrypt the current algorithms that we use,\u201d Neo said.<\/p>\n<p>Read next: <a href=\"https:\/\/www.insurancebusinessmag.com\/nz\/news\/cyber\/falling-cyber-alerts-may-not-mean-lower-risk-at-renewal-591209.aspx\" target=\"_blank\" rel=\"nofollow noopener\">Falling cyber alerts may not mean lower risk at renewal<\/a><\/p>\n<p>NZ government is already moving on quantum readiness<\/p>\n<p>New Zealand\u2019s government has signalled that quantum readiness is a priority. The Cyber Security Action Plan 2026-2027, published by the Department of the Prime Minister and Cabinet (DPMC), includes a specific action led by the National Cyber Security Centre (NCSC) to \u201cenable New Zealand to process and manage quantum-resistant cryptographic material.\u201d<\/p>\n<p>The Government Chief Information Security Officer (GCISO) has also reported to Treasury that agencies\u2019 investment proposals do not dedicate enough time and resources to cyber security or emerging threats, according to Quantum Zeitgeist.<\/p>\n<p>The New Zealand Information Security Manual (NZISM), updated in November 2025, now includes a section on post-quantum cryptography. It recommends that agencies inventory sensitive datasets needing long-term protection, identify systems reliant on public key cryptography, and develop transition plans. The Government Communications Security Bureau (GCSB) noted it may deprecate current cryptographic standards within the next two to three years.<\/p>\n<p>While the NZISM guidance applies to government agencies, it offers a framework that brokers can reference when talking to private sector clients about their own preparedness, similar to how recent NCSC supplier-oversight guidance has shaped cyber insurance conversations.<\/p>\n<p>Broader preparedness remains low<\/p>\n<p>A 2025 poll of more than 2,600 professionals by ISACA found that 55% had taken no preparatory action on quantum computing threats. Only 5% had a defined strategy, and 37% had never discussed the topic within their organisation, as reported by IT Brief New Zealand.<\/p>\n<p>Respondents from Oceania showed concern at least 10 percentage points above the global average.<\/p>\n<p>Jamie Norton, ISACA board director, said: \u201cToo many Australian and New Zealand organisations remain in reactive mode.\u201d<\/p>\n<p>Cyber threats are already escalating in NZ<\/p>\n<p>The quantum risk arrives on top of a worsening threat environment. The Cyber Threat Report 2025 recorded 331 incidents of potential national significance in the 2024\/25 year. Criminal or financially motivated actors accounted for 137 of those, up from 65 the previous year. Direct financial losses reported to the NCSC reached $26.9 million, up from $21.6 million.<\/p>\n<p>The report also found that 53% of small and medium enterprises experienced a cyber threat in the first half of 2025, up from 36% in 2024.<\/p>\n<p>A separate NCSC quarterly report for Q1 2026 recorded three C2 (highly significant) incidents, the first at that severity level since the 2021\/22 financial year, according to OpenGov Asia.<\/p>\n<p>The NZ cyber insurance market has softened even as threat levels have risen, with Aon classifying conditions as soft in Q1 2026.<\/p>\n<p>Read next: <a href=\"https:\/\/www.insurancebusinessmag.com\/nz\/news\/cyber\/nz-cyber-threat-rises-as-insurance-market-moves-the-other-way-591218.aspx\" target=\"_blank\" rel=\"nofollow noopener\">NZ cyber threat rises as insurance market moves the other way<\/a><\/p>\n<p>What should brokers be asking clients?<\/p>\n<p>Neo said many organisations remain focused on AI without assessing their broader exposure. \u201cThe timeline is getting shorter and shorter for them to be ready, to protect against quantum threat,\u201d she said.<\/p>\n<p>Cassini noted that upgrades would be costly but necessary. \u201cI think they should be looking at how safe and upgradable it is. It\u2019s a little bit of extra money, but I think it\u2019s worth it,\u201d he said.<\/p>\n<p>Under the Privacy Act 2020, New Zealand organisations must take reasonable steps to protect personal information. As quantum threats become more widely documented, what qualifies as \u201creasonable\u201d may shift to include cryptographic readiness. The Cyber Security Action Plan also flags that the Ministry of Justice is advising on incentives to protect personal information, including a potential civil pecuniary penalty regime under the Privacy Act.<\/p>\n<p>Research firm CyberCube noted in January 2026 that insurers are beginning to explore indicators of cryptographic readiness, though discussions remain focused on education and scenario analysis rather than pricing changes, as reported by Help Net Security.<\/p>\n<p>For brokers, client conversations about cyber cover should now include questions about data retention policies, encryption standards, and whether systems can be upgraded to post-quantum cryptography before the 2030 window closes.<\/p>\n","protected":false},"excerpt":{"rendered":"Current policy wordings may not account for encrypted data stolen today and decrypted years from now A global&hellip;\n","protected":false},"author":2,"featured_media":625456,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[307262,29019,111,43,139,69,375],"class_list":["post-625455","post","type-post","status-publish","format-standard","has-post-thumbnail","category-new-zealand","tag-cybersecurity-risk","tag-data-protection","tag-new-zealand","tag-news","tag-newzealand","tag-nz","tag-quantum-computing"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/625455","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=625455"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/625455\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/625456"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=625455"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=625455"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=625455"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}