They outnumber human identities, hold the highest privileges and operate silently within your organisation. Yet in most organisations machine identities – service accounts, API keys, certificates, microservices and bots – are not just unmanaged, but invisible to the organisation, something that is quickly being exploited by hackers.

“Fundamentally, machine identities are now an organisation’s most powerful user, and unfortunately, the least controlled,” Raymond Dickinson, SailPoint New Zealand country manager, tells iStart.

Meanwhile, attackers are increasingly targeting them because they provide silent, powerful access into enterprise systems, Dickinson says.

“If you can’t see it, you can’t secure it.”

“Without strong machine identity governance, organisations unknowingly leave their highest privilege access points unprotected,” he says.

Modern businesses rely heavily on automation, cloud services and DevOps pipelines, all of which generate machine identities at scale. Every new integration spins up more service accounts and keys, often with excessive privileges – and that includes in the OT environment, not just IT. And unlike human identities, in many organisations there is no on-boarding or off-boarding process, no lifecycle management and no visibility into who owns them, or even where they are.

“When there is a lack of ownership, no one really cares about the thing, and you end up not putting in the right governance processes. If you can’t see it, you can’t secure it. With machine identities, which often have excessive privileges, that’s a real concern.”

Dickinson points to the SolarWinds Orion breach in 2020 and a 2021 Microsoft Exchange Server breach as key examples – among many – of breaches using machine identities.

In the case of the SolarWinds breach, which triggered a supply chain incident affecting thousands of organisations including government, defence and enterprise, attackers

infiltrated the SolarWinds software build environment. They then used machine identities to sign malicious code with SolarWinds’ legitimate code signing certificates, abuse automated build service accounts and push compromised software to 18,000+ organisations.

Similarly, the Microsoft Exchange Server breach exploited unmanaged service accounts and OAuth tokens to maintain insider access.

The incidents underscore a harsh reality for organisations: Machine identities are low hanging fruit for attackers. Once a breach occurs, reports suggest hackers actively hunt for these accounts because they know they are rarely monitored.

A business problem

Dickinson stresses that unmanaged machine identities are not just a technology problem, they’re a business risk, creating significant operational, financial, compliance and cybersecurity exposure. “Getting boardroom support on machine identity is always a challenge, but the conversation is about securing them as a business risk decision, not a technology decision.”

For boards and executives, the conversation needs to start and finish with risk: Protecting revenue, ensuring business continuity, meeting regulatory obligations, reducing operational costs and enabling safe AI adoption.

As organisations adopt AI and automation, the stakes rise even higher. Without strong machine identity governance, organisations risk undermining the very technologies designed to drive efficiency and innovation. (And a side note here: An AI agent, which performs multiple tasks rather than a single defined task, is different from a machine identity as defined in the market today.)

Good governance 101

So, what does good machine identity governance look like?

According to Dickinson, it’s very similar to human identity governance and the first step is gaining visibility.

“You have to have full visibility into all machine accounts and know exactly where they all are.”

A discovery scan can identify every machine across an organisation – service accounts, API keys, certificates, bots and workloads. Expect a shock. Dickinson says most organisations underestimate their machine identity volumes by five to 10x.

Assigning ownership and purpose for each identity follows.

Automating the lifecycle – from creation through modifying, rotating and retiring identities – is also needed, along with enforcing least privilege – just as you’d do with a human worker.

“It’s very common for these machine accounts to be given the holy grail of all access even though they don’t need that level of access, simply because giving them domain level access is an easy thing to do.”

Securing credentials and ensuring robust certificate management is key to good machine identity governance, along with continuous monitoring and anomaly detection.

And, Dickinson warns, there needs to be good integration across cloud, DevOps and automation workflows.

“Don’t just think about your on-prem, you have to think about cloud. And you’ve got to look at where a lot of these are created – in the DevOps process – and make sure they are all picked up in the early stages and follow good governance.”

Rounding out Dickinson’s list of ‘key fundamentals’ is having strong auditable compliance and certification processes to enable tracking and logging of what is happening.

“Once you start putting all these key fundamentals in, it reduces risk, supports automation better and prepares government agencies and enterprises for the next step, which is really around the AI-driven operations side.”

He warns too, that it’s not a quick fix. Full governance can take one to three years, requiring collaboration between IT, identity teams and business stakeholders. The payoff, though, is resilience, safer automation and readiness for future technology.

Cyber resilience isn’t built on firewalls anymore. In today’s hybrid, cloud-first world, it starts with identity. But while global enterprises are advancing their identity maturity, many local organisations are still stuck in the slow lane and struggling to move beyond basic identity security initiatives.

Raymond Dickinson, SailPoint New Zealand country manager says identity security is no longer a technical control and just a layer of defence in a multi-layered stack. Today, it’s the organising principle of cyber resilience.

“Every user, system, device and process now relies on identity as their control point,” he says.

“You’ve really got to start looking at what is the unique area you do have control over, and that’s identity – because every person has an identity that needs to be managed. Every machine has an account or identity that needs to be managed. Every agent has one as well.”

“Identity security has shifted from being a technical control to the organising principle of cyber resilience.”

The shift is being driven by the decentralisation of IT. With users connecting directly to cloud services and software-as-a-service platforms – often outside the purview of IT – traditional perimeter-based security is no longer enough. Identity is the new perimeter.

By managing identity properly, organisations can enforce least privilege and reduce the risk of breach while also reducing damage should a breach occur.

“The lower the amount of access someone has means when there is a breach, you’re really reducing the amount of damage that is going to happen to an organisation.”

Many organisations, though, are still grappling with the basics.

SailPoint’s latest Horizons of Identity Security report shows 63 percent of organisations globally are still stuck in basic identity maturity. Dickinson says in New Zealand and, to a lesser extent Australia, may be even further behind.

“A lot of organisations here are still looking at the very early stages of identity and access management – they’re still really looking at multifactor identification (MFA) and single sign-on (SSO) – so we are in many cases a long way behind.”

He says many organisations still don’t realise the importance of identity governance and how it can uplift their cybersecurity maturity.

“They still seem to think that your average Microsoft Active Directory group is enough to achieve a lot of these outcomes. And it’s just not. It can’t give them the control, the governance and that real uplift that you get from a mature enterprise-wide identity security platform.”

Identity as a productivity engine

While identity security is critical for reducing risk, Dickinson says it also delivers serious business benefits, especially when it comes to productivity.

Automating joiner-mover-leaver processes mean new staff get access faster, internal moves are seamless and leavers are properly offboarded, cutting down on licence waste and security gaps.

“The leaver one is super important so you can ensure all their access has been revoked and you’re not having an account that is still active and may not be adhering to password policies and so on. It’s a key area where a lot of money and time is saved.”

Meanwhile, faster onboarding and provisioning means new hires and contractors can hit the ground running – improving customer experience and accelerating project delivery.

“Security often gets blamed for slowing things down,” Dickinson says. “But identity governance actually speeds things up. It’s a win-win.”

Automating user access reviews is also a key business benefit gained from identity security – bolstering accuracy while also reducing time.

“One organisation spent six months of the year going through doing access reviews, and then after six months, they start the next one. It’s a lot of time and effort that goes into sorting these things out.”

With identity governance, that becomes a continuous, automated process.

The benefits extend to cost savings too. With SaaS use exploding, many organisations are unknowingly paying for licenses tied to inactive accounts. Identity governance helps eliminate that waste revoking access as soon as someone leaves.

Despite the benefits, many organisations are still exposed. Over-provisioned access, unmanaged SaaS and shadow IT are common culprits, but one of the biggest risks is third-party access, Dickinson says, pointing to recent high-profile third-party breaches.

“Visibility over third parties is a critical gap. It’s an area where a lot of organisations still have someone manually managing the onboarding process and it’s just held in a spreadsheet.”

That opens the doors for people having too much access to systems, and accounts not being removed later on.

“It’s becoming a real issue for most people and it’s a real challenge for retail as well, because they have a lot of transient workers coming through and managing the onboarding and offboarding of those individuals is really hard.”

Machine identities and bots are another emerging threat as attackers increasingly target non-human accounts, increasing the critical need for visibility and governance.

Making the case to the C-suite

So how can businesses convince stakeholders outside of IT, such as the CFO, COO and risk managers, that identity security is worth the investment?

Dickinson says it’s not an easy sell unless you’ve got someone who has prior experience with identity governance.

“If they don’t there’s a lot of learning that needs to be done through that journey. It comes back to that lack of awareness and education within a lot of companies about the value of what identity governance can actually do for them.

“It’s the chicken and egg scenario – they haven’t seen it before so they don’t think it can achieve the objectives or outcomes.You’ve got to educate them before they’re actually ready to move forward.”

For many organisations, compliance is the lever that gets identity governance over the line.

“If they’re missing or failing compliance audits, that’s when ‘we have to get this done’.”

He recommends three key steps for building a compelling business case:

• Understand your cybersecurity objectives and frameworks

“Map those key framework controls back to how they link to an identity security platform… that will help you articulate back to the business why you need to invest.”

• Engage with other departments

“Go and talk to the CFO, go and talk to the head of risk. Understand their challenges. Look at how you can map them back to an identity security platform.”

• Quantify the value

“Sit down and understand what your current processes look like and what they are costing you today. If you were to put in a new identity security platform, what savings can be achieved?”

Even if the investment is net neutral, Dickinson says most business leaders will support a project that accelerates operations.

“Most business owners go ‘That’s great, so we’re going to do a security project that’s net neutral when most others cost a lot of money!’”

Cyber resilience isn’t built on firewalls anymore. In today’s hybrid, cloud-first world, it starts with identity. But while global enterprises are advancing their identity maturity, many local organisations are still stuck in the slow lane and struggling to move beyond basic identity security initiatives.

Raymond Dickinson, SailPoint New Zealand country manager says identity security is no longer a technical control and just a layer of defence in a multi-layered stack. Today, it’s the organising principle of cyber resilience.

“Every user, system, device and process now relies on identity as their control point,” he says.

“You’ve really got to start looking at what is the unique area you do have control over, and that’s identity – because every person has an identity that needs to be managed. Every machine has an account or identity that needs to be managed. Every agent has one as well.”

“Identity security has shifted from being a technical control to the organising principle of cyber resilience.”

The shift is being driven by the decentralisation of IT. With users connecting directly to cloud services and software-as-a-service platforms – often outside the purview of IT – traditional perimeter-based security is no longer enough. Identity is the new perimeter.

By managing identity properly, organisations can enforce least privilege and reduce the risk of breach while also reducing damage should a breach occur.

“The lower the amount of access someone has means when there is a breach, you’re really reducing the amount of damage that is going to happen to an organisation.”

Many organisations, though, are still grappling with the basics.

SailPoint’s latest Horizons of Identity Security report shows 63 percent of organisations globally are still stuck in basic identity maturity. Dickinson says in New Zealand and, to a lesser extent Australia, may be even further behind.

“A lot of organisations here are still looking at the very early stages of identity and access management – they’re still really looking at multifactor identification (MFA) and single sign-on (SSO) – so we are in many cases a long way behind.”

He says many organisations still don’t realise the importance of identity governance and how it can uplift their cybersecurity maturity.

“They still seem to think that your average Microsoft Active Directory group is enough to achieve a lot of these outcomes. And it’s just not. It can’t give them the control, the governance and that real uplift that you get from a mature enterprise-wide identity security platform.”

Identity as a productivity engine

While identity security is critical for reducing risk, Dickinson says it also delivers serious business benefits, especially when it comes to productivity.

Automating joiner-mover-leaver processes mean new staff get access faster, internal moves are seamless and leavers are properly offboarded, cutting down on licence waste and security gaps.

“The leaver one is super important so you can ensure all their access has been revoked and you’re not having an account that is still active and may not be adhering to password policies and so on. It’s a key area where a lot of money and time is saved.”

Meanwhile, faster onboarding and provisioning means new hires and contractors can hit the ground running – improving customer experience and accelerating project delivery.

“Security often gets blamed for slowing things down,” Dickinson says. “But identity governance actually speeds things up. It’s a win-win.”

Automating user access reviews is also a key business benefit gained from identity security – bolstering accuracy while also reducing time.

“One organisation spent six months of the year going through doing access reviews, and then after six months, they start the next one. It’s a lot of time and effort that goes into sorting these things out.”

With identity governance, that becomes a continuous, automated process.

The benefits extend to cost savings too. With SaaS use exploding, many organisations are unknowingly paying for licenses tied to inactive accounts. Identity governance helps eliminate that waste revoking access as soon as someone leaves.

Despite the benefits, many organisations are still exposed. Over-provisioned access, unmanaged SaaS and shadow IT are common culprits, but one of the biggest risks is third-party access, Dickinson says, pointing to recent high-profile third-party breaches.

“Visibility over third parties is a critical gap. It’s an area where a lot of organisations still have someone manually managing the onboarding process and it’s just held in a spreadsheet.”

That opens the doors for people having too much access to systems, and accounts not being removed later on.

“It’s becoming a real issue for most people and it’s a real challenge for retail as well, because they have a lot of transient workers coming through and managing the onboarding and offboarding of those individuals is really hard.”

Machine identities and bots are another emerging threat as attackers increasingly target non-human accounts, increasing the critical need for visibility and governance.

Making the case to the C-suite

So how can businesses convince stakeholders outside of IT, such as the CFO, COO and risk managers, that identity security is worth the investment?

Dickinson says it’s not an easy sell unless you’ve got someone who has prior experience with identity governance.

“If they don’t there’s a lot of learning that needs to be done through that journey. It comes back to that lack of awareness and education within a lot of companies about the value of what identity governance can actually do for them.

“It’s the chicken and egg scenario – they haven’t seen it before so they don’t think it can achieve the objectives or outcomes.You’ve got to educate them before they’re actually ready to move forward.”

For many organisations, compliance is the lever that gets identity governance over the line.

“If they’re missing or failing compliance audits, that’s when ‘we have to get this done’.”

He recommends three key steps for building a compelling business case:

• Understand your cybersecurity objectives and frameworks

“Map those key framework controls back to how they link to an identity security platform… that will help you articulate back to the business why you need to invest.”

• Engage with other departments

“Go and talk to the CFO, go and talk to the head of risk. Understand their challenges. Look at how you can map them back to an identity security platform.”

• Quantify the value

“Sit down and understand what your current processes look like and what they are costing you today. If you were to put in a new identity security platform, what savings can be achieved?”

Even if the investment is net neutral, Dickinson says most business leaders will support a project that accelerates operations.

“Most business owners go ‘That’s great, so we’re going to do a security project that’s net neutral when most others cost a lot of money!’”

Fixed wireless now accounts for 20 percent of New Zealand’s fixed broadband market, with fibre making up 74 percent of the country’s broadband connections – and data use continuing to skyrocket, surpassing the pandemic peaks.

The New Zealand Telecommunications Forum’s (TCF) Annual Report 2025 – which largely pulls together stats from other organisations – shows New Zealand is one of the highest adopters of fixed wireless broadband in the OECD, with use of the technology surging as copper connections decline.

The Commerce Commission’s (ComCom) latest Telecommunications Monitoring Report says two-thirds of those moving to 4G fixed wireless have moved from a fibre connection, with the largest proportion of those shifting from Fibre 300, followed by Fibre Max. Just seven percent shift from the entry-level Fibre 50 (now Fibre 100) plan.

Uptake of low earth orbit satellite services is now three percent of total market share, and 19 percent of rural connections, while five percent – some 92,000 – are still on copper. The entire Chorus copper network is due to be retired by 2030.

Eighty-seven percent of Kiwis have access to fibre.

The report shows telco costs rose 7.4 percent between January 2018 and January 2025. Electricity, by comparison, is up 17.8 percent.

The report figures however, were taken prior to price hikes by providers including Spark, Skinny, 2degrees and Slingshot last month and OneNZ’s hikes earlier in the year. The ComCom report says between them the three main telcos (Spark, OneNZ and 2degrees) hold 75 percent of the urban broadband market. (Energy providers Mercury and Contact now rank fourth and fifth, respectively, having doubled their market share from six percent to 13 percent over the past five years.)

The August hikes came just weeks after network operator Chorus upped internet speeds on its popular Home Fibre Starter, Home Fibre 50 and Home Fibre 300 plans at no extra charge.

The ComCom report noted that while most fibre customers subscribe to Fibre 300, the strongest recent growth has been at the budget and premium ends of the market – Fibre 50 (now Fibre 100) and Fibre Max, driven by cost-of-living pressures and evolving needs.

Monthly data use is also continuing to climb. The country is consuming nearly 10.5 million terabytes of data a year via fixed broadband and more than 400,000TB in mobile data usage.

The average monthly usage per connection has hit 648 gigabytes – up from 12GB in 2011, and well ahead of Australia’s average of 443GB per fixed broadband service in 2023.

“If this rapid growth continues, typical usage could reach one terabyte per month by 2028,” the TCF says. While the pandemic caused dramatic spikes in data consumption between 2019 and 2021, today’s usage has surpassed even those record peaks.

The Commerce Commission has flagged ongoing concerns with the challenges in changing plans between providers, saying broadband switching rates remain low and have worsened over the past year. Just 11 percent of broadband users changed plans in the past year, compared to 19 percent in electricity. For those who did switch, dissatisfaction with the process was high at 32 percent. Less than half of those switching from one of the three largest telcos stayed with a top three telco, with smaller providers, including the energy bundlers, gaining the lion’s share of switched connections.

“On the flipside, we can say that there are more than 100 retailer providers that these consumers can choose from, yet almost half of them decide on a largest three provider.”

Mobile growth

Mobile is also experiencing change. The 3G networks will shut down from the end of this year.

Customers are turning increasingly to on-account, or post-paid, plans, over prepaid, matching rising data needs and more advanced handset options, with the on-account plans often including more generous data allowances.

Eighty percent of customers are now on unlimited voice and SMS plans.

Text messaging is also on the downward slide, with traditional SMS dropping from 6.5 billion/month in 2018 to less than four billion/month in 2024 as messaging apps gained a foothold.

The report also notes the proliferation of scams: $1.6 billion was lost by Kiwis due to online threats in 2024 according the National Cyber Security Centre’s Cyber Security Insights report 2025.

The Department of Internal Affairs has partnered with Apple, 2degrees, One NZ, Spark and communications platform as a service provider Modica to provide a one-click reporting tool for users to report suspicious messages direct to DIA. The initiative works with iPhone 14 (mobile provider dependent), 15 and 16, updated to iOS 18.2 and enables users to select ‘report junk’ on suspicious messages and have the details shared directly with DIA.

Alexandra Smart has taken out top honours at this year’s CIO Awards, with AA Insurance, Fisher & Paykel Healthcare, Auckland Transport and Hamilton City Council also among the winners.

Smart’s CIO of the Year win came on the back of a ‘comprehensive transformation of Southern Cross Travel Insurance’s core systems’ with the judges praising her as an inspiring leader whose vision and strategic execution have delivered measurable growth and positioned the company for an ambitious new five-year strategy with technology as a true driver of business success.

Smart was one of two female health leaders to take out awards on the night

Hamish Archer, chief digital officer of WEL Networks; Sean O’Donoghue, CIO of BestStart Educare and Stephen Kurzeja, chief technology information officer for 2degrees, were finalists in the CIO of the Year category.

Smart was one of two female health leaders to take out awards on the night, with Stasha Rmandic, New Zealand Telehealth Services  head of analytics and insights beating out Fiona Millar from Christchurch International Airport, and Henry Chen from Yes Energy to take out the Emerging ICT Leader award. The award is presented to future leaders, under the age of 35.

Judges noted Rmandic’s ‘dynamic’ leadership of a high-performing team delivering strategic insights for critical decisions in a 24/7 virtual care environment, and recognised her as a values-driven leader passionate about health equity and using data to create meaningful change.

New Zealand Health Teleservices Whakarongorau Aotearoa was also a finalist for the Innovation Leadership through an Emerging Technology category, losing out to Hamilton City Council, which has used emerging technologies to create a high-resolution, predictive model for capturing and applying tree canopy data.

Elle Archer, whose current roles include as director of the electrotechnology and IT establishment advisory Industry Skills Board and a member of the executive council of AgriTech NZ, was the final individual honoured on the night receiving this year’s Outstanding Contribution to Technology and Business in New Zealand. Archer is also chair of Te Hapori Matihiko, and has worked extensively for Māori innovation.

The annual awards recognise exceptional leadership, transformative projects and impactful contributions across New Zealand’s tech sector with awards presented across seven key categories.

Finalists in the awards are selected based on a review of their written submissions and then face an independent judging panel of Kiwi ICT and business community.

AA Insurance’s win came in the Business Transformation through Digital and IT category, with the company modernising a complex, legacy business in a move judges said was not ‘merely an upgrade, but a truly transformative project’.

Auckland Transport’s HOP Open Loop project, which allows commuters to pay for public transport using contactless bank cards and digital wallets, won the organisation the Excellence in Customer Value award, ahead of Fisher & Paykel Healthcare and Lightwire.

But while F&P Healthcare missed out on that award, they quickly scooped up the Best ICT Team Culture and Inclusion award.

The final award, for Community Tech Champions, went to Digital Future Aotearoa for its work on initiatives such as Recycle a Device and Code Club Aotearoa, and efforts to provide digital skills for the next generation and pathways into tech for underrepresented communities.

The full list of winners is:

NZ CIO of the Year

Winner:

Alexandra Smart, Chief Technology Officer, Southern Cross Travel Insurance

Finalists:

Hamish Archer – chief digital officer, WEL Networks

Sean O’Donoghue – chief information officer, BestStart Educare

Stephen Kurzeja – chief technology information officer, 2degrees

Emerging ICT Leader of the Year

Winner:

Stasha Rmandic, Whakarongorau Aotearoa New Zealand Telehealth Services

Finalists:

Fiona Millar, digital transformation manager, Christchurch International Airport

Henry Chen, principal analyst and data scientist, Yes Energy

Business Transformation through Digital and IT

Winner:

AA Insurance

Finalists:

2degrees

Foodstuffs South Island

Excellence in Customer Value

Winner:

Auckland Transport

Finalists:

Fisher & Paykel Healthcare

Lightwire

Innovation Leadership through an Emerging Technology

Winner:

Hamilton City Council

Finalist:

Whakarongorau Aotearoa New Zealand Telehealth Services

Best ICT Team Culture and Inclusion

Winner:

Fisher & Paykel Healthcare

Finalists:

Fletcher Building

2degrees

Community Tech Champions

Winner:

Digital Future Aotearoa

Finalists:

Talent Rise

Women in Data Science New Zealand

Outstanding Contribution to Technology and Business In New Zealand

Elle Archer

There’s an often-overlooked part of cybersecurity that Raymond Dickinson says can be transformational for local businesses securing access to digital resources, improving user experience and supporting compliance. The wunderkind?… Identity security.

“Identity security is an enabler for digital transformation. It is a foundation for cloud adoption, hybrid work and zero trust and enables you to transform your business so much faster,” says Dickinson, SailPoint New Zealand country leader.

“Without it, every project hits friction, risk or delay because teams just can’t move fast enough because at the end of the day, when people need to get access to the cloud there is an identity that needs access into that cloud.”

The discipline focuses on managing and protecting digital identities, ensuring the right people have the right access to the right resources at the right time and for the right reasons. It extends beyond just managing usernames and passwords, providing context aware, policy-driven controls enforcing a least-privilege access model for each digital identity.

While most local companies are currently managing cloud adoption manually, Dickinson says managing identity via a single tool enables cloud adoption to be dramatically sped up.

“Identity security is an enabler for digital transformation. It’s a foundation for cloud adoption, hybrid work and zero trust”

One area of identity security Dickinson believes has particularly big benefits for business and users alike is lifecycle management, or ‘joiner, mover leaver’, streamlining user on- and offboarding, improving productivity and creating a more secure, efficient and agile environment for businesses.

“It automates the processes of new hires to get the right access from day one, enabling them to be productive and feel like they are delivering value from day one, which has a huge user experience impact.”

That extends throughout their time with the organisation – if they change roles or are temporarily assigned to help another team, they can gain the access they need quickly and easily.

Access can be instantly deprovisioned when they leave the organisation.

Also included is the facility to enable users to self-service and for requests to be routed to the appropriate person for approval and for policies to be enforced; risk-based access controls to ensure dynamically based access is provisioned; and integration with MFA (multi-factor authentication) and single sign on to deliver strong authentication at the first log-on and simplify access across all apps.

Alongside the business transformation benefits are the cybersecurity benefits, protecting digital identities from unauthorised access, misuse and cyberattacks, and ensuring only authorised individuals and systems can access data and applications, helping prevent cyber risks including data breaches, account takeovers, and financial fraud.

Dickinson likens it to having a smart, evolving security guard at every digital door in your organisation, constantly checking who users are, what they should have access to, whether they are still authorised to be there and whether their behaviour is normal.

But while identity security has been a cornerstone of modern cybersecurity for several years, Dickinson says it remains one of the most overlooked areas for New Zealand organisations, with Kiwi organisations ‘significantly’ trailing Australian counterparts in identity security.

Part of that is down to the idea we’re not likely to be a target at the bottom of the world, and the ‘she’ll be right’ attitude, which he says has created complacency around cyberthreats, especially those originating from internal mismanagement, like identity misuse.

Adding to that complacency is the lack of regulation in New Zealand, compared to Australia, where regulatory risk drives greater cyber focus.

But Dickinson says even without the regulatory risk, there are plenty of good reasons for Kiwi businesses to be embracing identity security, including the business risks of doing nothing, with potential for data breaches from misused or excessive access.

“Without identity governance users – especially contractors and leavers – can often have too much access for far too long. Stolen credentials for insider misuse can go undetected and cause significant harm and that’s a risk we’ve seen here before.”

In the event of a breach, figuring out how someone got in, where they went, what they did also takes much longer without an identity security platform in place, Dickinson says.

SailPoint research suggests that every dollar invested in identity security delivers disproportionately higher returns. Unlike traditional cybersecurity spend which typically delivers linear returns, identity security spend can ‘bend the curve’, delivering more value than investments in other cyber capabilities, according to SailPoint’s Horizons of Identity Security 2024-2025 report.

Those disproportionately higher returns are observed through business value and productivity, alongside the higher risk reduction, with the report showing more advanced companies were seeing accelerated time to market and reduced friction, while productivity gains for mature identity security users were 22 percent higher than less mature organisations.

For organisations keen to get started in identity security – or to level up their existing identity security work – Dickinson says a key starting point is an identity maturity assessment to understand their current state, what is working, what is manual and where there are risks.

“Identity security is critical to any security strategy today, but it extends well beyond just cybersecurity benefits,” Dickinson says. “If it’s not already in your strategy, you need to be thinking about how you are going to do it and do it well.”

Modern asset management across industries like mining, utilities, public infrastructure, road and rail represents a massive exercise in managing and analysing data.

Data performs a critical function within these industries, albeit one that has seen less digital transformation than other segments in recent years. Because of this, there is pressure on leaders to lunge for an AI project as a means to quickly manifest efficiencies in their operations.

“Data foundations must also be trusted, and solutions that act on that data must be trusted to do so correctly.”

However, whether organisations are curious, excited, motivated, or feeling like they’re under boardroom duress to deploy an AI solution into their asset management workflows, strategic considerations about how best to integrate these tools must come first.

Digital transformation is not a small undertaking, nor should it be about technology in and of itself, especially for companies managing critical infrastructure and assets potentially worth billions.

Hype Cycles, distractions and trust If you ask Scott McGowan, CEO of Australian asset management solutions firm COSOL, what he thinks of AI, he’ll tell you it represents a lot of potential in the asset management sector. However, he’ll also tell you not to run out and invest in an AI solution just because your board thinks you should.

“Data foundations must also be trusted, and solutions that act on that data must be trusted to do so correctly.”

Observing the proliferation of AI adoption hype across industry events, social media and the press, McGowan is concerned that market pressures might push organisations in asset-centric industries to try and run with AI before they can walk.

“Everyone expects everyone to build an AI division in-house, but if you’re a mining or infrastructure company, the reality is that’s not your core business,” he says. “Your core business is to produce iron, or coal, or copper, or to run trains and provide services to the public.”

Without reason or a roadmap, the discourse around AI integration often represents an unwelcome distraction from the primary mission of asset-centric industries.

Adoption pressures are being met with a degree of hesitation from business leaders, McGowan adds, due to the somewhat untested nature of AI in an asset management context and an absence of established trust.

“Hesitation toward AI probably comes from multiple aspects, but they all come back to one underlying principle, which is around trust,” he says. “Trust in security, trust in algorithms, and trust in data.”

“Trust is built on experience and understanding, and I think the challenge we have with AI as it stands today, is that the algorithms are designed in such a way that there’s little to no transparency as to the decision-making methodology those algorithms have.

“Data foundations must also be trusted, and solutions that act on that data must be trusted to do so correctly. Organisations need to trust that any solution they adopt is repeatable, robust and resilient.”

Exploring a path forward for AI in asset-centric industries will be the subject of a series of roundtables that COSOL, in partnership with IBM, will be running across three Australian cities in June. While the sessions are closed, select insights are set to be released highlighting discussions, pain points and strategies business leaders face.

Ahead of the events, COSOL’s McGowan touched on some of the issues set to be covered during the campaign.

First Steps: Learning to Walk with AI

AI transformation is a journey, not a big bang project. Organisations that approach their AI maturity through a lens of a walk-jog-run approach based on the true needs of the business are much more likely to find value in implementation versus those that seek shiny solutions.

In the first instance, the walk phase, McGowan urges that AI has to be solving an existing problem.

“There are a lot of AI initiatives and a lot of technologies looking for a problem; I think that’s the wrong way to go about it,” he says.

“The walk concept is solving a discrete problem that already lies within the technology space. If you think about self-solving and trust in data, using AI to resolve, infer, continually assess or optimise data quality is an interesting place to start.

“Through this approach AI starts to solve its own trust problem. The opportunity around master data quality and the ability to link physical equipment with digital representations for accuracy is in my view the first part of the AI journey.”

David Small, Principal Sales Leader for IBM Automation Software in Australia and New Zealand, echoes the need for organisational data layers to be updated and as accurate as possible to enable smarter asset management.

“Without quality data, organisations will struggle to achieve key benefits as they move along the asset maturity curve,” he says. “Data is the building block that asset management systems need.

“The direction that IBM has taken is to embed AI capability within the Maximo Application Suite vs saying to organisations go and build your own AI capability.

These AI enhancements are integrated AI experiences that deliver immediate value, increase productivity and seamlessly scale.”

Adding capability and building an AI-integrated business

Looking further into an AI modernisation program, companies might look to select an AI partner to help them further investigate ways and means AI can be implemented, be it in a proof of concept, or solving discrete problems.

Partnering with someone who specialises in AI can help companies build capability within the business from a cross-functional perspective.

“This phase is around automation of things like low-value tasks, work order administration, and master data creation as examples,” McGowan says.

“AI tools can bring forward understanding how to take a piece of equipment and represent it digitally and accurately.”

These types of initiatives should not be about solving technology problems but enhancing the operational capability of the business.

Of course, McGowan notes that strategy will need to be changed to enable technology to solve business problems. This may mean redefining the operating model and job descriptions around the purpose of AI.

“I can almost see a place where you define a job description for the AI agent or component, and it performs that task, has regular performance reviews, learns from its mistakes, and is managed like anyone else in a business,” he says.

Playing the long game

The warning to ‘innovate or be left behind’ is regularly bandied around with new technologies.

While McGowan notes the AI opportunity in asset management represents considerable potential, he feels strongly that it must be driven by practical business needs, organisational fit and readiness, rather than hype.

“The potential for AI particularly in the asset management space is almost endless, because largely the sector has not gone through as many digital revolutions that other industries and sectors have gone through,” he says.

“There are opportunities to do things like provide real-time feedback around avoiding potential incidents, or automating non-value-adding tasks.

“But it’s important that when we talk about driving efficiency with AI that we evolve our thinking in terms of what it means for careers and jobs and tasks and working to make those AI-infused rather than AI-replaced.

“We need to look at evolving the operating model to support the introduction of efficiency gains from AI and then driving your valued labour to much higher value tasks.”

This messaging will be central in COSOL’s upcoming roundtable series in Australia over the coming weeks.

With asset management leaders coming together to discuss the pivotal role of AI in shaping the future, valuable insights are guaranteed to emerge.

Many of these insights will be shared in an upcoming report. To register to receive these learnings, click this link.

IT consulting company Unisphere Solutions NZ has partnered up with knowledge work automation provider M-Files to help bridge the gap between documents and data.

The deal will see integrate M-Files intelligent automation with local support in an effort to help local business unlock insights from their data.

“For so long, businesses have been document-centric and, as they digitise, they need to bridge the gap in systems and processes from documents to data.”

The M-Files platform links repositories and systems to provide a holistic 360-degree view of data across an organisation, making information manageable and accessible from a single platform and automating processes.

James Dickinson, Unisphere NZ managing director, says businesses, so long document-centric, need to bridge the gap in systems and processes from documents to data, as they digitise.

“M-Files is the ideal solution for Unisphere NZ to support how businesses work now and into the increasingly digitised future,” Dickinson says.

The system automates processes, from document creation and management to workflow automation and external collaboration.

Dickinson says the deal will help Unisphere’s local clients streamline operations, enhance security and ‘achieve truly intelligent information management’.

M-Files has claimed its customers see a 70 percent increase in workflow efficiency and 50 percent better document searches – aided by AI and metadata.

Unisphere NZ will get direct access to M-Files’ advanced technology resources, specialised training and ongoing support as part of the M-Files partner program, enabling it to expand its solution portfolio and offer enhanced business outcomes.

“M-Files’ robust metadata-driven platform lets Unisphere NZ scale its offerings rapidly, drive greater value in client engagements and further solidify its market position,” the company says.

Chris Smith, M-Files APAC senior manager partner sales, says Unisphere’s expertise in optimising business processes ‘aligns perfectly’ with M-Files’ vision to transform knowledge work through intelligent automation.

“This new collaboration marks a turning point in how businesses leverage technology to drive growth, streamline operations and transform how organisations work in a digital age,” Smith says.

The first couple of years of the 2020s saw a flurry of data centre announcements for Auckland with big names including Microsoft and Amazon making a big play with their plans for local facilities. Roll on to 2024 and what’s the state of play?

Amazon Web Services announced plans in 2021 for its $7.5 billion AWS Asia Pacific (Auckland) region. AWS ‘chief evangelist’ Jeff Barr said at the time that the facility would open in 2024.

“Work on the development appears to have stalled.”

The region would, AWS informed us, include three interlinked data centres, and the investment would create around 1,000 jobs (though it failed to specify how many of those would be temporary roles for construction of the centre) and add $10.8 billion to the local economy over 15 years.

Early last year AWS brought the right to draw down 51 megawatts of electricity from Mercury Energy for the data centres in a deal AWS said would be more than required at launch.

But with launch due this year, work on the development appears to have stalled after issues around stormwater design, and a fire at the West Auckland site in January.

Reports say while land was cleared for the data centre, and two small artificial wetlands were drained, the property remains empty.

A resource consent application was paused in September 2023 over issues with stormwater design. Amazon is apparently still working with Auckland Council and adjacent landowners.

Auckland Council told RNZ it was not uncommon for resource consent applications to be placed on hold during the consenting process and ‘there is nothing out of the ordinary about this one’.

AWS told iStart this week that it remains committed to launching an AWS region in New Zealand, but said it was not able to share details about the construction or location of the region ‘as this is part of our secure design approach’.

The question of whether there was a new completion date went unanswered by AWS.

Microsoft was the first major hyperscale cloud player to announce plans to build a data centre in New Zealand. It gained consent from the Overseas Investment Office in 2020 to purchase 6.5ha of land for the Auckland build and amid much fanfare (just as accompanied AWS’ announcement), Fonterra and Spark were announced as anchor tenants for the new region.

It says once operational the new facility will create around 50 new FTE jobs, with 300 temporary FTE roles created during the construction of the data centre.

In August 2022 it announced the three New Zealand data centres would be powered by 100 percent carbon free energy from day one, but apart from occasional blasts from Microsoft about new customers signing up for the data centres, little has been revealed about the construction progress. Microsoft did not respond to a request for an update on the work.

But if the big names are faltering, or at least playing coy, others are at least advancing their plans – and in some cases even opening facilities.

ASX-listed data centre company NextDC bought land in Auckland in late 2022 and registered a local subsidiary in preparation for its build of its AK1 Auckland facility – its first data centre on this side of the Tasman.

Announced by the company in May 2023, the facility, which would be located in the Auckland CBD would have total power of 10MW+. NextDC has said work is expected to commence in FY2024 with the site expected to reach ‘practical completion’ of its phase one build in the first half of FY2026.

While it’s listed as ‘in planning’ on NextDC’s website, company financials last year show the facility as being ‘in development’. The latest half year financials however, say the facility is ‘in planning’.

Also announcing big data centre plans for Auckland was DCI Data Centers. The Brookfield Asset Management portfolio company already had one data centre build underway in January 2022 when it announced it was adding a second to the lineup.

It held a ground breaking ceremony in August of that year for AKL02, which it said would be ‘one of New Zealand’s largest data centres’.

Combined the two DCI centres would bring $600 million to the Auckland region, with a combined economic value exceeding $1.4 billion over the life of the projects, DCI claimed.

The first of those centres, in Westgate in north-west Auckland, was completed on time and on budget in early 2023. It was first announced in 2021, and was fully leased prior to opening.

Not to be outdone, Kiwi telco Spark also recently announced plans to build a hyperscale data centre campus on Auckland’s North Shore, having reached conditional agreement to purchase land. The telco completed a 10MW expansion of its Takanini data centre last August.

Canberra Data Centres is also planning a 7,000m2 facility in Hobsonville and a second, 11,000m2 facility in Silverdale, where construction is already underway.

It’s not just Auckland in the data centre running. Datagrid New Zealand is planning a ‘carbon neutral hyperspace data centre’ in Southland, having acquired 43ha in Makarewa.

The $700 million project is headed up by Remi Galasso, who founded Hawaiki Cable, among other things and CallPlus founder Malcom Dick .

Intelia, another company founded by Galasso, announced a submarine cable project linking Invercargill with Sydney and Melbourne a month ago.

Datagrid’s offering is one of two data centres planned for Southland, with New Zealand co-location data centre company T4 also announcing plans for a $50 million data centre. The facility will be T4’s – and New Zealand’s – first tier 4 data centre.

That data centre is due to commence construction this year, though specifics on its location haven’t been revealed.

Last week T4 announced it had bought global IT infrastructure services provider and IBM spin-off Kyndryl ’s East Tamaki facility for an undisclosed sum. T4 has been using the East Tamaki data centre, which is an all-of-government approved tier 3+ site, since 2022. The company also has data centres in Whangarei and Auckland.

A UK-based startup, Lake Parime, which announced plans in 2021 for a data centre near Clyde went into liquidation last year.

SnapLogic, the leader in generative integration, has released its “State of Data and Analytics Australia and New Zealand 2023” report in partnership with Corinium, exploring the current challenges, opportunities and emerging trends as AI continues to transform the business landscape.

Key Insights:

• High Demand for Expertise: 86% of respondents reported a notable increase in the demand for data and analytics expertise, indicating a sustained need for skilled professionals in the field.
  
  
• AI Reshaping the Landscape: AI emerges as a transformative force, with 89% of data leaders expecting a reduction in full-time hours within their organisations due to AI adoption. An overwhelming 90% believe that AI will drive the single greatest change in their data strategy over the next three to five years.
  
  
• Collaboration with Cybersecurity: 98% of participants underscored the importance of closer collaboration between data leaders and cybersecurity teams, emphasising the need to safeguard data in an increasingly digital landscape.
  
  
• CEO Alignment: Only 6% of respondents report to their organisation’s CEO, highlighting the limited direct connection between data and analytics leaders and top-level executives.
  
  
• Cloud Data Warehouses on the Rise: The report reveals that 92% of respondents are utilising cloud data warehouses across multiple business functions, reflecting a growing reliance on cloud infrastructure for data management.
  
  

Digital transformation full speed ahead

Brad Drysdale, principal solutions engineer at SnapLogic, says the report sheds a positive light on A/NZ businesses and their digital transformation journeys. “The survey results not only demonstrate that organisations across the region are investing in data-driven initiatives to power the customer experience, but they’re also setting themselves up to support that with 92 per cent using cloud data warehouses, which is great to see.

“There is a concern here that the people who are entrusted with using data to drive the business forward […] don’t have the ear of the CEO directly.”

“They’re also starting to look down the barrel to the fact that AI, particularly generative AI, is playing a more important role in their organisations, purely as a way to deal with the volume of data that’s coming in.”

Security and privacy top of mind

Drysdale shares that security and privacy are especially top of mind for organisations given recent data breaches, with nearly all (98%) agreeing there’s a need for greater collaboration between data leaders and cybersecurity teams.

“Underlying that number is the fact that people are scared to inherently trust the data when it makes decisions for the business. They are concerned about the risk associated with using a higher volume of data that’s closer to the customer, meaning customers’ personal data and what that means from a privacy perspective,” he says.

“If you look at the key findings, 6 per cent of respondents report to their organisation’s CEO, and 98 per cent agree there’s a security, trust and privacy elephant in the room. It seems logical to assume that issues such as brand erosion, risk and the financial implications of security and privacy concerns should squarely fall within the CEO’s purview.

“There is a concern here that the people who are entrusted with using data to drive the business forward and with the privacy, security and trust associated with it don’t have the ear of the CEO directly. The 6 per cent finding, although not unexpected, serves as a warning. CEOs must be more invested in the ownership of data-related matters. I think when that 6 per cent goes up, that 98 per cent security concern will drop.”

Generative integration

SnapLogic CTO Jeremiah Stone said, “Strong data infrastructure and integration solutions are critical capabilities if organisations wish to gain competitive advantage through being data-driven and through automation and analytics.

“Organisations that are able to create a sustainable effort with data drive more impact and results.”

The report coincides with the release of SnapLogic’s GenAI Builder, the world’s first no-code generative AI application development product for enterprise applications and services. Uniquely compatible with both legacy mainframe data, modern databases and APIs, GenAI Builder leverages conversational AI to transform and simplify customer, employee and partner digital experiences

About the survey

This representative survey of 159 data-focused leaders was conducted in June and July of 2023. Of these, 75% were from Australia and 25% were from New Zealand. Respondents were selected from local and global enterprises with at least 500 employees and those responsible for their organisations’ data strategy functions.The report features contributing insights from:

• Pieter Vorster, General Manager, Data Platforms, Westpac
• Nonna Milmeister, Chief Data and Analytics Officer, RMIT
• Brian Ferris, Chief Data, Analytics and Technology Officer, Loyalty New Zealand
• Julian Delany, Chief Technology Officer, Data and Digital, News Corp Australia
• Nasca Peng, Head of Artificial Intelligence, Fonterra

The State of Data and Analytics Australian and New Zealand 2023 report, now in its third consecutive year, provides in-depth insights and analysis into the evolving data landscape. To access the complete findings and recommendations, watch the webinar or download the full report here.