GCSB Annual Report 2025

The past year has again been characterised by global conflict and an increase in volatility around the world. Large-scale conflicts remain, and the unpredictable geopolitical environment continues to challenge the rules-based international system, from which New Zealand has traditionally derived security. We work in a complex environment together with like-minded partners, in the context of supporting New Zealand’s own sovereign interests, using unique capabilities under our governing legislation.

The GCSB is New Zealand’s lead organisation for signals intelligence and cyber security. Our mission is to provide our customers with intelligence advantage and cyber resilience to successfully navigate this unpredictable world. Our work with partner agencies to support the safety of New Zealanders remains in demand. This includes supporting the safety of New Zealanders overseas, such as New Zealand Defence Force personnel deployed in conflict regions.

During the year we provided signals intelligence to Ministers and government agencies to support their decision making on a range of issues under our government’s National Security Intelligence Priorities, ranging from transnational organised crime to foreign interference, to countering terrorism and violent extremism. We continue to make a highly valued contribution to global-counter-terrorism efforts, including assisting with the disruption of attack planning. We have played a critical role in helping our customers to make informed decisions. Our work also supports regional stability.

Events in the Pacific have a fundamental impact on New Zealand’s own national security, and the region is increasingly an area of strategic competition for influence. Transnational serious organised crime is also impacting the security of the region. The GCSB provides SIGINT in relation to New Zealand’s interests in the South Pacific. This focuses on providing support to other government agencies whose responsibilities include responding to security issues in the Pacific region.  

While we are a predominantly outward-looking agency, we seek to protect and strengthen New Zealand’s resilience to threats internally, too. Together with our partners, we continue to defend against a complex and persistent array of cyber threats on New Zealand’s digital infrastructure. From individuals falling victim to cyber-dependent criminal activity, to government agencies being targeted by advanced actors and techniques, we are continually refreshing our understanding of the cyber security threats being felt across New Zealand.

We have stepped up work to help build New Zealand’s cyber resilience in response. Following CERT NZ’s integration with the GCSB, our cyber security support has been extended to all New Zealanders, with a streamlined incident reporting function. We have also increased our engagement, publishing a range of advice and guidance to help New Zealanders stay cyber-smart. And we are working with New Zealand’s operators of critical infrastructure, as malicious cyber actors increasingly target systems supporting Western critical infrastructure.

We continue to meet with businesses, universities and associations to help build their defences, and continue to support countries in the Pacific to lift their own cyber resilience too. Through my role as Government Chief Information Security Officer, we continue to provide system stewardship for the public sector on information security issues, including emerging technologies such as artificial intelligence. Our international and domestic partnerships remain crucial to us as we work together to counter threats and increase our collective resilience.

Our services such as Malware Free Networks® (MFN®) play a key role in defending New Zealand from cyber threats, with the help of partner organisations. Between the introduction of MFN in 2021 and the end of this reporting year, MFN has now disrupted more than 473.4 million threats. In addition, we launched a Vulnerability Insights Programme this year, which detects and notifies customers in the public sector of their own cyber security vulnerabilities that could affect their systems. Since this launch, we have already expanded coverage to scan over 200,000 devices across 122 organisations.

This financial year also marked the opening of our new all-of-government data centre at Royal New Zealand Air Force (RNZAF) Base Auckland (Whenuapai). This data centre, named Mātai, was opened by the Minister Responsible for the GCSB, Hon Judith Collins KC. This facility was built to provide a safe, secure storage capability for New Zealand agencies to process and store the Government’s most sensitive information. The GCSB is operating this data centre as the New Zealand government’s lead agency for information security, and we are proud to be improving New Zealand’s digital resilience through this facility.

Resilience has also been an internal theme for our agency this year. We work closely with the New Zealand Security Intelligence Service (NZSIS), with whom we share joint enabling functions and staff. Together with the NZSIS, we undertook a change process as part of a joint financial sustainability programme, to ensure we are efficient, financially sustainable, and well-equipped to face the evolving threatscape. 

In the current unpredictable environment, it is imperative that the GCSB can continue to deliver on our mission. Our ability to meet this depends on our diverse and talented people, and their dedication to protect and serve New Zealanders. I am privileged to lead them, and thank them all.

Ngā mihi nui,

Andrew Clark
Te Tumu Whakarae mō Te Tira Tiaki 
Director-General of the GCSB

I am responsible as Director-General of the Government Communications Security Bureau (GCSB) for:

• The preparation of the GCSB’s statement of expenses and capital expenditure, and for the judgements made in them;
• Having in place a system of internal control designed to provide reasonable assurance as to the integrity and reliability of financial reporting;
• Ensuring that end of year performance information on each appropriation administered by the GCSB is provided in accordance with sections 19A to 19C of the Public Finance Act 1989, whether or not that information is included in this annual report; and
• The accuracy of any end of year performance information prepared by the GCSB, whether or not that information is included in the annual report.

In my opinion:

• This annual report fairly reflects the organisational health and capability of the GCSB.
• The Statement of Expenses and Capital Expenditure against Appropriation fairly reflects the total actual expenses and capital expenditure incurred for the year against the GCSB’s appropriation for the financial year ended 30 June 2025.

Andrew Clark
Te Tumu Whakarae mō Te Tira Tiaki
Director-General of the GCSB

30 September 2025

The Government Communications Security Bureau (GCSB) is New Zealand’s lead agency for signals intelligence (SIGINT), providing SIGINT to government customer agencies. We are also the lead operational agency for cyber security and cyber resilience, through the National Cyber Security Centre (NCSC).

Our mission

Our mission is to provide our customers with intelligence advantage and cyber resilience to successfully navigate an unpredictable world. The GCSB is a crucial part of how our country makes sense of the world and manages national security threats. 

Our functions

We use our intelligence collection capabilities, supplemented by intelligence received from partners, to support government agencies in their operations and decision making. Under the Intelligence and Security Act 2017 (ISA), the GCSB has four core functions:

• Intelligence collection and analysis
• Protective security advice and assistance, including Information assurance and cyber security activities
• Co-operation with other public authorities to facilitate their functions, and
• Co-operation with other entities to respond to imminent threat.

The NCSC works to strengthen New Zealand’s cyber security resilience. This includes ongoing work across Government and critical infrastructure organisations to ensure the data and online services that New Zealand relies on are protected against hazards and risks. We host the Government Chief Information Security Officer (GCISO) function and provide system stewardship of information security for the public sector. We are also responsible for providing cyber security advice and education to all New Zealanders, offering support to New Zealanders who have been the target of malicious cyber activity, and for helping to support cyber security resilience in the Pacific.

Our people

As at 30 June 2025, the GCSB has 589.3 full time equivalent employees. We have shared enablement functions with the New Zealand Security Intelligence Service (NZSIS). Many of our shared staff are employed by the GCSB but work across both the NZSIS and the GCSB. This supports ease of cooperation between our agencies in a cost-efficient manner.

Funding

We are funded through Vote Communications Security and Intelligence. The Minister Responsible for the GCSB is responsible for the single appropriation within this Vote. The GCSB’s Statement of Expenses and Capital Expenditure Against Appropriation is on page 35.