Division Zero launches continuous cyber testing platform

Division Zero has launched a continuous penetration testing platform aimed at reducing delays in corporate cyber security checks. The move comes as New Zealand government data shows a sharp rise in serious cyber incidents.

The Wellington-based cyber security company says its PTaaS+ service combines continuous background scanning with on-demand human penetration testing and faster reporting. It is positioning the service as an alternative to annual penetration tests, which it argues leave systems unchecked for long periods between audits.

The latest figures from the National Cyber Security Centre add urgency to that argument. According to Division Zero, the government's recent report found that New Zealand experienced as many highly significant cyber incidents in a single year as in the previous decade combined.

That reflects a broader shift in the threat environment. Automated bot networks using AI tools can scan internet-facing systems around the clock and identify weaknesses much faster, while many organisations still rely on periodic assessments tied to procurement cycles and fixed testing windows.

Chris Berry, Founder at Division Zero, said the faster pace of attacks is shrinking the time companies have to respond.

"AI isn't necessarily creating entirely new attack techniques, but it's certainly speeding up the process from discovery to exploitation," Berry said.

"It's essentially reducing the time a company has to react."

Division Zero argues this creates a long monitoring gap between formal reviews. If a business completes a security assessment and later changes software, cloud settings or user access arrangements, those changes may not be tested again until the next scheduled engagement.

Testing model

The platform is designed to shorten that cycle. Customers can add assets for monitoring, request a test and receive a human-led assessment on the next business day, according to Division Zero, rather than waiting weeks for a conventional engagement to be arranged.

Berry described speed and continuity as central to the model.

"A customer can add assets to our platform, order a test, and we'll start the next business day rather than weeks later," Berry said.

The service combines automated checks running in the background with human testing when required. That hybrid model reflects a view held across parts of the security industry that AI tools can improve scale and frequency, but still struggle with more nuanced assessments involving business processes and user roles.

Berry said current frontier AI models still do not match humans in contextual reasoning about permissions and intended access.

"Even on the frontier models, the reasoning is still not quite human-grade. Out of the box, they don't understand the context of what each user is supposed to be able to do. Human testing still fills that gap pretty neatly," Berry said.

Founded in 2018, the company focuses on offensive security testing and automated vulnerability assessment. From its Wellington base, it serves enterprise customers and is targeting a market where security teams face pressure to review more assets more often as cloud environments expand.

Broader pressure

The shift also highlights a broader issue for corporate technology teams in New Zealand and elsewhere. As AI tools lower the cost and effort needed to probe networks and applications, the economics of defence become more demanding. Annual or infrequent testing may no longer reflect the pace of infrastructure change or the persistence of automated reconnaissance.

Security providers have increasingly responded with subscription-style services that spread testing across the year rather than concentrating it into a single engagement. Division Zero's latest offering fits that trend, while maintaining that human input remains necessary when assessing business logic, user entitlements and other context-specific weaknesses that standard automated checks may miss.

The company says its aim is to help organisations identify vulnerabilities closer to the point when systems change, rather than after a long delay.