NZ Business Podcast - Paul Spain
Sep 18, 2026 · 1 hr · 15 segments
Paul Spain speaks with Stephen Phillips, Chief Technology Officer and Chief Information Security Officer at Gorilla Technology, about the risks facing New Zealand organisations, from identity theft…
Stephen PhillipsGuest
Paul SpainHost
Probably some of the biggest learnings and all in the time at probably the Core Plus group in the CTO role was you've got to look at external risk and you've got to look at internal risk.
The internal risk is you need to be auditing how the use of your assets are happening on a regular basis because sometimes they are misused.
What types of external threat could take the business out? We had a situation, one of the early, what's called a worm, which is an attack from the internet against a particular technology.
But what it did was completely took the internet service provider business out.
So, you know, for the want of not having two ways to connect to the internet, all of our customers were out.
So, you know, resilience basically was required basically to make sure that we actually delivered on our promise basically to the customer.
Yeah, I guess in those earlier days, there would have been a lot of lessons to learn that no one had really probably thought of so much at that point.
And as time's gone on, we've got to a point where things like having internet connectivity, access to databases and technology systems is an imperative because you can't operate when those things stop.
Yeah, and it turned out, you know, that the common advice, you have to patch your systems, was absolutely vital.
And nobody can be exempt from that because it was the most senior leader in the business that, you know, let basically the threat in.
And then it, you know, pretty much took the business out for a couple of days and we were starting to lose customers hand over fist.
Now, during early COVID, you took on the role at Westpac Bank of Chief Information, security officer there, becoming accountable for, I guess, cyber risk over a large portion of the funds that were flowing around New Zealand.
What was sort of the big changes that you've seen in more recent years when it comes to cyber security and the takeaways from that role?
Probably some of the biggest learnings and all in the time at probably the Core Plus group in the CTO role was you've got to look at external risk and you've got to look at internal risk.
The internal risk is you need to be auditing how the use of your assets are happening on a regular basis because sometimes they are misused.
What types of external threat could take the business out? We had a situation, one of the early, what's called a worm, which is an attack from the internet against a particular technology.
But what it did was completely took the internet service provider business out.
So, you know, for the want of not having two ways to connect to the internet, all of our customers were out.
So, you know, resilience basically was required basically to make sure that we actually delivered on our promise basically to the customer.
Yeah, I guess in those earlier days, there would have been a lot of lessons to learn that no one had really probably thought of so much at that point.
And as time's gone on, we've got to a point where things like having internet connectivity, access to databases and technology systems is an imperative because you can't operate when those things stop.
Yeah, and it turned out, you know, that the common advice, you have to patch your systems, was absolutely vital.
And nobody can be exempt from that because it was the most senior leader in the business that, you know, let basically the threat in.
And then it, you know, pretty much took the business out for a couple of days and we were starting to lose customers hand over fist.
Now, during early COVID, you took on the role at Westpac Bank of Chief Information, security officer there, becoming accountable for, I guess, cyber risk over a large portion of the funds that were flowing around New Zealand.
What was sort of the big changes that you've seen in more recent years when it comes to cyber security and the takeaways from that role?
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.