Cybersecurity
in APAC:
5 Contentious Truths for CIOs and CISOs in 2026
Written by:
Principal Consultant
Sapience Consulting
The cybersecurity landscape in the Asia-Pacific (APAC) region is evolving rapidly, and it is becoming increasingly complex for Chief Information Officers (CIOs) and Chief Information Security Officers (CISOs) to navigate. Cybersecurity in APAC is fraught with challenges that are not just technical but are also shaped by socio-political, economic, and regulatory factors. Several contentious issues are at the forefront of this conversation, which make it even more difficult for APAC organisations to protect their digital assets effectively.
In this blog post, we will explore five key cybersecurity issues that have become central to the concerns of CIOs and CISOs across APAC: Cyber Sovereignty, Ransomware Payments, Board Accountability in Cybersecurity, MFA Fatigue & AI Phishing, and Cyber Insurance. These issues are particularly contentious and do not have easy, one-size-fits-all solutions, especially given the diversity of political, economic, and technological contexts within the region.
1. Is “Cyber Sovereignty” Making Asia-Pacific Less Secure, Not More?
Cyber Sovereignty refers to the concept that a nation should have the right to control its digital infrastructure, data, and cyberspace independently. While this concept may seem like an important step for national security, it often comes at the cost of greater cooperation in cybersecurity across borders.
In APAC, nations like India, Indonesia, and China have introduced strong data localisation laws, requiring organisations to store data within their borders and sometimes restrict cross-border data flows. This has created significant friction, as global businesses in sectors like finance, healthcare, and logistics face heightened compliance costs, reduced operational efficiency, and slower responses to cyber threats.
The contention lies in the trade-off between data sovereignty and global threat intelligence sharing. While data localisation is intended to safeguard citizens’ privacy and bolster national security, it often isolates organisations from critical threat intelligence, hindering their ability to detect and respond to cyberattacks. This fragmentation creates cyber silos, and attackers can exploit these gaps for global operations.
CIOs and CISOs in APAC are now faced with the challenge of balancing compliance with localisation laws while still striving to share and access global threat intelligence. The result is often a more vulnerable cybersecurity ecosystem, making the region less secure, not more.
2. Ransomware Payments in APAC: Should Governments Make Them Illegal?
Ransomware attacks have surged across APAC, with industries like healthcare and logistics being particularly hard-hit. As the sophistication of attacks increases, businesses are faced with the dilemma of whether or not to pay the ransom. In some instances, paying the ransom ensures business continuity, especially in high-stakes sectors like healthcare, where downtime could lead to loss of life.
However, the contention arises when governments consider making ransom payments illegal to prevent fueling the criminal economy. The challenge lies in finding a balance between the survival of businesses and discouraging organised cybercrime. APAC nations like Australia and Southeast Asia are grappling with this very dilemma as they work to combat the growing number of ransomware attacks targeting critical infrastructure.
Governments are considering legislation that would criminalise ransom payments, hoping to cut off the financial pipeline for cybercriminals. However, businesses—especially those without adequate backup or recovery mechanisms—might find themselves in a tight spot. For CIOs and CISOs, the decision is not easy: risk paying the ransom to keep operations running, or refuse to comply and risk prolonged downtime?
3. Why APAC Boards Still Treat Cybersecurity as an IT Problem (and the Cost of That Mindset)
In many APAC countries, boards of directors still treat cybersecurity as an IT problem, delegating it to the CIO or CISO. This mindset is particularly prevalent in family-owned conglomerates and state-linked enterprises, where cybersecurity often takes a backseat to other strategic concerns. This approach is increasingly dangerous, as cyber threats become more sophisticated and attacks more damaging.
Boards that do not recognise cybersecurity as a core business issue miss the opportunity to address cyber risks at the strategic level. The result is insufficient funding, lack of accountability, and delayed decision-making when it comes to critical security measures. The cost of this mindset is high: data breaches, loss of customer trust, and significant financial losses.
For CIOs and CISOs, convincing boards to take cybersecurity seriously is a constant battle. They need to educate board members about the potential long-term damage of cyber incidents and the importance of embedding cybersecurity in every aspect of the business strategy.
4. MFA Fatigue, AI Phishing, and the Death of ‘User Awareness Training’
While Multi-Factor Authentication (MFA) is a crucial security measure, it is not foolproof. In APAC, where a large portion of the workforce is mobile-first, the effectiveness of MFA is increasingly under threat. MFA fatigue—where users become frustrated with frequent prompts to authenticate—has led to lax security practices. Combined with the rise of AI-driven phishing attacks, the human element in cybersecurity is under extreme pressure.
AI phishing is particularly concerning because it enables attackers to craft highly realistic and personalised phishing messages at scale, often exploiting social media and messaging platforms like WhatsApp. For many organisations in APAC, where WhatsApp is a dominant communication tool, this presents a significant challenge for cybersecurity teams.
Traditional user awareness training has become less effective in the face of these sophisticated attacks. Humans are still considered the weakest link in cybersecurity, but tools are struggling to keep pace with AI-driven threats. CIOs and CISOs must now rethink their approach to user education and invest in more sophisticated defenses, such as AI-powered anti-phishing systems and behavioral analytics.
5. Cyber Insurance in Asia: Risk Transfer or False Sense of Security?
As cyber threats evolve, cyber insurance has become a critical tool for businesses in APAC to transfer the financial risk of cyber incidents. However, as insurers tighten exclusions and premiums rise, many organisations are beginning to question whether cyber insurance is offering true protection or merely a false sense of security.
The cyber insurance market in APAC is still immature in many countries outside of Australia and Singapore, leaving organisations with limited options for coverage. In some cases, businesses are opting for insurance policies that provide inadequate coverage for evolving cyber risks, leading to gaps in their security posture.
For CIOs and CISOs, cyber insurance remains a complex issue. While it offers financial protection, it should not be viewed as a replacement for a robust cybersecurity strategy. Organisations must balance insurance with proactive security measures, including threat hunting, incident response planning, and continuous monitoring.
Conclusion: The Growing Complexity of Cybersecurity in APAC
Cybersecurity in APAC has become a battleground of regulatory, technological, and operational challenges. From cyber sovereignty to ransomware payments, MFA fatigue, and cyber insurance, CIOs and CISOs in the region must navigate a landscape filled with complex and often contradictory demands.
As cyber threats continue to evolve, it is clear that the solutions to these issues are not straightforward. The next wave of cybersecurity challenges in APAC will require collaboration, innovation, and strategic foresight to ensure that businesses remain secure without compromising their ability to operate in an increasingly interconnected world.
As a trusted leader in professional development, Sapience empowers you to invest in your future.
Don’t wait – Explore our available funding and leverage our expertise to upskill without financial strain.
