Southeast Asia has witnessed an unprecedented surge in cyber threats, ranging from sophisticated Advanced Persistent Threats (APTs) to widespread ransomware attacks. In the first half of 2024, for example, ransomware incidents across Asia Pacific reached 57,000, with Indonesia, the Philippines and Thailand being severely affected. In Indonesia, the attack on its national data centre is a clear example of the impacts of these threats, as ransomware jeopardises government services and impacts vital national assets. Earlier this year, Singapore also reported an APT attack on its critical infrastructure.
In addition, the rise of AI as a force multiplier for cybercriminals adds another layer of complexity. 47% of organisations cite top concerns surrounding GenAI as advanced adversarial capabilities, with AI enabling sophisticated social engineering tactics, lowering barriers to cybercrime entry and streamlining malware deployment processes.
As the World Economic Forum notes, this growing evolving threat landscape represents one of the systemic challenges for the region. For example, cyber risk increased by 74% in 2024 alone, with ransomware attacks (45%), cyber enabled fraud (20%) and supply chain disruption (17%) topping the list of concerns. These developments underscore the urgent need to strengthen cybersecurity frameworks to safeguard Southeast Asia’s digital future.
To examine comprehensive approaches to cybersecurity resilience, the Tech for Good Institute moderated a panel discussion on “Understanding the Multi-Stakeholder Model”, featuring speakers who shared both global and regional perspectives on collaboration in cyberspace governance.
Moderator and Panellists
- Ghislain de Salins, Global Lead, Cybersecurity, World Bank
- Masao Shino, Director, Office for Science Technology and Information, and Digital Transformation, Japan International Cooperation Agency
- Pua Hunter, Pacific Hub Director, Global Forum on Cyber Expertise
- Felipe Beato, Cyber Resilience, Centre for Cybersecurity, World Economic Forum
- Keith Detros, Programme Lead, Tech for Good Institute
Key Takeaways
1. Multi-stakeholder partnerships are essential foundations for regional capability development in cybersecurity.
Innovative multi-stakeholder partnerships are emerging as effective solutions. Key examples include the The ASEAN-Japan Cybersecurity Capacity Building Centre (AJCCBC), which demonstrates how regional cooperation can address talent gaps through practical programs like CYDER (Cyber Defense Exercise with Recurrence). The CYDER programme provides hands-on training for Security Operations Center analysts. In addition, another example is the Cyber SEA Games which exemplifies competitive capacity building, allowing participants to develop technical skills through practical cybersecurity challenges.
Public-private partnerships (PPPs) for cyber threat intelligence sharing and incident response can also be leveraged for talent development, as demonstrated by Togo’s National Cybersecurity Incident Response Team (CIRT). This is operated as a joint venture between the government and Polish IT company Asseco. Such models enable knowledge transfer, lower barriers to cybersecurity profession entry and provide sustainable training mechanisms.
Finally, partnerships with the technical community can also be an innovative solution towards resilience in cyberspace. For example, the World Bank has supported “bug bounty programmes” to tap on the expertise of ethical hackers.
2. Digital public infrastructure (DPI) and critical information infrastructure (CII) must be secured through security-by-design principles and adherence to international standards.
Protecting digital public infrastructure (DPI) and critical information infrastructure (CII) emerged as one of the key areas of priorities for countries. DPI must be made more resilient and safe through security-by-design, embedding security considerations into digital products from inception rather than retrofitting protection measures. The security-by-design approach can be achieved through: mandating adherence to international standards like NIST and ISO frameworks, bringing transparency to software supply chains through Software Bill of Materials (SBOM) requirements and implementing comprehensive risk assessment protocols. Countries in Southeast Asia are ramping up and updating existing guidelines in response to these challenges. The Philippines focuses on strengthening infrastructure resilience and mitigating vulnerabilities, while Singapore’s updated Cybersecurity Act 2024 implements stricter measures addressing supply chain vulnerabilities. However, SMEs remain particularly vulnerable, with 43% of targeted cyber attacks focusing on small and medium enterprises, despite 68.5% having adopted cybersecurity software.
3. Regional harmonisation of cybersecurity frameworks must balance standardisation with local context and fit-for-purpose solutions.
Southeast Asia’s cybersecurity landscape is characterised by regulatory fragmentation and gaps in capacity. While the ASEAN Cybersecurity Cooperation Strategy 2021-2025 establishes shared norms and encourages public-private partnerships, and the 2023 launch of ASEAN CERT strengthens cross-border collaboration, implementation varies significantly across member states. While multiple ASEAN frameworks including the Framework on Personal Data Protection (2016), Framework on Digital Data Governance (2018) and various cross-border data flow mechanisms have been instituted, interoperability challenges still persist. This requires alignment and harmonisation of cybersecurity approaches from a regional perspective. However, implementation should remain fit-for-purpose and locally relevant, with strong collaboration between academia, industry and government. An important mindset shift is to consider cybersecurity to be a “team sport” and a strategic investment rather than a cost. Treating cybersecurity as an investment, developing local talent and fostering multi-stakeholder collaboration remain non-negotiable priorities for building resilient digital ecosystems across Southeast Asia.
