Are you cyber ready?
Asia Pacific businesses vulnerable to escalating cyber-threats

The respondents shared a sense of increased cyber threat, with most believing cyber risk has increased compared to 12 months ago. However, our data shows that many are still not undertaking crucial preparatory work – perhaps one of the most jarring findings from our survey was that 69% of respondents said it would take an actual cyber attack to motivate their organisation to meaningfully improve their data risk management.

The traditional view of cyber risk and resilience is becoming harder to sustain. As companies continue to transform their digital capabilities, handle ever-greater data volumes, and transact with a complex array of third parties, their supply chains are subject to growing cyber vulnerability. Their attack surface has increased (and become less visible) and many are faced with the real prospect of regulatory intervention, consumer action and long-term reputational damage.

Adding further complexity is the patchwork of regulations and laws governing data privacy and cyber security across Asia Pacific.

While some jurisdictions have established frameworks with sector-specific requirements, others are still in the process of developing or implementing legislation. This evolving regulatory landscape continues to shift, as regulators enhance legislation and step up enforcement against organisations.

The results also highlighted a need among survey participants for:

We also observe that legal teams in Asia Pacific are perhaps unaware of the crucial role they play in a cyber crisis, with less than half of respondents saying they think legal is a key member of the incident response team in a cyber crisis. This is a notable difference to what in-house legal teams have told us in other regions of the world, where lawyers are becoming increasingly front and centre and playing the role of “breach coach”.

Boards also play a significant role. Key decisions, including those relating to disclosure, threat actor engagement and extortion payments often reside with the board. Despite this, almost half of our respondents say their boards have not been through a cyber simulation and 35% have not yet decided whether they were open to paying an extortion demand. Clearly there is a lot more to do.