Why identity is now APAC's biggest cybersecurity blind spot

Asia-Pacific’s cybersecurity conversation has quietly shifted. For years, the industry treated credential theft, stolen passwords, leaked databases, and brute-force attacks as the primary gateway into enterprise systems. That assumption no longer holds.

Interpol’s “2025/2026 Asia and South Pacific Cyberthreat Assessment” found that more than half of the 18 member countries surveyed now report that cybercrime accounts for 30% of all crimes reported nationally, with phishing and social engineering techniques emerging as the most widespread and financially damaging methods in use. The mechanics of compromise are changing faster than the volume. Instead of stealing passwords, attackers are stealing identity itself.

Identity over credentials

Two-factor authentication and single sign-on (SSO) were built to close the credential gap, and for a time, they did. Both were designed around the premise that a login attempt reflects a real, verifiable human. That premise is breaking down. Session hijacking, token theft, and SSO exploitation let attackers bypass multi-factor authentication entirely once they compromise a single trusted session. Meanwhile, password reuse across cloud applications widens the net further. The point of failure has moved to the identity layer behind these controls, where systems are meant to continuously confirm that someone is who they claim to be.

This matters because most enterprise security architectures in APAC were built around perimeter and endpoint controls, with identity treated as a supporting function instead of the primary control plane. As workforces, contractors, and now AI agents all authenticate into the same systems, identity has to become the front line.

Where the spending is actually moving

Budgets are starting to reflect this shift. IDC forecasts total security spending across Asia-Pacific, excluding Japan, will reach US$39.5 billion in 2026 , growing at a 10% compound annual rate by 2029, with identity governance among the fastest-growing categories in that forecast. That is a meaningful signal for organisations that have historically weighted budgets toward firewalls, endpoint protection, and network monitoring. Those tools remain necessary, but they were not built to answer the question that now matters most: Is the entity requesting access actually who, or what, it claims to be?

For CISOs and CFOs working through the last half of 2026 and 2027 planning cycles, this means revisiting how they structure security budgets. A perimeter-heavy allocation, however well-funded, leaves the identity layer under-resourced relative to where the exposure actually sits. Some organisations are treating identity governance, privileged access management, and continuous verification as core infrastructure.

AI complicates this picture. On the offensive side, generative AI has lowered the cost and skill threshold for convincing impersonation. Interpol’s report notes a 600% increase in deepfake-related discussion on cybercriminal forums and Telegram channels popular with Southeast Asian threat actors between February and June 2024 alone, showing how quickly deepfake-enabled fraud and business email compromise are scaling as a category rather than a niche threat.

At the same time, AI is being positioned across the industry as a defensive force multiplier for anomaly detection, behavioural analysis, and faster triage of the alert volumes security teams now face. Both are true at once, which is what makes 2026 a difficult year to plan security roadmaps. Deloitte’s “2026 Global Technology Leadership Study”, which surveyed more than 660 senior technology executives globally, found that 81% of leaders are confident their current operating model can deploy and govern AI enterprise-wide, yet 75% acknowledge their operating model will need to change within the 12 to 18 months to drive greater value.

That void between confidence and operational readiness is the same gap many Asia-Pacific enterprises are living through now. They are adopting AI-powered defensive tools faster than they are rebuilding the governance needed to manage AI-powered risks.

A region of uneven readiness

None of this plays out uniformly. Mature markets with established regulatory frameworks and higher security budgets, such as Singapore and Australia, are further along in shifting toward identity-centric architectures. Fast-digitising markets like Vietnam, Indonesia, and the Philippines are often absorbing new digital infrastructure and new threats simultaneously, with less institutional capacity to respond. Interpol’s report is explicit on this point, noting that disparities in cybersecurity maturity across the region create openings that better-resourced jurisdictions have already begun to close.

For enterprises operating across multiple APAC markets simultaneously, this unevenness is itself a risk factor. A posture calibrated for a mature hub cannot simply be replicated in a market still building basic digital infrastructure, and a lighter-touch approach suited to an early-stage market will leave gaps if applied to a highly digitised one facing well-resourced attackers.

The throughline across the crime, spending, and AI-readiness data is the same. The threat landscape has moved from credentials to identity faster than most operating models have. Closing that gap means treating identity governance as core infrastructure, budgeting accordingly, and building the AI governance required for a landscape in which attackers and defenders increasingly use the same tools.