Southeast Asia CISOs Top 13 Predictions for 2026: Securing AI, Centering Identity, and Making Resilience Strategic

In my recent conversation with CISOs across Southeast Asia, they shared with me a pragmatic view of 2026. Attackers are shifting tactics, AI is amplifying both risk and response, and IT-OT boundaries are blurring. Three priorities stand out to me, hardening cloud and AI infrastructure, treating identity as the active perimeter, and operationalizing resilience as capability and, in select sectors – as a service.

Cloud and AI become high‑value targets

Multi‑cloud adoption and sprawling SaaS create visibility gaps where a single misconfiguration or leaked credential can expose sensitive data and expensive compute, including AI GPUs. CISOs mandate is to tighten configurations, expand telemetry, and assume adversaries are probing the weakest link.

Identity and Trust Are the New Perimeter

We expect fewer “break‑ins” and more impersonation such as AI‑crafted lures, voice scams, session hijacks, and token theft that bypass traditional Multi-Factor Authentication. Southeast Asian CISOs are prioritizing continuous verification, session integrity controls, and trust checks embedded in workflows.

Supply chain risk multiplies

Open‑source components, model repositories, CI/CD pipelines, and cloud platforms widen exposure. A single compromised vendor can cascade across customers; ransomware and data theft increasingly arrive via “trusted” integrations. Organizations must strengthen vendor controls and harden pipelines.

Agentic AI raises the stakes on offense and defense

Autonomous agents can make poor decisions at machine speed unless constrained. Guardrails now include scoped, time‑bound access; human‑in‑the‑loop; kill‑switches; and behavioural monitoring. On defense, Security Operations Centers (SOCs) are automating correlation, summarisation, containment, and remediation, elevating analysts to strategic hunting and validation.

Instrument the browser

As AI works through browser sessions, responders need session reconstruction and richer telemetry to investigate fast‑moving incidents.

People remain decision makers

With manipulation accelerating, boards are investing in targeted awareness, deception detection, and decision‑support training that complements technical controls.

IT- OT convergence expands cyber‑physical risk

Industrial control systems require OT‑specific resilience such as segmentation, rigorous change control, and rehearsed recovery to be prioritized at the board level.

In financial services, resilience becomes a revenue stream

Large institutions may productize security assurance by packaging cyber resilience, AI‑enabled fraud controls, and compliance automation as subscription services.

Zero Trust extends to non‑human identities

Enterprises will manage thousands of AI agents. Expect formal AI identity and access governance, including least privilege for agents, authentication models for non‑human actors, and continuous behavior monitoring.

hacker stealing dollars bank cyber crime cybercrime money theft

Shutterstock

CSO ASEAN Final Take

2026 will test whether organisations can secure what they automate. In my view, this collective Southeast Asia CISOs’ message is consistent: harden cloud and SaaS, elevate identity‑centric controls, instrument agents and browsers for forensic clarity, and treat resilience not only as defense but, where it makes sense, treat it as a product.

Enjoy reading these top predictions for 2026 by our region’s most eminent CISOs who are also our CSO30 ASEAN & Hong Kong Award 2025 winners:

Jason Lau
Chief Information Security Officer
Crypto.com
Board Director at ISACA

Prediction 1
In 2026, organizations will face attacks that increasingly blur the lines between cybercrime, insider threat, and nation-state activity. Social engineering, SaaS compromise, digital-asset theft, and extortion will no longer appear as isolated incidents, but as coordinated services designed to scale impact and pressure defenders simultaneously.

Prediction 2
In 2026 we will likely see widely reported incidents of agentic AI going rogue. Not necessarily through rebellion, but through unchecked autonomy combined with speed. Boards will be forced to confront accountability when agents make bad decisions at machine scale, and organizations will need to redesign Model Context Protocol usage around human‑in‑the‑loop controls, scoped and time‑bound access, real‑time kill switches, and continuous behavioral monitoring. Governance that can’t keep up with velocity will be bypassed

Prediction 3
In 2026, the defining risk will be business‑process and human-layer exfiltration where AI systems, SaaS integrations and wearables become the transport layer for data loss. Security teams will be forced to rethink data‑loss prevention for an AI‑human-augmented world.

Prediction 4
Incident response and SOC teams will need to think about adding new telemetry for analysis- Agentic browser session reconstruction. Organizations that treat “AI browser access” like a normal productivity feature, rather than privileged access, will learn the risks the hard way.

Yohannes Glen Dwipajana
SVP Head of Enterprise Security
Indosat Ooredoo Hutchison

Prediction 5
Cloud misconfigurations, SaaS integrations, and AI GPU resources are under a constant attack. Most of the company will have a multi-cloud strategy environment however it will reduce SOC real time visibility to detect lateral movement, and the Threat Actor will steal your data and also compute power. This can be happened by a single misconfigured credential then will expose the enterprise.

Prediction 6
The Threat Actor are shifting away from breaking systems, they are impersonating people, sessions, and trusted workflows using AI-generated phishing, voice scams, and deepfakes are indistinguishable from real communications, there will be more session hijacking and token theft to bypass traditional MFA.

Prediction 7
Supply chain is the multiplier of risk, by having many software suppliers, using open-source components, AI models, and cloud platforms are now prime entry points. One single compromised vendor may expose thousands of customers. By exploiting vendor’s AI model repositories and CI/CD pipelines become a new emerging attack vector. Ransomware attack may increasingly enter through our “trusted” partners.

Michael Saw
Chief Information Security Officer, APAC
Siemens Energy

Prediction 8
As agentic AI accelerates attack speeds, human intuition will prove increasingly unreliable against sophisticated manipulation. This will drive boards to treat employee resilience as a core risk factor and invest in employees’ cybersecurity awareness programs and training, as well as proactive deception detection alongside technical controls.

Prediction 9
As Information Technology/Operational Technology (IT/OT) integration accelerates operational efficiency, cyber-physical attacks targeting industrial control systems (ICS) will rise, prompting boards to prioritize OT resilience as a core business risk alongside traditional IT security.

Primitivo Nufable
VP & Head – IT, Information & Cyber Security Group
St Luke’s Medical Centre

Prediction 9
Security teams will respond by fully operationalizing AI within their SOCs.

Prediction 10
In 2026, healthcare sector and St Luke’s Medical Centre in particular, will be laying Agentic AI SOCs roadmap to upgrade our existing SOC running on the basic SIEM/SOAR platform. AI agents will assist analysts by handling data correlation, incident summaries, and automated containment and remediation, allowing human analysts to focus on strategic threat hunting and validation. St Luke’s Medical Centre will try to replace L1 & L2 Cybersecurity Analyst with Agentic AI Analyst and L3 Cybersecurity Analyst will be in-charge of the governance of these AI agents.

Chhay Yaroth
SVP and Head of Information Security Division
ACLEDA Bank Plc.

Prediction 12
Over 60% of the world’s top 50 financial institutions by revenue will have launched profitable cyber-resilience products by 2026. This will give rise to a new metric-Security Contribution Margin which is tracked by analysts. Moreover, one-third of large fintech will become customers of their banking partners’ security services, flipping the traditional client-provider relationship based on cyber maturity.

Prediction 13
A major company will suffer material data risks originating from an over-permissioned, compromised, or hallucinating autonomous AI agent, leading to a new regulatory focus on “AI Identity and Access Governance” and forcing 60% of CISOs to create a dedicated “AI Identity” team within IAM.

Innovation and technology, Hand of robot touching a padlock of security on network connection of business, Data exchange, Financial and banking, AI, Cyber crime and internet security.

iStock/ipopba

Source link