Over the past year, it has been difficult to avoid the rapid acceleration of AI-related discussion across both the technology and cybersecurity industries. Conversations surrounding large language models, AI-enabled workflows, automation, copilots, and offensive security applications have increasingly dominated conference panels, executive briefings, social media feeds, and industry roadmaps. New platforms and challengers continue to emerge at a pace that would have seemed difficult to imagine only a few years ago.
More notably, these conversations are no longer limited to technical or cybersecurity circles. AI has become mainstream enough that even individuals outside the industry now possess at least a general awareness of how rapidly the technology is evolving and how significantly it may reshape the way organizations operate.
Against this backdrop, one question I have been asked with increasing frequency over the past year is whether organisations should be worried about AI-driven cyber threats.
The short answer is yes. Organisations should absolutely be paying attention to how artificial intelligence is changing the cybersecurity landscape, particularly as AI continues to improve the speed, scale, and accessibility of offensive cyber operations. However, the longer and perhaps more uncomfortable answer is that many organisations are still struggling with far more fundamental security issues that continue to drive a significant portion of real-world incidents today.
Having worked on and reviewed hundreds of cyber incidents across Asia over the past several years, one observation has remained remarkably consistent: most successful compromises still originate from fundamentally preventable weaknesses. In many conversations with organisations, the answer I often find myself giving is far less glamorous than expected. Before worrying about highly sophisticated AI-enabled attack scenarios, organisations should first ensure that they are consistently enforcing password policies, implementing multi-factor authentication (MFA) properly, maintaining sufficient visibility across their environments, and validating whether their Incident Response Plans are operational during an actual crisis rather than existing purely as documentation.
This is not to dismiss AI as a threat. Both things can be true at the same time. Artificial intelligence is unquestionably changing the threat landscape, and organisations should take that seriously. At the same time, the likelihood of an organisation experiencing a compromise through weak identity controls, poor policy enforcement, ransomware, phishing, or business email compromise remains significantly higher than many of the advanced AI-driven scenarios currently dominating industry discussion.
Importantly, “less likely” does not mean impossible. It simply means organisations should prioritise risk based on operational reality rather than hype cycles.
This operational reality is particularly complex across Asia, where organisations frequently operate across an unusually broad spectrum of technological maturity. Some organisations maintain highly mature, cloud-native environments supported by centralised telemetry, advanced identity controls, and established security operations capabilities. Others continue to rely on legacy infrastructure, ageing operational systems, fragmented environments, or inconsistent policy enforcement due to operational realities, technical debt, or the pace of business growth. In many cases, organisations operate both simultaneously, with modern SaaS platforms, externally exposed digital services, and AI-enabled tooling existing alongside infrastructure that was never originally designed to withstand today’s threat landscape.
As a result, defenders across the region are often tasked with securing environments that span decades of technology evolution at the same time.
Against this backdrop, AI is steadily reducing the operational effort required for attackers to identify, target, and exploit weaknesses at scale. The issue is not necessarily that threat actors have suddenly acquired revolutionary new capabilities. Rather, the economics of cybercrime are changing in a way that increasingly favours speed, scale, and accessibility.
Ransomware, phishing, credential theft, and business email compromise are not new threats. What is changing is the efficiency with which attackers can now execute them. Activities that previously required meaningful manual effort or technical specialisation — including reconnaissance, phishing customisation, impersonation, malware modification, and large-scale targeting — are becoming faster, cheaper, and significantly more accessible. Phishing campaigns can now be generated with improved language quality, regional context, and personalisation at a scale that was previously difficult to achieve. Open-source intelligence gathering can be automated and correlated more efficiently, while social engineering attempts are becoming increasingly convincing with less preparation and lower technical barriers to entry.
In practical terms, the “classic” threats are becoming hyperscaled.
For organisations with weak foundational controls, this creates a significant problem. In many incidents today, the initial point of compromise still traces back to familiar weaknesses such as reused passwords, missing MFA enforcement, weak conditional access policies, excessive permissions, dormant accounts, poor credential hygiene, or insufficient segmentation between environments. These are not new problems, but AI increasingly enables attackers to identify and exploit these weaknesses more quickly and across a broader range of targets than before.
As a result, organisations that may previously have sat outside the typical target pool are increasingly becoming viable targets. In the past, some organisations may simply have avoided becoming targets due to scale, geography, language barriers, or sheer luck.
That margin of safety is shrinking.
This trend is particularly important in a region as operationally diverse as Asia. Organisations are digitising rapidly, integrating AI-enabled tooling, adopting cloud platforms, and expanding external connectivity faster than ever before. At the same time, many continue to manage uneven visibility, legacy systems, fragmented environments, and operational constraints that make consistent security enforcement difficult to achieve across the enterprise.
AI does not remove these realities. In many ways, it amplifies them.
Organisations preparing for AI-era cyber threats should therefore avoid losing sight of a more immediate operational reality: the next major incident affecting their organisation is still far more likely to originate from a preventable control failure than from a highly sophisticated AI-driven attack chain. That does not make AI irrelevant. It simply means organisations should focus first on the threats they are most likely to face, while simultaneously evaluating how AI may amplify both the likelihood and operational impact of those incidents over time.
The fundamentals of cyber compromise have not changed nearly as much as many organisations believe. What has changed is the speed and scale at which those fundamentals can now be exploited.
