While much of the cybersecurity conversation focuses on how AI is transforming external threats, many organizations in Asia Pacific are dealing with a more immediate issue: the growing frequency of insider-driven incidents.
For years, cybersecurity has been shaped by the idea of the “big incident”, a single, high-impact incident that disrupts operations, exposes sensitive data, and makes headlines. But that framing no longer reflects how risk plays out in many organizations today, particularly across Asia Pacific.
APAC Vice President and General Manager, Mimecast.
Recent research shows that organizations in APAC are experiencing insider-driven cyber incidents more frequently than their counterparts in North America and Europe. On average, companies in the region face around eight such incidents each month, compared with approximately six in EMEA and five in North America.
While the cost per incident is broadly consistent globally, the higher frequency in APAC changes the equation entirely.
The real issue is not the scale of any one exposure. It is the cumulative impact of many.
From exceptional events to everyday risk
Insider-driven incidents are no longer rare or exceptional. They are becoming a routine part of operating in a digital environment.
These incidents can take many forms. An employee shares sensitive data through an unauthorized channel. Credentials are compromised and used to access internal systems. A file is inadvertently exposed through a misconfigured platform. In most cases, there is no malicious intent. The risk emerges from how people interact with systems, data and tools in the course of doing their jobs.
What is changing is not just the nature of these incidents, but their frequency.
When organizations are dealing with multiple insider-driven events each month, the conversation shifts. This is no longer about preventing a single incident. It is about managing a continuous stream of exposure.
Why APAC is seeing more frequent incidents
The higher frequency of insider-driven incidents in APAC is not a coincidence. It reflects how organizations in the region are structured and how they operate.
Many companies across APAC manage large and geographically distributed workforces. Team collaboration across markets, time zones and digital platforms is common. Daily operations involve high volumes of communication and data exchange, often across a mix of on-premise systems, cloud storage environments and third-party applications.
This creates more opportunities for data to move and, with it, more opportunities for it to be mishandled, exposed or misused.
At the same time, organizations are rapidly adopting new tools to improve productivity, including AI tools that can access and process large volumes of information. While these tools bring clear efficiency gains, they also introduce new pathways for data exposure, often without corresponding visibility or control.
The result is an environment where insider risk is shaped less by isolated mistakes and more by the interaction between people, processes and increasingly complex digital systems.
The financial impact of insider-driven incidents is well understood. What is less often discussed is how that impact compounds over time.
Each incident carries a cost. But when incidents occur repeatedly, those costs accumulate across multiple dimensions.
Security teams are placed under constant pressure to investigate and respond. Incident response processes become stretched. Operational disruption becomes more frequent. Over time, this can erode efficiency and divert resources away from strategic initiatives.
There is also a broader impact on trust. Customers and partners expect organizations to manage their data responsibly. Repeated incidents, even if individually contained, can undermine confidence in an organization's ability to do so.
Regulatory exposure adds another layer of complexity. As governments across APAC strengthen requirements around data protection and privacy, organizations face increasing scrutiny. In Singapore, the Personal Data Protection Commission has stepped up enforcement under the Personal Data Protection Act, with organizations expected to demonstrate not just that incidents are contained, but that appropriate safeguards and processes are consistently in place.
Frequent incidents can therefore raise questions not just about technical controls, but about governance and oversight.
Why traditional approaches fall short
Many organizations continue to approach cybersecurity with a focus on external threats and technical vulnerabilities.
This approach remains important, but it does not fully address the nature of insider-driven risk.
Traditional models tend to assume that incidents are infrequent and can be managed as discrete events. They are designed to detect anomalies, respond to incidents, and restore systems to a secure state.
In an environment where incidents occur regularly, this model becomes less effective.
Responding to each incident in isolation does little to address the underlying patterns driving repeated exposure. Over time, organizations can find themselves caught in a cycle of detection and response, without reducing the overall level of risk.
Rethinking insider risk as a continuous challenge
To manage insider-driven risk effectively, organizations need to shift their perspective.
This starts with recognizing that insider risk is not an edge case. It is a core component of the modern threat landscape, shaped by everyday behavior and routine operations.
Visibility becomes critical — and increasingly, that means behavioral visibility. Organizations need to understand not just who is accessing data, but how. Sudden spikes in downloads, unusual transfers to personal applications, or attempts to disguise files by renaming them can all be early indicators of exposure. These signals are easy to miss when security teams are focused on perimeter threats, but they are often where insider risk first becomes visible.
Context is equally important. Not all actions carry the same level of risk. Understanding the intent, behavior and environment surrounding an activity allows organizations to prioritize what genuinely requires attention rather than chasing noise.
AI-driven tools add a further layer of complexity. As organizations across APAC adopt AI applications to improve productivity, these tools can access and process large volumes of sensitive information — often without corresponding visibility or controls. At the same time, AI can be a significant asset in detection, establishing behavioral baselines and surfacing anomalies that would be difficult to identify manually. The key is ensuring that AI adoption on the operational side is matched by AI-informed oversight on the security side.
Importantly, the goal is not to restrict employees but to support them. Research consistently shows that the majority of insider incidents are unintentional — the result of poor judgement or unfamiliar tools, not malicious intent. Employees should not be treated as the weakest link. They should be set up for success, with clear guidance, appropriate access, and a culture where reporting concerns feels safe rather than risky.
Managing risk at scale
As insider-driven incidents become more frequent, the challenge for organizations is not just prevention, but management at scale.
This means moving beyond reactive approaches towards models that can identify patterns, anticipate risk, and respond in a way that reduces overall exposure over time.
Zero trust principles are increasingly central to this. Limiting employee access to only what their role genuinely requires — and continuously reassessing those privileges as roles change — reduces the potential impact when an account is compromised or misused. Offboarding processes deserve particular attention. Employees who leave often retain access longer than they should, and those familiar with internal systems can represent a significant exposure window if that access is not promptly revoked.
It also requires stronger alignment between security, operations and governance. Insider risk does not sit neatly within a single function. It spans technology, people and process, and needs to be addressed accordingly. Insider risk needs to be treated as an ongoing program, not a periodic review or a compliance exercise.
In APAC, where organizations are operating in fast-moving and highly connected environments, this shift is particularly urgent. With large and distributed workforces operating across multiple markets, the conditions for insider risk are structural — building continuous risk management capability is not optional.
A different way of thinking about cyber risk
The narrative around cybersecurity has long been shaped by the idea of catastrophic events. While those events still matter, they are no longer the only, or even the primary, source of risk for many organizations.
In APAC, insider-driven incidents are happening more often, and that frequency is what makes them significant. When the average organization in the region faces around eight such incidents each month, the cumulative financial and operational impact adds up fast — even before factoring in the regulatory scrutiny that increasingly follows repeated exposure.
The question is no longer whether an incident will occur. It is how often, and how well organizations are prepared to manage the impact when it does. The organizations that manage this well will not necessarily be those with the largest security budgets. They will be those that treat insider risk as a continuous, evolving challenge — investing in the visibility, culture and controls that reduce exposure before incidents occur, not just responding after they do.
The organizations that succeed will not be those that simply prevent incidents, but those that understand and manage risk as a continuous, evolving part of doing business.
Because in today’s environment, the cost of insider risk is not defined by a single moment of failure. It is defined by how often that moment repeats.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit