From surviving cyber-attacks to learning from them – to mitigate systemic risks for business resilience.

For years, cybersecurity has been treated largely as a technology issue; something to be solved with better tools or more sophisticated defenses. Increasingly, however, policymakers and business leaders are recognizing it for what it is: an economic issue and a form of systemic risk that can’t be contained within IT alone. 

The impact is especially visible across Asia. Singaporeans lost S$456.4 million to scams in the first half of 2025 alone. In the Philippines, financial losses have reached an astonishing $8.29 billion (₱480 billion) annually, which is 1.9% of the nation’s GDP. 

If global cybercrime were an economy, it would be the world’s third largest, surpassed only by the US and China. 

At that scale, cyber risk can no longer be treated as a technical issue confined to IT teams; it is a systemic economic threat, with direct implications for regional stability, business confidence, and growth across Asia. 

In this context, the moment is critical for businesses across Asia. Now is the time to recognize cyber resilience, anchored in breach containment and continuity, as a fundamental business outcome.  

While the conversation is thankfully moving in the right direction, we’re still not aiming high enough. Withstanding attacks is now table stakes; true resilience is also about limiting impact, sustaining operations, and emerging stronger after a crisis. 

Fragility = failed resilience  

As individuals, we have evolved from a focus on merely surviving to thriving. The same mindset should apply to organisations and cybersecurity. Modern organizations should not aim simply to withstand disruption, but to continually improve and to thrive in the face of it. 

As attackers constantly change tactics and execute increasingly complex supply‑chain attacks, resilience must evolve in tandem, becoming an ongoing process of learning, adaptation, and strengthening over time. 

That is the essence of anti-fragility: systems that do not merely withstand stress, volatility, disorder, and shocks, but improve because of them. A security model designed only to recover remains exposed. An anti‑fragile approach, by contrast, treats every attack as a signal — revealing weaknesses, closing gaps, and adapting continuously. 

Just as there is no guarantee that investing in your health will stop you from getting sick, no company can ever guarantee it will experience zero cyber incidents.

The difference lies in what happens next. By shifting the focus – from extinguishing digital fires as quickly as possible, to understanding why and how they started – organizations can reduce repeat failures and strengthen their ability to respond faster and more effectively over time. 

Too many organizations rely on legislation alone 

While more organizations are beginning to recognize anti‑fragility as a strategic objective, too many still treat regulatory compliance as a proxy for resilience.

That alone is not enough.

Compliance lays an important foundation for cybersecurity, but it is just that: a foundation, not a finished structure. The problem with using compliance as a north star is that legislation almost always lags behind the threat landscape. The gap between a new attack technique emerging and regulation catching up can span years, leaving organizations exposed in the meantime.

Compliance, therefore, does not equate to protection. To reduce real risk, organizations must look beyond regulatory mandates and formalize a post‑incident learning approach, one that treats security as an ongoing process of adaptation and improvement. 

A breach containment strategy should sit at the centre of this effort. By focusing on limiting the spread and impact of an attack through restricted lateral movement, containment helps ensure that inevitable incidents do not escalate into systemic failures. 

Critical success factor: turning data into insight 

At the center of breach containment is microsegmentation and Zero Trust, which focus on reducing the impact through strict access controls.

By proactively segmenting networks, isolating workloads, and limiting unnecessary permissions, critical operations can continue to run even during and after a cyber incident.  

Every attempted breach can be analyzed, providing insights that can help to find weak points, bolster the protection of critical assets, and strengthen defences in a more adaptive, intelligent way.   

For companies, the ability to turn data into insights and act upon it can become a game-changer. Cybersecurity success will be defined not by those who avoid incidents, but by those who learn from them.