Strengthening Cyber Resilience in APAC

Key Takeaways:

1. Cyber attack is the top-ranked risk in Asia Pacific, with regional cyber losses above the global average.
2. Ransomware, social engineering and technology supply-chain disruption are expanding cyber impacts beyond IT.
3. AI-enabled threats are increasing attack speed, scale and sophistication, reinforcing the need to review controls, continuity and risk transfer.
4. Mature cyber resilience connects board oversight, continuity planning, employee awareness, quantification and insurance program design.

Cyber risk has moved into the centre of the business resilience agenda. Aon’s Tenth Edition Global Risk Management Survey shows that cyber attack is the top-ranked risk in Asia Pacific (APAC), ahead of economic slowdown and increasing competition. Its position reflects the potential for cyber events to disrupt production, projects, supply chains and customer confidence.

This elevates a critical question: are organisations measuring and managing cyber risk with the same rigor applied to other material business risks?

The data points to a resilience gap. APAC organisations report higher cyber loss experience than the global average, yet fewer have a formal response plan. Limited use of cyber risk quantification can also constrain visibility into potential disruption and the decisions that shape investment, retention and transfer.

The threat environment is also evolving. Ransomware remains a key driver of large claims, while social engineering, business email compromise and technology supply-chain disruption continue to test organisational resilience. Generative AI and automation may further increase the speed, scale and sophistication of attacks by helping threat actors identify vulnerabilities and mimic legitimate user behaviour.

For organisations across the region, strengthening cyber resilience means connecting cyber risk to enterprise decision-making: testing continuity plans, strengthening people and process controls, assessing operational dependencies and using analytics-led quantification to inform insurance program design and total cost of risk decisions.