Indonesia’s Cybersecurity Talent Problem Is Becoming a Skills Problem

For cybersecurity teams, AI is quickly moving from something experimental to something people actually use. The World Economic Forum’s Global Cybersecurity Outlook 2026 found that 77% of surveyed organizations had adopted AI for cybersecurity. It is already being used for tasks such as phishing detection, intrusion response and user-behaviour analysis. That sounds like good news for teams struggling with workload. And mostly, it is. But AI doesn’t remove the need for skilled cybersecurity professionals. It changes what those professionals need to be good at. AUTOMATION CAN DO MORE. SO HUMANS HAVE TO DO MORE TOO. The same WEF research found that 54% of organizations considered insufficient knowledge or skills a barrier to using AI effectively in cybersecurity. Another 41% pointed to the need for human oversight. That second number matters. AI can analyse enormous amounts of information quickly. What it still struggles with is context: whether an unusual event is genuinely dangerous, how a technical issue affects the business and what action makes sense when the available information is incomplete. Cybersecurity professionals increasingly need

Cybersecurity training has an awkward reputation. For many employees, it arrives as an annual module, a collection of familiar warnings and a quiz that strongly encourages remembering whatever appeared on the previous screen. Meanwhile, the workplace has become considerably less predictable. ENISA’s latest Cybersecurity Month data shows that 74% of surveyed employees had received suspicious emails, messages, voice communications or links at work during the previous six months. Phishing remained the most common example, but employees also encountered attempts to steal personal information, passwords, AI-generated scams, malware and ransomware. ENISA [https://www.enisa.europa.eu/news/cybersecurity-month-work-employees-skills-under-the-looking-glass] Yet only 45% said their organization regularly sends cybersecurity awareness information or updates. The interesting part is that employees don’t appear uninterested. Eighty-five percent said they wanted to improve their cybersecurity skills. ENISA [https://www.enisa.europa.eu/news/cybersecurity-month-work-employees-skills-under-the-looking-glass] The gap is partly about how training is delivered. THE BIGGEST TRAINING PROBLEM MAY BE THE CALENDAR Among employees who identified obstacles to developing cyber skills, 26% cited finding time during work, ahead of cost at 16%, followed by limited information about training and insufficient employer support. ENISA [https://www.enisa.europa.eu/news/cybersecurity-month-work-employees-skills-under-the-looking-glass] That matters because

Introduction Third-party involvement in data breaches doubled from 15 percent to 30 percent in a single year, the largest one-year shift ever recorded in the Verizon 2025 Data Breach Investigations Report. That is not a gradual trend line, it is a structural shift in how attackers reach their targets. Rather than breaching a company directly, they go after the vendor, the software dependency, or the service provider sitting quietly inside that company's trust boundary. As Indonesia's leading cybersecurity company, ITSEC Asia works with organizations across finance, healthcare, and technology who are only now realizing that their own defenses were never the whole picture, because a breach can start three vendors away and still land squarely on their desk. Source: Supply Chain Attack Statistics 2026, Stingrai Research · Supply Chain Attack Statistics for 2026, Swif The Numbers Behind the Shift A supply chain compromise now costs an average of 4.91 million US dollars and takes 267 days to identify and contain, the longest lifecycle of any breach vector tracked in IBM's Cost