Key Takeaways
- AI is being used both defensively and offensively in cybersecurity; attackers leverage it to automate phishing, malware generation, and large‑scale fraud, while defenders embed AI to speed detection, reduce analyst workload, and improve response.
- The effectiveness of AI‑driven security depends on high‑quality, centralized telemetry; fragmented data limits detection and correlation capabilities.
- Successful AI adoption requires evaluating tools by workflow integration and analyst time saved—not by feature count—and prioritizing platforms where AI is built‑in rather than bolted on.
- Organizations must establish internal AI governance aligned with emerging regulations and run phased deployments with measurable baselines before full‑scale rollout.
- For Southeast Asian enterprises, especially SMBs, embedding AI into unified detection‑and‑response workflows yields the greatest operational benefit and helps counteract the speed‑and‑scale advantage gained by threat actors.
AI in Cybersecurity: Dual‑Edged Sword
Artificial intelligence has become a fixture in enterprise security strategies. According to Kaspersky’s 2026 global study, virtually all organizations in the APAC region—including Singapore, Indonesia, and Vietnam—plan to incorporate AI into their security operations. Vendors are embedding AI to accelerate threat detection, alleviate analyst workload, and counter attacks that outpace human responders. At the same time, cybercriminals are harnessing the same technology to automate reconnaissance, craft convincing phishing lures, and scale malware campaigns that once demanded significant expertise. This symmetry creates a constant arms race where every AI capability available to defenders can be repurposed by attackers.
How Cybercriminals Weaponize AI
Threat actors systematically integrate generative AI across the entire attack chain. They automate the creation of phishing content, generate functional malicious code, improve payload evasiveness, and enhance social‑engineering tactics at scale. Kaspersky’s Global Research and Analysis Team (GReAT) illustrated this shift in the RevengeHotels campaign, where AI‑generated code was woven into malware development, producing more convincing lures and harder‑to‑detect payloads. In the financial sector, Kaspersky recorded over 530,000 attempted financial phishing attacks across Southeast Asia in 2025, with Thailand leading at 247,560 attempts. AI enabled attackers to model victim behavior, tailor fraudulent lures, and probe infrastructure faster than manual methods allowed. Similar patterns emerged in entertainment, where AI‑driven deepfakes and content fraud posed rising risks to studios and platforms. The common denominator is speed and scale: AI compresses the time between reconnaissance and compromise, eroding the defender’s traditional response‑time advantage.
AI‑Powered Defensive Capabilities
Security vendors are responding by embedding AI throughout the detection‑and‑response lifecycle. Kaspersky, for example, has extended AI‑driven capabilities across its portfolio to deliver richer, faster, and more actionable intelligence without overburdening analysts. Behavioral correlation rules establish baselines for normal login activity and automatically flag anomalies, triggering account‑theft alerts without manual log review. AI‑based asset scoring continuously evaluates risk based on event sequences and context, elevating scores for assets with unusual patterns so teams can focus limited resources where exposure is greatest. Incident summarization powered by AI explains attack chains, initial vectors, and adversary actions in plain language, allowing analysts to grasp what happened without sifting through raw event data. AI assistants further deobfuscate command lines, provide analytical explanations, and generate concise investigation reports, reducing cognitive load and accelerating analysis in complex, multi‑stage incidents.
Challenges in AI Integration
Despite enthusiasm, many organizations encounter organizational and technical hurdles when integrating AI into their security stacks. Data quality and telemetry coverage emerge as primary concerns: AI detection and correlation are only as good as the data they consume, and fragmented architectures with siloed sources produce inconsistent telemetry that blunts AI effectiveness. Integration complexity and total cost of ownership also pose challenges; adding AI as isolated features within a disjointed stack increases overhead without delivering unified benefit. Skill gaps can widen when tools demand deep technical configuration, potentially leaving under‑resourced teams behind. Finally, responsible AI governance is essential—enterprises must align internal policies with emerging regulatory frameworks and vendor accountability measures to ensure ethical and effective use.
Practical Steps for Successful AI Adoption
To overcome these obstacles, organizations should follow a structured approach:
- Consolidate telemetry into a unified platform before layering AI capabilities. Centralized data collection across endpoints, identity, cloud, and network ensures AI has a complete, consistent view.
- Evaluate AI security tools based on workflow integration, not feature count. The true metric is analyst time saved and operational efficiency gained, not a checklist of capabilities.
- Prioritize platforms where AI capabilities are built‑in rather than bolted on. Native integration reduces integration overhead, lowers total cost of ownership, and minimizes context‑switching.
- Establish internal AI governance standards aligned with emerging regulations and vendor accountability frameworks. Clear policies guide responsible use and risk management.
- Run phased deployments with measurable outcome baselines to validate AI impact before full‑scale rollout. Pilot projects enable organizations to quantify benefits, adjust configurations, and build confidence before scaling.
Building a Resilient AI Strategy
The central question for security leaders is not whether to adopt AI, but how to implement it so that it delivers genuine operational benefit rather than added complexity. AI that operates in isolation or requires extensive manual configuration merely adds overhead without reducing risk. The greatest gains arise when AI is embedded directly into unified detection‑and‑response workflows, allowing analysts to act on enriched intelligence without juggling disparate tools. By focusing on integration, organizations can turn AI from a potential source of complexity into a force multiplier that enhances speed, accuracy, and resource efficiency.
Leadership Perspective: Simon Tung’s Role
Simon Tung, appointed General Manager for Kaspersky in ASEAN and the Asia Emerging Countries in October 2025, drives the company’s strategic direction across the region. With over three decades of experience in technology leadership—including stints at Crayon, Microsoft, and SAP—Simon emphasizes accelerating growth, forging key partnerships, and delivering innovative solutions that meet evolving customer needs. His background, which includes an MBA from the University of Adelaide, ACCA certification, and an SMU‑SID Accredited Diploma in Directorship, equips him to blend financial discipline with strategic foresight as Kaspersky seeks to empower organizations and governments against an increasingly complex threat landscape.
Strategic Guidance for SMBs in SEA
For small and medium‑sized businesses in Southeast Asia, the advice mirrors that of larger enterprises: prioritize a unified security platform with native AI capabilities, ensure high‑quality telemetry, and measure success by tangible improvements in analyst efficiency and incident response time. By adopting AI as an integrated component of their security posture—rather than a set of disconnected tools—SMBs can better defend against AI‑enhanced phishing, malware, and fraud attempts while keeping operational costs manageable. In doing so, they not only protect their assets but also contribute to a more resilient regional cybersecurity ecosystem.