"The answer is not to fear AI or slow innovation, but to understand how the risk landscape is changing," said Gareth Russell, Field Chief Technology Officer, Security, APAC, Commvault.
IDC: Asia Pacific AI spending — 33.6% CAGR to US$175 billion by 2028
Investment in AI across Asia Pacific is accelerating. According to IDC, regional AI spending is growing at a compound annual growth rate of 33.6 percent from 2023 to 2028, with the market projected to reach US$175 billion by 2028. That rapid uptake promises productivity gains but, as vendors and researchers warn, it also compresses the time organisations have to build guardrails and resilience into AI-enabled operations.
Generative AI, agentic AI, and the new technical attack surface
Commvault and others describe new and amplified risks tied to AI. Generative AI can introduce prompt injection and data poisoning risks, while agentic AI — systems that make decisions and take actions across business systems — raises the stakes for identity, permissions and operational control. KENSAI Cybersecurity’s findings, as cited in the discussion, show a related trend in attack effectiveness: AI-powered ransomware is deemed 73 percent more likely to be successful than traditional variants and is able to reduce dwell times from an average of nine days to just 47 hours. Commvault adds that AI-enabled ransomware can continuously modify code and behaviour patterns, rendering many prior detection methods ineffective.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleFrom prevention to impact limitation: breakout time and operational reality
Gareth Russell framed the strategic shift plainly: "The reality is that organisations cannot stop every attack. The question is no longer, 'How do we prevent compromise?' It’s 'How do we continue operating when compromise occurs?'" The pace of intrusion bears this out — average breakout time has fallen to 29 minutes, leaving organisations less than half an hour between initial compromise and lateral movement. That velocity forces a recalibration: stronger identity controls, tighter segmentation, isolated immutable recovery environments and AI-driven automation for detection and recovery at machine speed.
State of Data Resilience Asia 2026: expectations versus recovery capability
Commvault’s State of Data Resilience Asia 2026 study reveals a wide resilience gap. Eighty-one percent of Asian organisations expect to be operational within five days after an incident, yet the average time required to recover to even a minimal level of operation is 28 days. The study also finds that four out of 10 organisations pay a ransom following an attack, and nearly one-third of those who paid say the outcome still failed because data was not returned or they were attacked again. These figures underline Russell’s argument that recovery cannot be treated as an afterthought or a one-time plan.
Minimum Viable Company (MVC): decide what to restore before crisis
Russell recommends that organisations define a Minimum Viable Company — the smallest set of services, applications, data, identities and processes required to keep the business alive after a major cyberattack. MVC is a prioritisation discipline: it identifies what must continue if everything else is unavailable, then tests and refines that list continuously as priorities and dependencies change. The goal is not to recover everything at once but to recover what matters most first.
What this means for security teams, legal and communications, and business leaders
- Security teams should shift from pure detection to integrated resilience: strengthen identity governance, segment critical systems, maintain isolated recovery environments and adopt AI-driven automation for containment and recovery.
- Legal and communications leaders must be involved from the outset. Containment, recovery, legal obligations, regulatory notifications and customer communications need parallel decision-making, not sequential handoffs.
- Business leaders must invest in continuous testing and governance: define who declares a recovery event, who decides what gets restored first, and what evidence is required before systems are trusted again.
Practical steps, simulations and the operational test
Commvault advises treating recovery as an "always on" capability through Recovery Operations (ResOps) — continuous, integrated functions that combine recovery, cyber response and data protection. Practical steps include defining decision-making responsibilities ahead of incidents and replacing assumptions about backup integrity with evidence. Commvault's hands-on exercises — "Minutes to Meltdown," "Minutes to Recovery," and Cleanroom Recovery — are cited as ways to simulate real-world pressure: proving teams can restore business services under stress and validating recovery in isolated environments before returning systems to production.
The facts are stark. AI investments are rising quickly across Asia Pacific, attacks are operating at machine speed, and many organisations expect to recover far faster than their current capabilities allow. The narrowing window for response shifts the decisive advantage to organisations that make recovery continuous, evidence-driven and governed long before compromise. Will APAC enterprises accelerate resilience planning to match their AI deployments? The clock — measured in minutes and hours, not days — is running.
