CXOInsights by CXOCIETY

Asia’s 2027 security landscape is defined by a “governance over hype” reckoning. IDC projects regional security spending will hit US$39.5 billion in 2026, while noting only 7% of APeJ enterprises feel highly prepared in GRC skills. 

As Gartner forecasts 40% of enterprises will demote AI agents by 2027 due to governance gaps surfacing only in production, CISOs face a dual mandate: deploy agents at machine speed while proving verifiable, auditable control to fragmented regulators. 

Fastly CISO Marshall Erwin joins us on this episode of PodChats for FutureCISO to tackle the pressing issue of managing accountability in the age of AI as viewed from the perspective of the CISO.

1.       High level view of Fastly.

2.       Do enterprises in Asia have a comprehensive, real-time inventory of all AI agent identities and their permitted data access?

3.       From a CISO perspective, are current threat models updated to include agents as active actors, not just tools?

4.       How are enterprises demonstrating to regulators across multiple jurisdictions that their AI guardrails and data flows are governed with verifiable, auditable evidence, moving beyond policy to operational proof?

5.       Have enterprises mapped every sector-specific data localisation requirement (beyond the general PDP laws) that applies to business in Asia? (global context)

6.       Are current public and private cloud architectures designed for the necessary data residency and portability?

7.       In your view is zero-trust architecture sufficiently mature to act as the control plane for AI, effectively preventing a compromised agent or partner from causing a cascading regional incident by eliminating lateral movement?

8.       How are enterprises operationalising digital sovereignty, ensuring that our reliance on global cloud providers does not compromise our technical and operational control, especially in the event of a geopolitical or regulatory shift?

9.       Advise on Accountability without control – a CISO’s sovereignty dilemma

Asian enterprises are rapidly deploying agentic AI, yet resilience lags. Singapore’s new Agentic AI Framework offers crucial guidance on governance and accountability. To be clear, traditional IAM is ill-equipped for non-human identities, which according to some statistics outnumber humans 1:144. Organisations must prepare by establishing robust identity controls and governance, as regulators demand proof of responsible AI use within their business ecosystem.

In this PodChats for FutureCISO, Jasie Fon, regional vice president of Asia, Ping Identity, offers her perspective on the state of resilience as non-human identities expand their presence and influence in the workflow.
 CONSIDER RE-ORDERING

1.       Why are identity governance gaps widening as agentic AI adoption accelerates? 

2.       What can enterprises across Asia learn from Singapore’s early exploration of identities for AI agents? 

3.       What should enterprises put in place before giving AI agents access to systems, data, and applications? 

4.       How should organisations across Asia verify an AI agent’s identity and authority? 

5.       Who should be accountable when an AI agent makes a decision or takes an unauthorised action? 

6.       How should CIOs and CISOs in Asia prepare for AI agents becoming part of the enterprise workforce? 

7.       What role does resilience play in the age of autonomous AI agents? 

8.       There are many solutions out there, what should CISOs and CIOs ask when identifying the right approach and solution for their organisation?

Asian enterprises remain prime cyberattack targets, with adversaries increasingly bypassing traditional defences through sophisticated delivery models. From AI-generated phishing to software supply chain poisoning, attackers exploit trusted channels and legitimate services to infiltrate networks. These novel approaches demand a fundamental security strategy shift toward containment and resilience rather than prevention alone.

In this PodChats for FutureCISO, Raghu Nandakumara, Vice President of Industry strategy, Illumio, talks about strategies CISOs and security practitioners will want to consider mitigating trust should it be used as an attack vector.

1.       How should AI governance evolve to address both the risks of using AI tools and the risks of attackers exploiting AI interest?

2.       How would you assess current user training and AI-themed social engineering?

3.       What are the SOC implications of attackers increasingly targeting the software acquisition workflow?

4.       Strategies to mitigate trust as an attack vector
How should enterprises rethink "trust" in software supply chains when legitimate update mechanisms are being compromised?

5.       With AI enabling personalised phishing at machine speed, what role should behavioural controls and containment play where human detection inevitably fails?

6.       How do enterprises defend against a campaign where the malware is old and the delivery method is new?

7.       For Asian organisations where unsanctioned AI adoption is widespread, how can security teams govern what they cannot see?

8.       Does this represent a broader shift in attack patterns that should influence 2027 security investment priorities?

9.       2027 is just around the corner, what is your advice for CISOs as they set in place strategies to mitigate trust as an attack vector, including investment priorities.

As we look toward 2026 and 2027, data centre leaders across Southeast Asia and Hong Kong stand at a critical juncture. Surging AI demand is colliding with power constraints and increasingly divergent regulatory landscapes, as seen in Singapore's high benchmarks and emerging hubs like Thailand and Johor. The challenge has shifted from merely collecting sustainability data to embedding green energy as a strategic differentiator. For CIOs, success now depends on forging partnerships to navigate these complexities, building AI-ready and resilient infrastructure while developing the skilled workforce essential for execution

In this PodChats for FutureCIO, Govind Choudhary, GM of Southeast Asia and India at Digital Realty, shares his perspective on how CIOs are embedding sustainability into AI infrastructure.

1.            What is Digital Realty?

2.            How do you see data centres in Asia addressing the growing gap between sustainability data collection and meaningful action?

3.            How should CIOs, in partnership with data centre operators, navigate the diverging regulatory landscapes across the region?

4.            Given the accelerating use of AI, how should CIOs design and build the right infrastructure for AI workloads while maintaining sustainability?

5.            Do should CIOs, again working with DC operators, address the skilled workforce requirements to execute this strategy?

6.            How should CIOs manage sovereign data requirements while leveraging regional scale?

7.            Any recommendation on how to build resiliency against power constraints and grid instability?

8.            How should CIOs embed sustainability as a competitive differentiator, not just a compliance cost?

9.            Not all DC operators are equal, what is your advice when selecting their operator/partner to address calls for embedding sustainability not just in their AI infrastructure but across all their compute needs – local and international?

Singapore's AI maturity has rebounded, but a critical execution gap threatens to undermine record investments. 

While agentic AI adoption has doubled to 51% in 2026, only 10% have redesigned end-to-end workflows. This "Pacesetter" minority achieves significantly higher ROI, highlighting the difference between buying AI and building an enterprise around it—a lesson for Southeast Asia.

In this PodChats for FutureCIO, Colin Tan, country manager for ServiceNow Singapore, explains to us what the most recent ServiceNow study reveals about agentic AI adoption in Singapore.

Colin, welcome to PodChats for FutureCIO.

1.       Strategy & Ambition: In the ServiceNow study, 68% of organisations cited inadequate data accuracy, access, and management as on-going challenges. How do we modernise our data architecture to provide the clean, connected, and real-time intelligence AI agents need to act reliably at scale?

2.       Infrastructure & Scale: As agentic AI generates exponentially more network traffic and computational demand, is our current infrastructure resilient enough to handle this surge, or are we risking a "digital congestion collapse" that undermines performance and agility?

3.       Workflow Orchestration: While 51% of Singapore enterprises now use agentic AI, only 10% have redesigned end-to-end workflows. How do we shift from automating isolated tasks to orchestrating autonomous, cross-functional workflows that deliver measurable business transformation?

4.       Taming "Agent Sprawl": As autonomous agents proliferate across departments, they risk creating new technical debt and fragmentation. How do we architect a unified control plane to gain visibility, manage permissions, and prevent chaotic, disconnected agent deployments?

5.       Governance & Risk: Governance is the prerequisite for autonomous AI. How do we build a living governance framework that provides continuous oversight, embeds trust and transparency, and ensures accountability before agents operate at scale?

6.       Singapore’s IMDA published the world's first governance framework for agentic AI. How are Singapore enterprises keeping pace with the standard the government has set for the country?

7.       Measuring New Value: As AI shifts from efficiency to revenue creation and new business models, how should we evolve our metrics to accurately capture the value of AI-enabled agility, innovation, and competitive differentiation—not just cost savings?

8.       Lesson from Pacesetters: The ServiceNow study shows that a "Pacesetter" minority, who redesign work around AI, can achieve significantly higher ROI than those that simply layer AI onto existing processes. What can we learn from Pacesetters?

Even as Singapore strengthens its national digital identity with device-bound passkeys to secure the login, the live video session remains a gaping exposure layer. Once authenticated, high-value activities—remote approvals, KYC reviews, and workforce verification—are conducted over mainstream video platforms that rely on trust and manual checks. 

This is dangerously insufficient as deepfake video injection attacks become more capable and affordable. The question for CISOs is no longer just “who logs in,” but “who is actually present in the frame.”

In this PodChats for FutureCISO, Dominic Forrest, chief technology officer at iProov, highlights these trends and solutions to mitigate against the inherent security risks that come with live video sessions.

1.       How would you define the current state of identity and session security in Southeast Asia and Hong Kong, given the rapid digital adoption and escalating AI-driven threats?

2.       Device-bound passkeys effectively secure the login session against phishing. However, once a user is “inside” a live video session, what new exposures emerge that passkeys simply cannot address?

3.       With remote workforce verification and high-value approvals now routine over video, what gaps remain in current manual verification processes? Why are these gaps particularly concerning for CISOs?

4.       How do injection attacks work, and why are they so difficult to detect with traditional verification methods?

5.       How are attackers evolving their techniques, and what makes these attacks especially dangerous for banks and fintechs?

6.       Traditional liveness detection—such as blink checks and smile prompts—is failing against modern AI-generated deepfakes. What newer technologies are emerging to verify genuine human presence in real time during live video interactions?

7.       How can continuous presence assurance at the video layer complement device-bound passkeys and national digital identity schemes, help CISOs build a more layered and resilient defence?

8.       Finally, how are regulators in the region responding to these threats, and what should CISOs be prioritizing on their roadmaps to stay ahead?

Across Southeast Asia and Hong Kong, finance teams are transitioning from ledger-keepers to strategic drivers of business resilience. The imperative for real-time cash visibility clashes with fragmented markets, forcing a move beyond digitisation. Technologies like automation and AI are viewed as essential, with 95% of regional tax and finance leaders prioritising data and AI tools to support innovation and predictive analytics. 

Yet adoption is tempered by concerns over data integrity and the escalating threat of AI-enabled fraud. Singapore lost S$913 million to scams in 2025, recovering only S$140.5 million. 

In the first half of 2026, Hong Kong recorded 20,613 overall deception and fraud cases with total financial losses reaching HK$3.5 billion with investment scams costing victims roughly HK$1.65 billion, nearly half of all monetary damage from fraud during this period.

CFOs are prioritising robust verification controls, with 58% giving equal priority to payment speed and security, yet only 43% rate their ability to deliver both as strong. 

In this episode of PodChats for FutureCFO, Karthik Manimozhi, Global President at Eftsure shares his views on how to drive cash resilience with visibility, velocity, verification.

1.       How can CFOs establish a centralised data architecture and governance framework that ensures data integrity, underpins successful AI deployment, and mitigates the risk of information leakage to third-party vendors? 

2.       In an environment of high economic and environmental volatility, how can CFOs mature their cash flow visibility from a near-real-time snapshot to a predictive, AI-driven forecast that actively models for uncertainty? 

3.       Amidst divergent monetary policies and tariff uncertainty, how can CFOs/finance team leverage AI and automation to strengthen their working capital velocity and accelerate receivables, ensuring liquidity is not trapped or eroded? 

4.       To what extent does current technology infrastructure and partnership with banks enable the "always-on" treasury, essential for managing trapped cash and intra-day liquidity across different time zones? 

5.       As fraud tactics grow more sophisticated, including the rise of deepfakes, how can CFOs move beyond reliance on traditional human verification to establish cryptographic, AI-powered controls that verify identities and payments before they are authorised?

6.       For finance teams operating across multiple jurisdictions in the region, how can they balance the drive for automation with the reality of fragmented local payment rails and complex, evolving regulatory landscapes? 

7.       As the focus of sustainability shifts from branding to bottom-line impact, how should CFOs integrate real-time energy cost data and supply chain carbon exposures into their core treasury and cash flow models? (repeated due to signal problem)

8.       With many firms increasing AI budgets but few reaching advanced capability, what do you recommend as a strategic framework for upskilling finance talent to oversee autonomous AI systems? 

For CIOs in Malaysia and Singapore, 2026-2027 marks a defining reckoning. While 88% of organisations now use AI in some function, the staggering reality is that 84% of pilots never reach production, with 95% delivering zero measurable P&L impact. 

The challenge has decisively shifted from experimentation to industrialisation. Success now hinges on treating AI as an infrastructure investment, not an innovation project. The core obstacles are structural—data quality, system integration, and governance gaps—not model capability. 

Agentic AI compounds the urgency, demanding a "neutral control plane" for orchestration and auditability. The channel ecosystem is stepping in, with partners offering readiness assessments to bridge the deployment gap. 

The 2026 CIO must architect for production-grade resilience, aligning technology with business process redesign and outcome-based economics.

In this PodChats for FutureCIO, Lynn Toh, Senior Director, Advanced Solutions, Tech Data APAC, discusses the key trends impacting CIOs and their organisations as they look to integrate AI into day-to-day operations.

1.       How can CIOs redesign business processes before deploying AI, ensuring we automate the right workflows rather than just digitising inefficiency?

2.       What governance framework and infrastructure are needed to move AI pilots into production, addressing data quality, security, and integration gaps that cause 41% of stalls?

3.       How can CIOs architect a "neutral control plane" to manage agentic AI, ensuring least-privilege access, audit trails, and oversight for autonomous decision-making?

4.       With agentic AI raising the stakes, how should CIOs redesign identity and zero-trust architectures to secure at machine-speed, autonomous actions?

5.       How can CIOs measure success by business outcomes and ROI, moving beyond pilot counts to metrics that justify board-level investment? (may want to rephrase)

6.       How should CIOs evolve pricing and investment models—perhaps towards consumption or outcome-based models—to make scaling AI economically sustainable?

7.       What role can channel partners play in conducting AI readiness assessments and bridging the gap between pilot and production deployment?

8.       What should be the CIO strategy for workforce transformation, building cross-functional buy-in and AI literacy to ensure adoption beyond the pilot team?

9.       Synthesizing everything we’ve covered, what is your advise for CIOs for 2027?

For Southeast Asian CIOs, the window to merely experimenting with AI is fast closing. The imperative now is to industrialise intelligence, moving from proof-of-concept to production-scale agentic systems that deliver tangible business value. 

Yet, as the "token economy" dictates, success hinges on a foundational element: your data platform. The key to controlling costs and ensuring trusted, real-time outcomes lies not in the fragmented data stack that exists in many organisations today, but in a unified architecture that makes retrieval accuracy a competitive advantage. This demands a new strategic focus. 

In this PodChats for FutureCIO, Thorsten Walther, Managing Director, CXO Advisory Asia, MongoDB, shares the most prevalent issues facing CIOs and their enterprises in navigating their AI journey while managing the economics of AI integration and use.

1. As we move from AI experimentation to production, how can we rationalise a fragmented data and retrieval stack to reduce latency and governance risk, particularly given the need to manage highly dynamic, unstructured data?
2. Given that the "token economy" makes retrieval accuracy a direct cost-control lever, how can we implement a unified data platform to improve retrieval quality and reduce expensive LLM retry loops?
3. How do we ensure our data architecture provides the schema flexibility needed for rapid AI iteration, avoiding the rigidity of relational models that slows development and creates technical debt?
4. With the rise of agentic AI, how can we architect a system for "agent memory"—blending short and long-term context—that allows agents to act on the current state of data, not stale copies?
5. How can we improve retrieval accuracy by natively combining semantic understanding with precise keyword search, while also using reranking to refine results, without adding external systems that create sync delays?
6. For regulated enterprises, how can we bring these production-grade AI retrieval capabilities inside our compliance framework, avoiding the choice between innovation and data sovereignty?
7. What is our strategy to move beyond the complexity of managing separate databases, search engines, and vector stores to a single, unified platform that reduces operational overhead?
8. How do we build a flexible, "production-ready" data foundation that allows us to pivot quickly as model providers and agent frameworks evolve, without being locked into a rigid stack?
9. How can we best equip our developer and agentic workflows with the necessary skills and best practices to avoid common pitfalls like over-normalisation, ensuring agents build on a robust data model?
10. With a significant focus on the ASEAN market, how can we leverage local partnerships and expertise to accelerate our AI modernisation journey and address specific regional regulatory and data challenges?

A 2026 Wolters Kluwer report reveals that a striking 83% of APAC CFOs see AI adoption as a key force reshaping finance, while 72% believe its impact will be significant within three years. As understanding of what AI do for finance teams, we are starting to see the adoption narrative move from a discretionary "innovation project" to a necessary part of the governance and controls framework—a language CFOs and compliance officers understand intimately. 

To be clear, anxieties about moving fast (in the adoption journey) remain persistent as is maintaining trust, a theme echoed in the Deloitte survey which found CFOs reinforcing fundamentals and cost discipline even as they invest in AI.

In this PodChats for FutureCFO, Nikhil Parambath, Regional Vice President for Asia at BlackLine, offers some insight into how CFOs and the finance leadership can finetune their adoption strategies as AI moves from a nice to have to a compliance imperative.

Nikhil, welcome back to PodChats for FutureCFO.

1.       Across Asia, CFOs are being asked to close faster and support real-time decisions, yet many close processes remain stitched together with spreadsheets and manual workarounds. Where are finance teams in the region still most vulnerable to this "spreadsheet dependence," and what specific risks does this create for a CFO's ability to 'trust the numbers' in a volatile environment? 

2.       BlackLine uses the term "self-driving close." In business terms, what does this operating model look like in practice, and what are the biggest misconceptions finance leaders in Southeast and Northeast Asia have about it? 

3.       As agentic AI evolves from copilots to autonomous actors, which specific close activities—such as reconciliations, journal entries, intercompany matching, and variance analysis—are the safest and most impactful to automate first, giving finance teams the fastest return on confidence and efficiency? 

4.       Agentic AI is only as good as the data it operates on. Before a CFO can confidently let parts of the close run on "autopilot," what critical data, process, and control foundations need to be in place to ensure governance, security, and an auditable chain of trust? Foundational readiness

5.       Controllable autonomy As the system starts handling the "heavy lifting" of routine tasks, the finance professional's role is shifting from processor to validator and strategist. How do you see the role and skillset of finance teams evolving over the next 2-3 years, and how should CFOs prepare their people for this transition to an advisory role? 

6.       In a region marked by rapid digitalization yet persistent skills gaps, what are the key implementation challenges for CFOs in places like Singapore, Hong Kong, and Japan who are trying to scale AI-led finance? 

7.       As AI agents become more autonomous, questions of accountability arise. How can CFOs adapt their internal controls and compliance frameworks to effectively "govern" AI, ensuring the autonomous close meets regulatory standards? 

8.       Finally, how does achieving a "self-driving close" free the CFO's office to focus on what matters most—such as strategic analysis, partnering with the business, and steering the organization through volatility?