Cisco: Only 6% of PH Firms Cyber Ready in 2025

Only 6 percent of organizations in the Philippines have reached a mature level of cybersecurity readiness, according to Cisco’s 2025 Cybersecurity Readiness Index released Tuesday, signaling continued vulnerability in an increasingly AI-driven threat landscape.

The report, based on a global double-blind survey of 8,000 business and security leaders, found that cybersecurity preparedness in the Philippines remains low despite a five-percentage-point increase from just 1 percent last year.

Cisco’s index measures readiness across five key pillars—Identity Intelligence, Network Resilience, Machine Trustworthiness, Cloud Reinforcement, and AI Fortification—categorizing firms as Beginner, Formative, Progressive, or Mature based on their deployment of 31 security capabilities.

“AI opens up new possibilities but also adds complexity to an already challenging security landscape,” said Zaza Soriano-Nicart, managing director of Cisco Philippines.

“Over the past year, we have seen companies worldwide, including those in the Philippines, continue to grapple with evolving threats like the rise of shadow AI, talent shortages, and complex security infrastructures,” Nicart added.

Cisco found that 85 percent of organizations in the Philippines experienced AI-related security incidents last year, while only 71 percent of respondents believed their employees fully understood AI-related threats.

Just 59 percent said their teams grasped how malicious actors exploit AI to launch more sophisticated attacks, revealing a critical awareness gap.

“As AI transforms the enterprise, we are dealing with an entirely new class of risks at unprecedented scale—putting even more pressure on our infrastructure and those who defend it,” said Jeetu Patel, Cisco’s chief product officer.

The report also showed that more than half of organizations in the Philippines (54 percent) suffered cyberattacks in the past year, many of them hindered by fragmented security frameworks involving more than 10 separate point solutions.

Despite these threats, only 49 percent of firms allocate more than 10 percent of their IT budgets to cybersecurity—down 13 percent from the previous year.

Meanwhile, 75 percent of respondents anticipate business disruptions due to cyber incidents in the next 12 to 24 months.

Among the top external concerns are attacks from malicious actors and state-affiliated groups, which 54 percent of Philippine organizations ranked as more pressing than internal threats (46 percent).

AI is being widely used for cyber defense, with 93 percent of respondents leveraging it to understand threats better, 84 percent using it for detection, and another 84 percent for response and recovery.

Yet challenges persist with GenAI use: 57 percent of employees in the Philippines reportedly use approved third-party GenAI tools, while 20 percent have unrestricted access to public tools and 52 percent of IT teams are unaware of this activity.

Shadow AI, or unregulated AI deployments, remains a major risk, with 57 percent of organizations lacking confidence in detecting such threats.

Compounding the risks, 92 percent of firms reported increased vulnerabilities due to unmanaged devices connected to networks under hybrid work setups.

The cybersecurity talent gap is also a major bottleneck, with 90 percent of firms struggling to fill roles and 52 percent reporting more than ten unfilled cybersecurity positions.

“Organizations must rethink their strategies now or risk becoming irrelevant in the AI era,” Patel warned, emphasizing the need for simplified security systems, greater AI awareness, and stronger investments in infrastructure.

Cisco said 98 percent of Philippine firms plan to upgrade their infrastructure, but without deeper investments in cybersecurity and strategic AI deployment, many will remain exposed to escalating risks.