Zero Trust in a Constantly Evolving Threat Landscape: Why Password Security is Critical for APAC Enterprises

By Takanori Nishiyama

Cybersecurity is a Business Priority

Cybersecurity is no longer a concern reserved for IT teams—it has become a boardroom issue. As digital transformation accelerates across Asia Pacific, organizations are adopting hybrid work models, cloud infrastructure, and remote access technologies at an unprecedented pace. These advances bring agility and growth but also expand the attack surface.

From targeted phishing campaigns to ransomware attacks on municipalities and small businesses, the cyber threat landscape in Asia Pacific is increasingly aggressive and complex. Yet, amid this rapid evolution, one factor remains strikingly consistent: credential compromise continues to serve as the entry point for the majority of successful attacks.

The High Cost of Compromised Credentials

According to the Verizon 2024 Data Breach Investigations Report, more than 60% of breaches involved stolen or compromised credentials, surpassing phishing, vulnerability exploitation, and other attack vectors.

This statistic highlights a critical truth: credentials, whether passwords, secrets, or passkeys, are among the most targeted and abused assets in the modern enterprise. In Asia Pacific, where complex supply chains, legacy systems, and internal silos are common, the risk of credential abuse is magnified.

Common user behaviors, such as password reuse, storing credentials in unsecured files, or sharing them through email or chat apps, expose businesses to significant vulnerabilities. These practices point not just to technical gaps, but to cultural and procedural weaknesses in security governance.

From Risk to Action: Strengthening Identity Security

To reduce the attack surface, organizations must shift their cybersecurity strategy from traditional perimeter defenses to zero-trust security. This means organizations should operate on the principle of “never trust, always verify,” securing every login, every privileged action, and every credential, regardless of user location or device.

This is where privileged access management (PAM) plays a vital role. Rather than treating all users equally, PAM ensures that only the right individuals can access sensitive systems, and only under the right conditions.

Introducing a Modern Approach to Privileged Access Management

Modern PAM solutions are designed to address the limitations of traditional access control systems. While legacy PAM platforms often require large budgets, complex deployments, and lengthy onboarding, today’s cloud-based solutions are:

• Fast to deploy: measured in days, not months
• Simple to use: intuitive interfaces that minimize training requirements
• Cost-effective: accessible to SMBs as well as large enterprises
• Comprehensive: managing credentials, secrets, and remote access from a single platform

For businesses, this means increased resilience without increased complexity.

Bridging Today’s Risks with Tomorrow’s Authentication

We are seeing growing interest in passwordless authentication technologies like biometrics and passkeys throughout Asia Pacific. However, for many organizations, especially in manufacturing, public services, and logistics, traditional credentials are still the norm due to legacy systems and infrastructure.

For example, the passwordless market in Japan is expected to grow significantly, with projections estimating it will reach approximately USD 2.06 billion by 2030 (CAGR: 18.7%). Yet adoption remains gradual. Many users still rely on insecure password practices, which reinforces the need for stronger password management and cultural change before passwordless can become the standard.

Rather than jumping directly to passwordless, forward-thinking organizations are bridging the gap with modern access management solutions. These platforms enforce strong password hygiene, enable secure credential sharing, and prepare the organization for a passwordless future on their own terms and timeline.

From the Network to the Identity Perimeter

The old cybersecurity model focused on fortifying the network perimeter. Today, the new perimeter is identity.

Every identity, human or machine, must be verified, monitored, and continuously validated. The zero trust model assumes that no user or device is inherently trusted. Least privilege is a security principle where a user or process is granted only the minimum permissions and access rights necessary to perform their job duties. And zero-knowledge encryption ensures that even service providers cannot view customer data.

These principles are not only global best practices—they are strategic imperatives for organizations facing rising regulatory expectations and an increasingly digitized customer base.

Taking the First Step

Securing credentials is the foundation of any effective cybersecurity program. By adopting a modern, cloud-based PAM solution, businesses in Asia Pacific can strengthen their defenses, streamline compliance, and protect their most valuable digital assets without overburdening their teams.

In a threat landscape where identity is the battleground, protecting credentials, managing privileges, and planning for a passwordless future are no longer optional—they are essential.

The author is the Senior Vice President of APAC & Japan Country Manager of Keeper Security.