Are Asian enterprises advancing AI too fast without a resilience strategy in place?

According to IDC, AI spending across Asia Pacific continues to rise at a rapid compound annual growth rate of 33.6 percent from 2023 to 2028, with the regional market projected to reach US$175 billion by 2028. 

While the uptake sounds positive, a serious question remains about the unforeseen consequences from the risks of not securing adequate guardrails. Many companies adopting AI are facing new operational and security pressures as they continue to add autonomous tools without making equivalent changes to oversight and recovery planning. 

Commvault studies have also found that AI deployment is moving ahead faster than the internal processes designed to assess risk, accountability and policy compliance, and significantly exposing weaknesses in governance before AI systems are put into use. 

Another brutal reality is that many organisations are continuing to do so in a degraded or limited operating state, underlining how resilience planning falls short once an attack or system failure affects their core business. 

There is now a narrowing window to respond to threats as AI changes the pace of exposure. How existential is the threat to organisations? How best can we scale this governance gap? What steps should you take when your organisation is compromised today?  

iTNews Asia gets down to brass tacks on these tough issues with Gareth Russell, Field Chief Technology Officer, Security, APAC, Commvault, as well as learn about strategies APAC enterprises can take to recover. 

iTNews Asia: We are seeing AI being embedded into enterprise operations, from employee workflows to automated decision-making. Often, organisations are rushing to deploy AI - including generative AI and agentic AI. In doing so, what new security risks do you think are being created? 

It starts with the data. AI introduces new risks while amplifying familiar challenges around identity, access and resilience. Generative AI can expose organisations to threats such as prompt injection and data poisoning, while agentic AI raises the stakes because it can make decisions and take actions across business systems. 

The answer is not to fear AI or slow innovation, but to understand how the risk landscape is changing. Organisations need to protect data integrity, tightly govern agent identities and permissions, monitor activity, and ensure they can recover from trusted data. If AI becomes part of how the business operates, it must also become part of how the business protects and recovers. 

iTNews Asia: What does cyber resilience needs to cover in 2026?  Why should APAC organisations treat recovery as a continuous operating capability, rather than something activated only after an incident? 

Cyber resilience in 2026 must extend beyond traditional backup. Organisations need to recover the applications, identities, infrastructure and trusted data required to keep critical services operating. As AI becomes increasingly embedded into work processes, the dependencies that businesses rely on are also becoming more complex. 

iTNews Asia: Why should APAC organisations treat recovery as a continuous operating capability, rather than something activated only after an incident? 

There is a significant gap between what organisations expect and what they can actually achieve. Our State of Data Resilience Asia 2026 study found that 81 per cent of Asian organisations expect to be operational within five days, whereas the average time required to recover to even a minimal level of operation is 28 days.  

Recovery therefore needs to be a priority before an attack happens. Dependencies across critical services and functions need to be understood and tested in advance. This is where Recovery Operations (ResOps) comes into place. Organisations should adopt an always on approach to resilience: treating recovery, cyber response and data protection as continuous, integrated functions rather than emergency measures. 

iTNews Asia: In a recent finding by KENSAI Cybersecurity, AI-powered ransomware attacks are deemed as 73 percent more likely to be successful than traditional variants, with dwell times reduced from an average 9 days to just 47 hours. This is enabling faster and more precise intrusions AI-enabled ransomware, which continuously modifies its code and behaviour patterns, rendering many previous detection methods ineffective.  

Given this scenario, and the velocity of AI-attacks we are seeing today, how can organisations be better insulated? 

AI has fundamentally changed the rules of the game. Attackers are no longer operating at human speed. They're operating at machine speed, with the average breakout time falling to just 29 minutes. This means organisations now have less than half an hour between initial compromise and an attacker moving laterally through their environment. At the same time, AI-enabled ransomware can adapt its behaviour in real time, making traditional detection-led approaches increasingly unreliable. 

The reality is that organisations cannot stop every attack. The question is no longer, "How do we prevent compromise?" It’s "How do we continue operating when compromise occurs?" 

As such, the focus needs to shift from preventing compromise to limiting impact. That means strengthening identity controls, segmenting critical systems, maintaining isolated and immutable recovery environments, and using AI-driven automation to detect, contain, and recover from threats at machine speed. 

iTNews Asia: When a ransomware attack disrupts operations, how should leaders decide which systems, data and processes must be restored first? 

The worst time to decide what to recover is during a ransomware attack. Resilience should be built into the design of the business long before an incident.  

Organisations need to define their Minimum Viable Company (MVC), the minimum set of services, applications, data, identities and processes required to keep the business operating. Just as importantly, that MVC needs to be continuously tested and refined as business priorities, technology environments and dependencies evolve.  

This is not a one-time exercise. It's an ongoing discipline. Leaders should start by asking a simple question: What absolutely must continue operating if everything else is unavailable? The answer differs for every organisation.  

Ultimately, resilience isn't about recovering everything. It's about recovering what matters most, first. Organisations that understand and regularly test their MVC will make faster decisions, recover more effectively, and be far better positioned to withstand disruption. 

iTNews Asia: What factors should enterprises weigh across containment, recovery, legal obligations, communications and business continuity?  

Cyber recovery cannot be treated as a technical exercise. The moment a ransomware attack disrupts operations, it becomes a business continuity issue. 

The first priority is containment: stop the spread, isolate compromised systems and identities, and determine what can still be trusted. From there, the focus should shift to clean recovery, not simply fast recovery. Restoring compromised systems quickly only increases risk and can prolong the disruption. 

At the same time, organisations need to manage legal obligations, regulatory notifications, customer communications and operational continuity. These decisions must happen in parallel, not in sequence, which is why legal, communications, risk and business leaders should be involved from the outset. 

iTNews Asia: What practical steps can they take? 

The practical step organisations can take today is to define decision-making responsibilities before an incident occurs. Who declares a recovery event? Who determines what gets restored first? What evidence is required before systems are trusted again? These questions should never be answered in the middle of a crisis. 

Ultimately, the organisations that recover most effectively are not those with the best technology. They are the ones that have consistently tested their response, established clear governance, and know exactly how to restore critical business services safely and with confidence. 

iTNews Asia: What are the common gaps organisations often only discover after a cyber incident, and how can they address these before an attack happens? 

One of the most common gaps organisations discover after a cyber incident is that recovery is far more complex than anticipated. 

Many assume their backups are clean, their recovery environments are trustworthy, and their recovery objectives are achievable. Those assumptions are often challenged for the first time during an incident. Organisations may discover compromised recovery points, hidden dependencies, or that critical services cannot be restored as quickly as expected. Recovery becomes even more complicated when attackers retain persistence within the environment. 

Another common misconception is that paying a ransom that paying a ransom guarantees a successful outcome. In reality, recovery is rarely that straightforward. Our State of Data Resilience research found that four out of 10 organisations pay the ransom following an attack, nearly one-third of those who paid said the outcome still failed because data was not returned or they were attacked again. 

The organisations that recover most effectively are the ones that replace assumptions with evidence. They continuously validate recovery points, prove they can restore critical services, and establish confidence that they can recover to a trusted state before a crisis occurs. The biggest resilience gap isn't backup. It's believing recovery will work exactly as expected when it's needed most. 

- Gareth Russell, Field Chief Technology Officer, Security, APAC, Commvault

 

iTNews Asia: You spoke about a Minimum Viable Company (MVC) earlier. Can you explain what the concept means, and why it is becoming more relevant as organisations become more dependent on AI-driven operations? 

A useful way to think about a Minimum Viable Company (MVC) is: if my organisation suffered a major cyberattack tomorrow, what are the key services that absolutely must keep running? For a bank, it might be processing transactions. For a hospital, it might be clinical systems. For a manufacturer, it could be keeping production moving. Every organisation is different, but the principle is the same: identify what keeps the business alive. 

MVC is becoming more relevant because organisations are becoming increasingly dependent on technology, data, AI and automation. When disruption occurs, recovering everything at once is unrealistic. The organisations that recover fastest are the ones that have already decided what matters most and what can wait. Those that recover fastest are not necessarily the ones with the most technology. They're the ones that know exactly what matters most to the business. 

iTNews Asia: How can organisations test whether their recovery plans will work under real-world pressure, especially when business data is growing faster and becoming more distributed?  

The key is to stop treating recovery testing as a compliance exercise and start treating it as a measure of operational readiness. Most organisations know their data is growing. What they often don't know is whether their recovery capability is keeping pace with that growth. As applications become more distributed and business dependencies become more complex, the challenge shifts from restoring data to restoring operations. 

That's why recovery plans need to be tested in conditions that reflect reality, not ideal scenarios. Commvault's hands-on simulations, such as “Minutes to Meltdown” helps organisations understand how quickly disruption can spread when critical systems fail, while ‘Minutes to Recovery” challenges teams to prove they can restore business services under pressure. Cleanroom Recovery adds another layer by allowing organisations to validate recovery in an isolated environment before bringing production systems back online. 

iTNews Asia: Do we need to move towards more dynamic, risk‑driven defense strategies to stay ahead of the cyberthreat actors today? 

Ultimately, resilience needs to become a continuous discipline. As technology environments evolve, recovery priorities, critical dependencies and business risk analysis must adapt with them.