Insights

How AI-driven SOCs are transforming autonomous threat management across Southeast Asia

Subra Mani (Mani), Regional Sales Director, UST Singapore

Amar Chhajer is a senior leader at UST focused on AI-driven transformation and enterprise resilience across Asia-Pacific.

There is a number that every CISO in Southeast Asia should have in front of them: 194 days. That is the global industry average time to identify a breach when human analysts are working without AI assistance, according to IBM's Cost of a Data Breach Report. Against that, Darktrace reports that its autonomous AI responds to active threats within seconds, with autonomous investigations that once took hours completed in under a minute.

That gap, 194 days versus seconds, is not a technology gap. It is a survival gap. And it is the reason AI-driven Security Operations Centers are moving from a conversation about the future to a procurement line on this year's security budget.

Across Malaysia, Singapore, Indonesia, Thailand, and the Philippines, enterprise security teams are being asked to protect rapidly expanding attack surfaces, cloud workloads, APIs, distributed endpoints, OT systems, with headcounts that were never designed to handle this volume. The math has broken down. Manual SOC operations, however well-staffed, cannot process the alert volumes modern infrastructure generates.

DIVIDER

Why traditional SOCs are failing Southeast Asian enterprises

Traditional SOCs were built for a different threat environment. They assumed human analysts could read, triage, and respond to alerts within manageable timeframes. That assumption no longer holds.

In Southeast Asia specifically, the pressure is compounding.

1. According to Tenable's 2025 Cloud Security Risk Report, 70% of AI cloud workloads across AWS, Azure, and GCP contain at least one unremediated critical vulnerability — a significantly higher rate than the 50% seen in non-AI workloads. Tenable specifically flags growing risk for businesses in Singapore and Southeast Asia as AI adoption accelerates.
2. Daily attack volumes targeting Philippine businesses surged to 8,800 per day in 2025 — more than five times the prior year's rate, according to ITG Group.
3. Globally, AI-fueled cyber attacks surged 70% since 2023, with organizations facing an average of 1,968 attacks per week in 2025, per Check Point's 2026 Cyber Security Report.

The traditional SOC model was not built for this. The AI-driven SOC was.

DIVIDER

What an AI-driven SOC actually does, and how it differs

An AI-driven SOC does not simply automate the work a human analyst would do more slowly. It redefines what the SOC does, and at what layer of the threat lifecycle it intervenes.

The key shift is from reactive triage to autonomous threat management across the full cycle: detect, investigate, contain, remediate, and recover. Gartner's March 2026 Cybersecurity Predictions forecast that AI applications will drive 50% of cybersecurity incident response efforts by 2028, up from a fraction of that today, as AI-driven SOC capabilities mature from pilot to production.

AI-driven behavioral analytics platforms detect up to 95% of insider threats and unknown malware variants that signature-based tools miss entirely, per research compiled by Practical DevSecOps. Traditional detection is rule-based; it recognizes known attack patterns. AI-native detection is behavioral; it identifies anomalies that have no known signature.

This matters enormously in the current threat landscape. IBM X-Force's 2026 Threat Intelligence Index found that supply chain incidents increased nearly fourfold over five years, while ransomware groups surged 49% year-on-year as AI lowers barriers to attack. These attack types are specifically designed to evade signature-based detection. They require behavioral, context-aware AI to catch.

Gartner's AI cybersecurity spending forecast (Q4 2025) projects AI cybersecurity growing at a 73.9% CAGR, from $26 billion today to $172 billion by 2029. McKinsey's research on AI-powered security operations indicates that response time to security incidents can be reduced by at least 40%, lowering the financial impact of those incidents.

DIVIDER

The talent shortage that makes autonomous threat management essential

The global cybersecurity talent gap grew from 3.4 million unfilled positions in 2022 to 4.8 million in 2024, a 19% year-on-year increase. The workforce itself has held essentially flat at 5.5 million while demand outpaced supply.

In Malaysia alone, Fortinet's regional Senior Director Peerapong Jongvibool has cited data showing just 16,765 cybersecurity personnel as of mid-2024, against a projected requirement of 26,430 by end-2025 and 28,068 by 2026. Malaysia's government response: the Cyber Security Academy launched in 2025 reflects how seriously this gap is being taken at national level. But training pipelines take years to close a gap measured in tens of thousands of skilled roles.

The financial consequences of understaffing a security team are not theoretical. They show up directly in breach costs, remediation timelines, and regulatory exposure. What compounds the problem is that most organizations deploying AI-driven security have not yet built the governance infrastructure to manage it. Autonomous systems making containment decisions without documented authority chains, audit trails, or escalation protocols create a different category of risk, one that regulators in Malaysia, Singapore, and across ASEAN are increasingly focused on.

Autonomous threat management does not eliminate the need for cybersecurity professionals. What it does is change the ratio. Instead of five analysts manually triaging 4,000 alerts a day, two analysts supervise an autonomous system that has already resolved 96% of those alerts and escalated only the genuine positives. This is how organizations in Southeast Asia bridge the gap, not by finding people who do not exist, but by making the people they have dramatically more effective.

UST's work on AI-driven enterprise resilience across the APAC region reflects this directly. The goal is always augmentation, not replacement. See UST's cloud infrastructure and security practice

DIVIDER

Three capabilities defining next-generation cyber defense in ASEAN

1. Autonomous threat detection and behavioral baselining

AI-native SOCs build continuous behavioral baselines for every user, device, and process on the network. Deviations from baseline: unusual login times, abnormal data volumes, lateral movement between systems are flagged and investigated autonomously, often before human analysts are even aware of the anomaly. This is the layer at which AI closes the 194-day detection gap. Darktrace's autonomous response does not wait for human handoff; its self-learning AI acts at machine speed, resolving in seconds what previously required hours of analyst investigation.

2. Agentic AI for end-to-end incident response

The next evolution beyond detection is autonomous response: AI agents that do not just flag an incident but contain it. In 2026, agentic AI SOC capabilities, systems that can reason across multiple data sources, execute containment actions, initiate patch management, and coordinate cross-team responses without human handoffs at each step are moving from pilot to production in enterprises across Singapore and Malaysia. The Sagetap Cybersecurity Report, covering 264 security leader decisions across verified enterprise buying activity in H2 2025, identifies automated SOC triage and AI-driven incident response as the highest-adoption investment category, with 40% AI adoption across threat detection and response initiatives.

Explore how CyberProof's AI-native MXDR platform operationalizes this at enterprise scale.

3. Continuous threat intelligence and predictive modelling

Beyond responding to active attacks, AI-driven SOCs consume global threat intelligence feeds, correlate them with the organization’s own environment, and generate predictive models of likely attack vectors before they activate. This moves security from a reactive to a pre-emptive posture; the difference between repairing after an incident and preventing one.

DIVIDER

The human oversight question: AI autonomy versus accountability

It would be a mistake to conclude from all of this that the future SOC is a lights-out, fully automated operation with no human involvement. That is not how responsible AI deployment works, and it is not what the best-performing enterprise security teams are building.

AI autonomy in the SOC is about removing humans from the operational loop on routine, high-volume, low-complexity decisions: alert triage, known-pattern response, containment of isolated anomalies. It is not about removing human judgment from strategic decisions, novel attack scenarios, regulatory accountability, or cross-functional crisis response. Those decisions require human expertise, human authority, and human accountability.

The governance question matters particularly in the ASEAN regulatory environment, where data localization requirements, national cybersecurity frameworks, and sector-specific compliance obligations vary significantly by market. Malaysia's Cyber Security Act 2024, Singapore's Cybersecurity Act and its ongoing revisions, and Indonesia's evolving data protection landscape all create obligations that autonomous systems must be configured to respect, and that human security leaders must be able to audit and demonstrate. Enterprises building AI-driven SOCs without governance infrastructure are creating a different category of risk, one that regulators are increasingly focused on.

Read more about UST's approach to responsible AI in enterprise security.

DIVIDER

What CISOs in Southeast Asia should do now

The move toward AI-driven, autonomous threat management is not a project for next year's budget cycle. The threat environment is not waiting. Here is where to focus:

4. Audit your baseline metrics. Your SOC's mean time to detect (MTTD) and mean time to respond (MTTR) are your starting point. Any AI investment should be measured against real improvements in these numbers, not against technology adoption rate.
5. Identify the triage bottlenecks. Where do your analysts spend the most time on repetitive, low-value alert processing? That is your first automation target. This is where enterprise investment is concentrating.
6. Evaluate AI governance readiness. Who has authority to approve an automated containment action? How are false positives logged and audited? These questions need answers before deployment, not after an incident.
7. Build for ASEAN regulatory specificity. AI-driven SOC tools configured for the US or EU regulatory environment will not automatically satisfy Malaysia's Cyber Security Act, Singapore's MAS guidelines on technology risk, or Thailand's PDPA requirements. Configuration, localization, and audit trail requirements need to be built in from the start.
8. Partner with teams that have done this at scale. The implementation gap, between knowing that AI-driven SOCs are necessary and actually deploying one that works, is where most enterprise security transformations stall.

There is a number that every CISO in Southeast Asia should have in front of them: 194 days. That is the global industry average time to identify a breach when human analysts are working without AI assistance, according to IBM's Cost of a Data Breach Report. Against that, Darktrace reports that its autonomous AI responds to active threats within seconds, with autonomous investigations that once took hours completed in under a minute.

That gap, 194 days versus seconds, is not a technology gap. It is a survival gap. And it is the reason AI-driven Security Operations Centers are moving from a conversation about the future to a procurement line on this year's security budget.

Across Malaysia, Singapore, Indonesia, Thailand, and the Philippines, enterprise security teams are being asked to protect rapidly expanding attack surfaces, cloud workloads, APIs, distributed endpoints, OT systems, with headcounts that were never designed to handle this volume. The math has broken down. Manual SOC operations, however well-staffed, cannot process the alert volumes modern infrastructure generates.

DIVIDER

Frequently asked questions about AI-driven SOCs

What is an AI-driven SOC?

An AI-driven Security Operations Centre uses machine learning, behavioral analytics, and increasingly autonomous AI agents to detect, investigate, and respond to cyber threats with significantly less human intervention than a traditional SOC. The key difference from rule-based automation is that AI-driven systems identify unknown and novel threats — not just known attack signatures.

How does autonomous threat management differ from standard SOC automation?

Standard SOC automation executes pre-scripted responses to known threat patterns. Autonomous threat management means an AI system can reason across novel inputs, make triage decisions on previously unseen attacks, initiate containment without a human approval at each step, and adapt its behavior based on real-time threat context. The scope of autonomous action is what distinguishes them.

Is the cybersecurity talent shortage in Malaysia and Southeast Asia improving?

Not at the pace required. ISC2's Cybersecurity Workforce Study puts the global talent gap at 4.8 million unfilled roles, up from 3.4 million in 2022 — a 19% year-on-year increase. Malaysia had approximately 16,765 cybersecurity professionals as of mid-2024 against a projected need of over 26,000 by end-2025. Government initiatives like Malaysia's Cyber Security Academy are steps in the right direction, but the structural gap will persist through the rest of this decade.

Can AI-driven SOCs replace human cybersecurity analysts?

No. AI-driven SOCs change the role of the human analyst rather than eliminating it. Routine triage, alert processing, and known-pattern response are automated. Human analysts focus on strategic threat assessment, novel attack investigation, regulatory accountability, and the decisions that require human judgment and authority. The ratio of human oversight to automated action shifts, but the human remains essential.

What should enterprises consider before deploying an AI-driven SOC?

Three things are critical before deployment: governance (who authorizes autonomous actions and how are they audited), regulatory fit (does the configuration satisfy your specific market's data and security compliance requirements), and baseline measurement (do you have clear MTTD/MTTR metrics to measure improvement against). AI-driven SOC deployment without these foundations creates new risks while attempting to reduce old ones.

How is UST helping enterprises in Southeast Asia with AI-driven cybersecurity?

UST works with enterprise clients across Malaysia, Singapore, and wider ASEAN on AI-driven security transformation through its cloud infrastructure and security practice and its cybersecurity division CyberProof. This includes MXDR deployment, AI governance frameworks, and SOC capability maturity assessments. Contact the UST Malaysia team to start the conversation.

Related reading

• From automation to augmentation: The human-centric AI journey in Asia-Pacific
• UST Cloud Infrastructure and Security Services
• CyberProof Managed Extended Detection and Response (MXDR)