Businesses in the Philippines should restrict employees’ access to systems and information to only what their jobs require to help reduce cybersecurity risks, an expert said.
The approach, known as the principle of least privilege, helps limit the damage that could result from compromised employee accounts.
Arun Kumar, regional vice president of Zoho Corporation’s enterprise information technology (IT) management division in India, said organizations should divide their networks into smaller, separately protected sections to help prevent a cyberattack from spreading. The practice is called network microsegmentation.
“Let employees have access to only what they are supposed to do and also bring some of the best practices like strong password policies, multi-factor authentication,” Kumar said in an interview with PhilSTAR Tech.
He opined that organizations should observe visibility across their entire digital infrastructure, including employee devices, user identities, cloud services, and on-premises systems.
This would allow IT and security teams to monitor who has access to sensitive information and whether users have permissions beyond their responsibilities.
The 2024 report of the International Trade Administration said the Philippine cybersecurity market is projected to reach $387.10 million by 2028, accounting for 13 percent increase.
In a 2023 survey of 100 companies, at least one in four reported exposure to cyberattacks, including malware, phishing, and password-related breaches.
“Awareness is not just finding a malicious file or a phishing email. It is also about reporting to the right authorities within the organization,” Kumar said.
“Organizations, at the end of the day, have to give clear clarity to their internal employees on where they should first go and report to,” he added.
Kumar said companies should assign personnel to handle incident reports, coordinate with authorities, notify affected customers and determine how a breach occurred.
The findings of the 2026 cybersecurity report also reveal that 39 percent of organizations experienced cybersecurity risks associated with AI agents.
While IT teams serve as the primary approvers of AI agents, plug-ins, and connectors, security teams take on the role in only 6 percent of organizations.
This disparity, Kumar said, raised concerns about whether cybersecurity considerations are sufficiently integrated into AI adoption, as agentic AI agents can connect to applications, use application programming interfaces and carry out tasks with varying degrees of autonomy.
The expert warned that mistakes or manipulation in complex AI environments could disrupt business operations if organizations lack adequate safeguards and recovery mechanisms.
Risks posed by shadow AI
Kumar also warned against security risks posed by unauthorized artificial intelligence tools, also known as shadow AI
Shadow AI occurs when employees use personal accounts on publicly available AI platforms to process company information without the organization’s knowledge or oversight.
He distinguished shadow AI from enterprise AI systems, which organizations adopt through formal agreements and governance policies that establish how data may be used and protected.
“Shadow AI creates the challenge for IT organizations because this doesn’t fall under the IT infrastructure or IT security or under their purview,” Kumar said in an interview with Philstar Tech.
He said businesses should establish clear policies governing which AI applications employees may use and what information they can enter into these tools.
A 2026 cybersecurity report titled “From Deepfakes to Double Agents: The New Face of AI-Driven Cyber Risk” found that around 77 percent of respondents said an AI agent or tool had acted on malicious, misleading, or unauthorized instructions or content in the past year.
Among affected organizations, the most common incidents involved AI tools processing or acting on malicious emails or messages, which accounted for 42 percent, while attackers using AI in phishing or social engineering attempts accounted for 41 percent.
