Retail industry sees most cyber incidents in APAC due to lack of cybersecurity budget
19% of companies in the region have experienced cyber incidents due to insufficient cybersecurity investment in the last two years. When it comes to companies’ finances, nearly one-in-five (16%) admit they do not have the budget for adequate cybersecurity measures.
According to a recent study by Kaspersky, globally, critical infrastructure, oil & gas and energy organizations suffered the biggest number of cyber incidents due to improper budget allocation (25%). In Asia Pacific, however, the retail industry experienced the greatest number of successful cyberattacks in the past 24 months.
The latest survey also revealed 19% of companies in the region have experienced cyber incidents due to insufficient cybersecurity investment in the last two years. When it comes to companies’ finances, nearly one-in-five (16%) admit they do not have the budget for adequate cybersecurity measures.
Kaspersky conducted a study to discover the opinions of IT Security professionals working for SMEs and enterprises worldwide regarding the human impact on the cybersecurity in a company. The research – aimed at gathering information on various groups of people who influence cybersecurity – considered both internal staff, and external contractors. It also analyzed the impact decision makers have on cybersecurity in terms of budget allocation. A total of 234 respondents from APAC were surveyed.
Insufficient distribution of budget for cybersecurity led 19% of Asian companies to endure cyber incidents in the last two years.
The situation is different for every industry. For example, retail organizations suffered the greatest number of cyber breaches because of the lack of budget (37%), followed by telecommunication companies (33%) and critical infrastructure, energy, oil and gas sector (23%).
“E-commerce is expected to be a 2.05 trillion USD market in Asia Pacific towards the end of 2023. Retail being the industry which suffered most cyber incidents here makes sense as cybercriminals follow the money trail. These companies are part of the greater digitalization movement in the region and hold treasure troves of data, specifically financial ones,” comments Adrian Hia, Managing Director for Asia Pacific at Kaspersky.
“Our recent study proves that threat actors know which company to target. They know the data they want and where to get them. I encourage all industries in APAC, especially those that handle critical information, to allot a better cybersecurity budget to ensure the safety of their businesses, and most importantly, of their customers’ sensitive data,” he added.
Meanwhile, some industries showed a smaller number of cyber incidents. Manufacturing industry suffered 11% of cyber incidents due to budget constraints, while transport & logistics saw 9% of them.
When asked about the budget for cybersecurity measures, a majority (83%) of respondents from APAC said they are equipped to keep up with or even stay ahead of new threats. However, 16% of companies are not doing so well – 15% report that they don’t have sufficient funds to protect the company’s infrastructure properly.
At the same time, there are still companies without cost allocations for cybersecurity at all – 2% claimed they don’t have a dedicated budget for cyber protection needs.
The most successful industry in APAC in terms of proper monetary distribution for cybersecurity are financial services – 100% of respondents working in this sphere claim their organizations are set to keep up with and stay ahead of all new threats.
Would you say the budget for cybersecurity measures in your company …?
Many respondents’ companies are eager to take steps to strengthen their cybersecurity in the next 1-1.5 years. One of the most popular areas of investment is threat detection software (46%), and trainings, where half (50%) of companies plan to allocate budgets for educational programs for cybersecurity professionals and 46% for training general staff.
Other popular measures organizations plan to take soon are introducing endpoint protection software (42%), hiring additional IT professionals (37%) and adopting SaaS cloud solutions (45%).
“Today, companies must align cybersecurity investment with a business strategy and consider cybersecurity as one of their business goals. Of course, investments must justify themselves and be effective, so the information security department also faces the task of increasing the ROI of investments in information security and defending investments to senior management or the board of directors. Also, in addition to reducing MTTD and MTTR, information security is tasked with reducing the cost of a security incident. These challenges can be met through the use of various modern approaches and technologies. For example, we are investing in developing our SASE portfolio as well as XDR and MDR with integrated AI, Machine Learning, automated detection and response, automated threat investigation, out of the box integrations and much more. To ensure process transparency and prove the value of our solutions, we also provide C-level dashboards and reports for CISOs, which include information on how many incidents we prevented, how quickly incidents were investigated, and the effectiveness of deployed cybersecurity solutions. We also highlight customer-specific risks, and show them trends particular to the industry to help them shape their cybersecurity by targeting their defenses around current dangers, and justify investments in the necessary technology,” comments Ivan Vassunov, VP, Corporate Products at Kaspersky.
The full report and more insights on the human impact on cybersecurity in business are available via the link.
To get the most out of your budget, Kaspersky recommends:
Implementing cybersecurity products with Advanced Anomaly Control such as Kaspersky Endpoint Detection and Response Optimum. This helps prevent potentially dangerous ‘out of the norm’ activities initiated both by a user or by an attacker who has already taken control over the system.
Using easily-manageable solutions. Kaspersky Endpoint Security Cloud is designed for smaller enterprises or companies that don’t currently have the budget for a wide stack of cybersecurity products. The all-in-one hosted SaaS console allows just a single administrator to manage a broad range of cybersecurity tasks from one place, with a simple and easy-to-master workflow.
Investing in training for everyone in your company – from general staff to decision makers. Kaspersky Automated Security Awareness Platform training teaches employees safe internet behavior and includes simulated phishing attack exercises. At the same time, Kaspersky Cybersecurity for IT Online training helps build up simple yet effective IT security best practices and simple incident response scenarios for generalist IT admins, while Kaspersky Expert Training equips your security team with the latest knowledge and skills in threat management and mitigation to defend your organization against even the most sophisticated attacks. And last but not the least, to advance decision-makers’ understanding of the importance of cybersecurity and how best to distribute budgets to stay ahead of threats, engage them with Kaspersky Interactive Protection Simulation for enhanced C-level professional education.
Considering experts’ help. For example, Kaspersky Assessments family of professional services identifies security gaps in your system’s configuration, and the Security Architecture Design helps create an IT security infrastructure that’s a perfect fit for a particular company. Every step of implementation is grounded in real security needs, giving decision-makers convincing arguments to allocate budgets.
Referring to Kaspersky’s ‘Cybersecurity on a budget‘ resource for small and medium businesses for tips on how to spend less on IT without compromising on security.
Office owners or managers, take note: Increased risk of bullying in open-plan offices
In traditional open-plan offices it is easier to notice colleagues’ shortcomings and become irritated by them. If someone gets frustrated and takes it upon themselves to “do something about” a colleague’s behaviour, and there are no clear guidelines for handling such situations, there is a risk that it may escalate into bullying. Those who are subjected to bullying lack access to a private space for retreat.
Open-plan offices entail a clearly increased risk of workplace bullying compared with employees having their own office or sharing with just a few colleagues. This is shown in research from Linköping University, Sweden.
“Increased bullying is a tangible negative consequence of how you choose to organise the workplace. It’s important to highlight this, as it hasn’t previously been examined,” says Michael Rosander, professor at the Division of Psychology at Linköping University.
Open-plan offices, where many employees share the same space, have become increasingly common. Employers often justify this development as a way to use premises more efficiently and to encourage creative interactions between employees. However, research has shown that open-plan offices do not promote health, job satisfaction or productivity.
Until now, it has been unclear whether open-plan offices also affect the risk of bullying and employees’ motivation to look for another job. Through surveys of more than 3,300 randomly selected individuals in employment in Sweden, Michael Rosander has now provided an answer. The results are published in the journal Occupational Health Science.
Thirty per cent of those with some form of office-based work reported that they worked in a traditional open-plan office with no access to private space. Thirteen per cent worked in so-called activity-based offices, where employees spend part of their time in an open-plan environment but also have access to designated rooms for tasks requiring peace and quiet. The remainder had their own office or shared one with only a few colleagues.
For traditional open-plan offices, the survey responses showed a clearly increased risk of bullying compared with those who had their own office or shared an office with only a few colleagues. The difference remained regardless of factors such as personality traits and the extent of remote working. This suggests that the problems are indeed caused by the work environment in the office.
The researchers’ explanation is that in traditional open-plan offices it is easier to notice colleagues’ shortcomings and become irritated by them. If someone gets frustrated and takes it upon themselves to “do something about” a colleague’s behaviour, and there are no clear guidelines for handling such situations, there is a risk that it may escalate into bullying. Those who are subjected to bullying lack access to a private space for retreat.
Activity-based open-plan offices, by contrast, showed no increased risk of bullying, likely due to the availability of private spaces. However, in both types of open-plan office, employees were more likely to consider changing jobs. One possible explanation is that activity-based offices also involve more distractions, according to Michael Rosander.
For employers who have introduced, or are planning to introduce, open-plan offices, there are some lessons to be learned. One is to be prepared to deal with irritation and conflicts before they escalate. Another is the importance of providing rooms where employees can work undisturbed. Placing individuals with similar needs and tasks near one another may also reduce the risk of disruption.
“Traditional open-plan offices are in themselves negative for the individual, for productivity, and make people more likely to leave their job. Social interaction also suffers. So it’s worth considering how to handle it,” says Michael Rosander.
A new study from the University of East London has found that companies led by long-serving chief executives may become less innovative over time unless challenged by strong independent boards.
The research examined 215 FTSE 350 companies over an 11-year period between 2010 and 2021. It explored how CEO tenure and independent directors influence a company’s “R&D knowledge stock”, which is the research, expertise and technological capability built through investment in innovation.
The study published in the journal Corporate Governance found that CEOs who remain in office for many years often become more cautious and less willing to back risky research and development projects. These companies were more likely to reduce investment in innovation and long-term technological growth.
Firms with higher numbers of independent directors were more likely to continue building innovation capacity with experienced CEOs and independent directors forming an effective partnership, to combine deep company knowledge with outside challenge.
However, both experienced CEOs and independent directors become more cautious and less willing to back risky research and development projects when the company fails to meet performance aspirations, suggesting that independent directors do not have stable risk preferences.
The findings suggest that innovation is shaped not only by technology and finance, but also by leadership culture and corporate governance structures.
Author Dr Igbekele Sunday Osinubi, of the Royal Docks School of Business and Law, said: “Long-serving CEOs can bring valuable experience and stability, but there is also a risk that leaders become too cautious or too attached to existing ways of thinking. Our findings show that independent directors play an important role in encouraging companies to continue investing in innovation, especially during difficult periods when firms may otherwise retreat from long-term research and development.”
He added: “This matters beyond individual companies. Innovation drives productivity, competitiveness and economic growth. The study highlights how governance structures can influence whether firms continue building the knowledge and technologies that shape future industries.”
The paper argues that regulators and policymakers should consider governance reforms and incentives that encourage long-term innovation strategies, particularly in firms led by long-serving executives. The findings may also influence how boards think about CEO succession planning, oversight and the balance between short-term financial pressures and long-term investment.
Companies celebrated for strong financial performance may actually be inefficient once their environmental impact is taken into account, according to new research from the University of Surrey.
The study, published in theEuropean Journal of Operational Research, shows that firms that appear highly efficient at generating revenue can perform far worse when their environmental footprint are included in the calculation.
To tackle this problem, researchers developed a new way to measure “sustainable corporate efficiency”, combining traditional financial metrics with environmental data such as energy consumption, carbon emissions and revenues generated from environmentally friendly products and services.
Dr Menelaos Tasiou, co-author of the study and Senior Lecturer in Finance at the University of Surrey, said: “Businesses have long been judged on how efficiently they turn resources into profit. But if those profits come with large environmental costs, the picture changes completely. What we show is that true efficiency means generating revenue while also reducing the environmental damage caused by production. In other words, profitability alone can mask how wasteful a business really is when environmental costs are considered. “
The research analysed more than 2,800 publicly listed companies across 61 countries between 2010 and 2022, creating one of the largest global datasets measuring how sustainable companies are, when both financial performance and environmental impact are assessed together.
The team combined company financial records, in alignment with the green economy (defined as a low carbon, resource efficient and socially inclusive economy), with environmental disclosures such as energy use and greenhouse gas emissions. They then applied a machine learning technique known as Convexified Efficiency Analysis Trees (CEAT) to estimate how efficiently companies convert resources into revenue while minimising pollution.
Unlike older approaches, the method models the reality that production creates both desirable outputs, such as revenue, and undesirable ones, such as emissions. This allows companies to be compared on how well they balance profit with environmental performance.
The results found a moderate link between financial efficiency and environmental efficiency, meaning many firms that are strong financially are not necessarily good at managing their environmental impact.
The study also found large differences across industries and countries. Firms operating in sectors with high emissions, such as manufacturing and energy, often lagged behind leaders that were better at reducing carbon intensity while maintaining revenue.
Dr Tasiou continued: “Measuring efficiency in this broader way can help investors, regulators and policymakers identify companies that are genuinely prepared for a low carbon economy. Stronger management capability plays a key role. Firms with more capable management teams were more likely to balance profitability with environmental responsibility, suggesting that leadership decisions can strongly influence sustainable performance.
“As governments push towards net zero and investors scrutinise environmental performance more closely, companies that fail to integrate sustainability into their operations risk falling behind.”