Cyber threats in Southeast Asia expose the limits of perimeter security

At a glance

What this is: This is a Seclore analysis arguing that perimeter security is no longer enough in Southeast Asia because breaches, insider exposure, and third-party risk now move with the data.

Why it matters: IAM, PAM, and data security teams need to treat access, sharing, and revocation as data-level controls, not just network or platform settings.

By the numbers:

• In 2025, ASEAN recorded an increase in average data breach costs from $3.23 million to $3.67 million.

Context

Southeast Asia’s security problem is not a single control failure but a governance mismatch: organisations have expanded cloud collaboration, partner access, and digital workflows faster than they have expanded control over where sensitive data can go. Perimeter-based security assumes the threat is outside the boundary, yet the article shows the more relevant boundary is now around the data itself.

For IAM and identity governance teams, that shift matters because access decisions increasingly outlive the original session, platform, or network context. When employees, contractors, vendors, and services can all touch the same files across multiple systems, security has to account for entitlement scope, sharing behaviour, and revocation after distribution, not just authentication at the edge.

Key questions

Q: What breaks when data protection stays outside the identity model?

A: Controls that focus only on login and network location lose visibility once a file is copied, shared, or opened in another system. The organisation may still know who authenticated, but not whether the data can keep being used after the original business context ends. That gap turns valid access into persistent exposure.

Q: Why do insider incidents become compliance failures so quickly?

A: Because the risk is usually not the first access event, but the uncontrolled onward use of information after a legitimate user forwards, shares, or stores it elsewhere. Regulators care about accountability, traceability, and data handling, so a single unmanaged action can create a reportable control failure even without malware or theft.

Q: How should security teams govern external collaboration when third parties need access to sensitive data?

A: Security teams should treat external collaboration as a data governance problem, not just a connectivity problem. Start by identifying which partners, contractors, and suppliers can reach sensitive data, then limit access to the minimum necessary and apply controls that persist with the data itself. That reduces overexposure when files move across email, cloud shares, and collaboration tools.

Q: What is the difference between perimeter security and data-centric security?

A: Perimeter security assumes the network boundary is the main control point and focuses on who is inside or outside it. Data-centric security shifts the control point to the information itself, so decisions are based on what data is accessed, how it has moved, and whether the action fits its context across cloud, SaaS, and endpoints.

Technical breakdown

Why perimeter controls fail once data leaves the boundary

Perimeter security is built on the idea that if traffic is inspected at the edge, the asset remains protected inside the environment. That model weakens when files move into collaboration tools, partner systems, or personal workspaces because the protection layer is no longer attached to the asset. Data-centric security changes the unit of control from network location to the object itself, using persistent policy, encryption, and usage enforcement so protection survives movement. In practice, the issue is not only where data sits but who can keep using it after legitimate access has been granted.

Practical implication: move from location-based trust to file-level controls that stay active after export, sharing, or sync.

How insider exposure becomes a governance problem

Insider risk is often described as malicious behaviour, but the more common failure mode is ordinary misuse of legitimate access. Employees, contractors, and partners can expose sensitive information by forwarding files, sharing links too broadly, or leaving access open after a task ends. This is an identity governance issue because the entitlement may be valid while the usage context is not. The article’s emphasis on audit logs, time-bound access, and instant revocation reflects a control model that tracks what users do with data, not only whether they authenticated to reach it.

Practical implication: align access duration, sharing scope, and revocation rules to the actual business use case.

Third-party exposure is now part of the access model

Third-party risk grows when vendors, service providers, and cloud partners receive data under assumptions that their controls match yours. In distributed ecosystems, a breach in one organisation can propagate through shared files, collaborative platforms, or delegated access paths. That means ownership of the data does not equal control of the environment it moves through. For identity teams, this makes offboarding, delegated access review, and partner governance inseparable from data protection. The central technical issue is that shared access can persist long after the original business need has changed.

Practical implication: treat partner access as a lifecycle control, with explicit expiry, review, and revocation for shared data.

Threat narrative

Attacker objective: The objective is to obtain or expose sensitive business data despite legitimate access controls, then preserve usability of that data across shared environments.

1. Entry occurs through trusted cloud collaboration, partner access, or internal misuse rather than a classic perimeter intrusion.
2. Credentialed users then over-share or forward protected information, extending access beyond the intended business context.
3. The impact is data exposure, compliance failure, and broader ecosystem risk when sensitive files remain usable after they leave the original boundary.

Breaches seen in the wild

• Firebase misconfiguration exposure 2024: Missing Firebase security rules on 916 websites exposed 125 million user records and 19.87 million plaintext passwords; a quarter were fixed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Data-centric security is the governance answer to perimeter failure. The article is right to frame the issue around data movement rather than network location, because modern collaboration has dissolved the old inside/outside boundary. Encryption and inspection at the edge do not solve the problem when files continue to circulate after they leave the enterprise. Practitioners should treat persistent data controls as a core governance layer, not an add-on.

Insider risk is usually an entitlement design problem before it is a behavioural problem. When employees, contractors, and partners can expose sensitive information through ordinary workflow actions, the issue is not simply user intent. It is that access, sharing, and revocation controls have not been modelled to match real use. The control gap is prolonged usability after access is granted, and that gap is what auditors and identity teams need to close.

Third-party access without lifecycle discipline creates hidden exposure debt. Once data is shared across vendors and service providers, the organisation inherits risk from every downstream handling decision it cannot see. That is a classic lifecycle problem, not just a perimeter problem, and it maps closely to NHI governance where access often outlives the original purpose. Teams should treat partner sharing as a governed entitlement lifecycle with expiry and traceability.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Data-centric governance is becoming the practical control plane for distributed identity. As collaboration shifts across clouds and partners, entitlement decisions have to include how data is shared, copied, and revoked after the original session ends. For IAM and NHI programmes, the real task is to bind access lifecycle to data lifecycle, not to rely on a perimeter that no longer exists.

Service-account visibility remains a weak point that broadens the exposure problem. Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs, and that blind spot becomes more serious when those accounts can move or protect sensitive data across multiple systems. Teams need inventory, ownership, and revocation discipline before they can claim the data is actually governed.

For practitioners

• Define data-level protection for high-value files Apply persistent controls such as encryption, usage policy, and revocation so protection remains attached after files move into collaboration tools or partner systems.
• Time-limit access based on business need Set access windows that match the task, then remove the ability to open, share, or reuse sensitive files once the business purpose ends.
• Review third-party sharing paths Map which vendors, contractors, and cloud services can receive protected data, and require explicit expiry and traceability for each path.
• Instrument audit logs for file usage Capture who opened, forwarded, downloaded, or modified protected data so compliance teams can reconstruct exposure and prove control execution.
• Align identity governance with data governance Join entitlement review, offboarding, and access revocation to the places where sensitive data is stored and shared, not just where users authenticate.

Key takeaways

• The article’s core argument is that perimeter security no longer matches how sensitive data moves across cloud, partner, and internal systems.
• The biggest governance gap is not only initial access, but how long data remains usable after it is copied, forwarded, or shared.
• Identity and data security teams need lifecycle controls that cover entitlement, traceability, and revocation across the full sharing path.

Key terms

• Data Centric Security: Data Centric Security protects information itself, rather than relying only on the security of systems that store or move it. It uses controls such as classification, encryption, tokenization, access policies, and usage restrictions so data remains protected wherever it travels, is copied, or is processed across cloud, endpoint, and application environments.
• Third Party Risk: Third party risk is the chance that an outside organization, supplier, contractor, or service provider will create harm for your business. It includes security, privacy, operational, legal, and compliance exposure caused by access to data, systems, or processes. In identity terms, it often arises from shared credentials, integrations, and delegated trust.
• Insider Risk Management: Insider Risk Management is the practice of detecting, investigating, and reducing harm caused by legitimate identities misusing access. It covers human error, malicious insiders, compromised accounts, and increasingly AI-driven actors that can move sensitive data without breaking perimeter controls.
• Entitlement Lifecycle: The entitlement lifecycle covers how access is created, reviewed, used, changed, and removed over time. Strong lifecycle control prevents old permissions from lingering after a role, project, or need has ended, which is essential for least privilege and audit readiness.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps security and identity practitioners connect lifecycle control to the wider programme decisions that govern access and exposure.