Cyber threats in Southeast Asia expose the limits of perimeter security

At a glance

What this is: This is Seclore’s analysis of rising cyber threats in Southeast Asia, arguing that perimeter-only security no longer protects data moving across cloud, partners, and internal systems.

Why it matters: It matters because IAM, data security, and GRC teams need controls that govern access, sharing, and revocation across internal users, third parties, and NHI-enabled workflows.

By the numbers:

• In 2025, ASEAN recorded an increase in average data breach costs from $3.23 million to $3.67 million.
• Only 5.7% of organisations have full visibility into their service accounts.
• 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.

👉 Read Seclore’s analysis of cyber threats, data exposure, and data-centric security in Southeast Asia

Context

Southeast Asia’s digital growth has expanded the attack surface faster than many organisations have adapted their control model. The core problem is not just more attacks, but a weaker ability to govern access once data leaves the original boundary, especially when cloud services, partners, and contractors are all part of the workflow. For IAM and data security teams, the primary challenge is preserving policy enforcement after sharing begins.

This article’s strongest governance point is that data security and identity governance are converging. When files move across Microsoft 365, storage systems, vendors, and internal teams, access control is only part of the answer. Revocation, auditability, and user-level accountability become the real control points, particularly where non-human identities and third-party access are involved.

Key questions

Q: How should security teams govern shared data across vendors and cloud collaboration tools?

A: Treat shared data as a lifecycle object, not a static asset. Security teams should define who can access it, how long access lasts, whether access can be revoked instantly, and how activity is logged. That approach works better than perimeter-only controls because modern collaboration paths create copies and delegated access that outlive the original session.

Q: Why do third-party access paths increase identity risk across enterprise programmes?

A: Third-party access paths increase identity risk because they often rely on tokens, OAuth grants, API keys, and service accounts that sit outside the normal employee lifecycle. Those identities can remain valid long after the business context has changed. IAM and PAM teams need to govern the access path itself, not just the supplier relationship.

Q: What breaks when insider risk is managed only with perimeter security?

A: Perimeter security fails when the threat originates inside trusted workflows. Employees and partners may have legitimate access, but they can still overshare, forward files, or retain visibility beyond the intended window. Without content-level controls, organisations lose the ability to constrain usage once data enters collaboration and exchange systems.

Q: Who is accountable when sensitive data leaves through a vendor, API, or misconfigured system?

A: Accountability usually sits with the business owner of the data, the identity or platform team that granted access, and the vendor manager if external trust was involved. Frameworks such as Zero Trust and least privilege make that shared responsibility harder to ignore because they require continuous verification of access, not one-time approval.

Technical breakdown

Why perimeter security fails in distributed data environments

Perimeter security assumes the boundary is stable and that once something is inside, it is trusted enough to manage centrally. That model breaks when data moves through SaaS platforms, collaboration tools, and partner ecosystems where copies proliferate and local controls vary. In practical terms, the data object outlives the session, the device, and sometimes the originating organisation. Data-centric security changes the unit of control from the network edge to the content itself, which is why this topic intersects with identity governance whenever access decisions need to follow the data.

Practical implication: move from network-centric assumptions to file-level enforcement, especially for externally shared sensitive data.

How insider and third-party exposure changes the identity control model

Insider risk is not limited to malicious insiders. It also includes accidental oversharing, overbroad access, and weak handling by partners who were granted legitimate access. The identity issue is that trust is often granted once and then left in place, while the operational reality keeps changing. That creates a lifecycle gap: access is provisioned, but revocation, expiry, and usage monitoring do not keep pace. In NHI and IAM programmes, this is where service accounts, tokens, and delegated access deserve the same scrutiny as human users.

Practical implication: treat third-party and internal sharing as lifecycle-managed access, not as a one-time approval.

Why auditability and revocation are the real control layer

The article points to three practical controls that matter more than perimeter claims: time-bound access, audit logs, and instant revocation. These are not cosmetic features. They determine whether an organisation can prove who touched data, how long access lasted, and whether access can be removed after risk changes. In governance terms, this is where data security becomes a policy enforcement problem, not just a storage problem. For identity teams, the question is whether the organisation can enforce access limits across humans, vendors, and machine identities with the same consistency.

Practical implication: require audit trails and revocation hooks for every sensitive data-sharing workflow.

Threat narrative

Attacker objective: The attacker or risk actor aims to gain, retain, or misuse access to sensitive business data across trusted sharing environments.

1. Entry occurs through legitimate sharing paths such as cloud collaboration, vendor workflows, or unprotected file forwarding rather than through obvious perimeter intrusion.
2. Escalation happens when access spreads through over-shared files, unmonitored partners, or internal users who retain visibility longer than intended.
3. Impact follows when sensitive data is exposed, mishandled, or used in ways that trigger compliance failures, operational disruption, or reputational harm.

NHI Mgmt Group analysis

Data-centric security is now an identity governance problem, not just a file protection problem. Once sensitive content moves into collaboration tools, vendor systems, and cloud storage, the organisation has to govern access after the file leaves the originating boundary. That means lifecycle controls, revocation, and auditability matter as much as encryption. For IAM and NHI teams, this is a reminder that policy must travel with the data, not sit only in the directory.

Third-party access without lifecycle discipline is the governance gap this article exposes. The article correctly frames external ecosystems as a risk multiplier, but the deeper issue is that many organisations still approve partner access without strong expiry, offboarding, or usage validation. That gap is visible across NHI governance too, where delegated access often persists after the business need ends. Practitioners should treat third-party sharing as an access lifecycle problem with a clear owner.

Time-bound access is a stronger control signal than static permission models in distributed environments. Static entitlement reviews do not tell you whether a sensitive file is still exposed today, only whether access once existed. When the control plane includes watermarking, logs, and revocation, the organisation can respond to changing risk instead of relying on periodic review. For security architects, the lesson is to design enforcement around duration, traceability, and removal rather than around location alone.

Regional compliance pressure is pushing organisations toward measurable data governance. The article’s regulatory focus reflects a broader trend: data protection obligations are becoming operational requirements, not legal footnotes. That matters because controls that cannot prove sharing scope, expiry, and user actions will not stand up well to board scrutiny or regulator review. The practical conclusion is to align data protection controls with IAM evidence and NHI oversight.

Distributed collaboration creates hidden non-human access paths that deserve explicit oversight. In many modern workflows, service accounts, automation, and integrations move data faster than human reviewers can track. That creates a blind spot between human approvals and machine execution. Organisations should map where NHIs can read, copy, sync, or distribute sensitive content so that machine-mediated exposure is governed with the same rigor as user access.

What this signals

Distributed collaboration is forcing security teams to measure control quality by revocation speed and access traceability, not by perimeter reach. That shift aligns with the NIST Cybersecurity Framework 2.0, especially where data protection depends on enforceable access policies and evidence of control operation.

Exposure-window governance: the practical question is how quickly access can be constrained once data leaves the original control boundary. Teams that cannot answer that with logs, expiry, and revocation workflows will struggle to prove resilience across partner ecosystems. The operational signal is whether the organisation can reduce exposure without waiting for a manual review cycle.

Where NHIs participate in sharing, sync, or automated distribution, the same controls used for human access are no longer sufficient on their own. Security leaders should map machine-mediated data movement, then decide whether the identity stack can enforce least privilege across integrations, not just users.

For practitioners

• Map data-sharing workflows end to end Inventory where sensitive files move across collaboration platforms, vendors, and internal teams, then document which identities can read, copy, forward, or sync each dataset.
• Enforce expiry on externally shared content Set time-bound access for partner and contractor workflows so permissions automatically lapse when the business need ends, rather than relying on manual follow-up.
• Require revocation and audit hooks Make revocation, access logs, and user-level traceability mandatory for protected content so responders can remove access and reconstruct usage after an incident.
• Include NHIs in data-access reviews Review service accounts, integrations, and automation paths that can move or expose sensitive files, then constrain them to the minimum content scope needed.

Key takeaways

• The central risk is not simply more cyberattacks, but weaker control over data once it moves across cloud, partner, and internal workflows.
• The evidence points to a governance gap in visibility, revocation, and third-party accountability rather than a single technical flaw.
• Security teams should prioritise content-level enforcement, lifecycle-managed access, and machine identity oversight for shared data paths.

Key terms

• Identity-Centric Data Security: Identity-centric data security is the practice of governing sensitive data through the identities that can reach it, not only through storage controls. It connects entitlement, context, and auditability so organisations can explain and limit access across humans, machines, and AI agents.
• Third-party risk management: Third-party risk management is the process of identifying, assessing, monitoring, and reducing risk introduced by external vendors and service providers. In identity terms, it governs who outside the organisation can reach systems or data, how that access is approved, and when it must be removed.
• Exposure Window: The period in which a credential, session, or privilege grant can be exploited before it is revoked or expires. Shorter windows help, but they do not solve the deeper question of whether the access remains justified for the full time it is active.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

What's in the full article

Seclore's full blog post covers the operational detail this post intentionally leaves for the source:

• Regional breach-cost context and how the article maps those costs to Southeast Asia-specific threat exposure
• Practical examples of file-level protections, including time-bound access, dynamic watermarking, and instant revocation
• Compliance mapping across ASEAN privacy regimes and how organisations can evidence accountability to auditors
• Implementation framing for teams evaluating data-centric security alongside existing DLP, IAM, and collaboration controls

👉 Seclore’s full post adds the practical file-level controls and compliance context behind the regional risk picture.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, IAM, and secrets management in practical terms. It is designed for practitioners building identity controls that work across human and non-human access paths.