As APAC races to adopt AI in cybersecurity, the human skills gap threatens to slow it down

Global cybersecurity company Kaspersky has found that Artificial Intelligence (AI) ambitions across the Asia-Pacific region face a serious hurdle, which is a widening human skills gap that threatens to undermine the very technology organizations are racing to deploy.

The finding reinforces the urgency behind Kaspersky’s Cyber Pathways, an interactive platform that helps cybersecurity professionals map their skills and navigate their career development.

AI adoption in security operations is accelerating fast. According to a new global survey by Kaspersky, the data further said that 81 percent of APAC organizations have increased their IT security budgets, while 71% already prefer AI-enabled security solutions over their non-AI equivalents — with Vietnam (87%), Malaysia (76%), and Indonesia (74%) showing the strongest appetite for AI-powered tools. But as AI takes on more of the operational load in cybersecurity, the question of what organizations need from the humans working alongside it remains largely unanswered.

The threat landscape facing APAC organizations makes these skills gap all the more urgent. It is also noted that the cyber attacks based on employees' low IT security awareness were particularly prevalent, affecting 63% of APAC organizations against a global average of 60%, with Vietnam (75%), India (70%), and Indonesia (66%) among the hardest hit.

Phishing remained the most reported incident across the region (24%), while the use of AI vulnerabilities (14%) and deepfakes (14%) are emerging as growing threats – with Thailand reporting AI vulnerability exploitation at 22% and Vietnam reporting deepfake attacks at 21%, both well above the global average of 13% and 11% respectively.

"APAC is experiencing more types of incidents per organization than the global average, and the majority of them trace back to human factors. That should be a wake-up call. AI can augment what skilled professionals do, but it cannot replace the judgment, awareness and practical knowledge that this region urgently needs to build," said Adrian Hia, Managing Director for Asia Pacific at Kaspersky.

What AI cannot do in cybersecurity

AI has hard limits, and those limits define the human contribution. AI operates within the distributions it was trained on. It struggles with genuinely novel attack vectors like the kind that haven’t been seen before, the kind that a creative adversary deliberately engineers to evade detection.

AI can’t make judgment calls that require accountability like deciding whether to disclose a breach, weighing business risk against security risk, communicating findings to a board that needs to act on them. It cannot interrogate its own outputs with adversarial skepticism and it cannot build the trust with stakeholders that effective security leadership requires.

In APAC, hiring managers place a strong premium on practical experience over academic credentials. According to the recent Kaspersky data, hands-on training and previous work experience are the top determinants of candidate qualification among APAC hiring managers, both cited by 76%, ahead of relevant certifications (74%), employer recommendations (57%), and university degrees (57%). Notably, 70.4% of APAC InfoSec specialists say hard and soft skills are equally critical, reinforcing that the region's talent gap is not just technical, but behavioral.

Specializations and different skill equations

One reason the skills conversation in cybersecurity often stalls is that it treats the field as a single discipline. It isn't. The skill mix required of a malware analyst is fundamentally different from what a security operations professional needs, which is different again from the work of a threat intelligence analyst or a network security specialist.

Kaspersky's Cyber Pathways addresses this directly. Rather than mapping a single skills ladder for the profession, it helps practitioners and teams understand the six core specializations:  Security Operations, Threat Intelligence, Security Assessment, Information Security Research, Network Security and Malware Analysis. It also helps identify which combination of technical capability, AI literacy and human judgement each demands.

For APAC organizations, the window to act is now. The region's biggest hard skills shortfalls remain in systems programming (62%), framework knowledge (61%), and network technologies (46%), while soft skills gaps in analytical thinking (48%) and problem-solving (43%) continue to leave organizations exposed. Investment without structured, role-specific development is investment without direction.

"The talent gap in APAC is not going to close on its own, and AI is not going to close it for us. What the region needs now is a deliberate, specialization-driven approach to building cybersecurity capability. Organizations that invest in structured pathways for their people today will be the ones best positioned to harness AI effectively tomorrow," Hia further said.

As APAC organizations navigate an increasingly complex cybersecurity landscape, the path forward is clear. Building a skilled, specialized and future-ready workforce is the foundation on which everything else depends. Kaspersky's Cyber Pathways offers a practical starting point, helping professionals and organizations across the region identify where they stand, where they need to go, and how to get there, one specialization at a time.

Kaspersky

Kaspersky is a global cybersecurity and digital privacy company founded in 1997. Innovating the industry with a Cyber Immunity approach, Kaspersky safeguards consumers, businesses, critical infrastructure, and governments from cyberthreats, with over a billion devices protected to date.

Kaspersky ensures Cybersecurity True to Business, focusing on providing clear outcomes, protecting revenue, easing workloads and preventing downtime. Kaspersky’s deep threat intelligence and security expertise is constantly transforming into innovative solutions and services for organizations of every size, from small businesses to large enterprises, combining proven AI-driven protection technologies with simple management and expert support.

Recognized in independent tests and trusted by millions of individuals worldwide and nearly 200,000 organizations, Kaspersky helps detect threats earlier, respond faster and operate with greater confidence and freedom, protecting what matters most to our clients. Learn more at www.kaspersky.com