Takeaways from the Singapore Cyber Security Business Mission to Indonesia, convened by AIBP - commissioned by SGTech and the CyberSG TIG Collaboration Centre, a joint venture between the Cyber Security Agency of Singapore (CSA) and the National University of Singapore (NUS).

Three days, three months, or even three years are barely enough to understand a market of 270 million people - particularly one whose history stretches back to Java Man.

Yet companies arrive in Indonesia all the time armed with a regional strategy, a few meetings and the assumption that what worked in Singapore will work in Jakarta.

Indonesia has a habit of punishing assumptions.

Last month, ten Singapore cyber companies spent three days across the 54th AIBP Indonesia Conference & Exhibition, with lightning showcases, networking receptions, and 75 one-to-one meetings, alongside:

Sitting in the same room with Indonesian banks, insurers, utilities, regulators and state enterprises taught us something. Here's what stood out - especially if Indonesia is on your radar.

The backdrop is hard to ignore.

BSSN logged around 5.5 billion cyberattacks in Indonesia in 2025, and roughly four in ten Indonesian enterprises say cyber and privacy are slowing their digital plan - yet lack the talent to do much about it.

Compliance kept coming up as the reason to act now.

OJK's cyber-resilience rules, the Personal Data Protection Law (UU PDP) and BSSN's growing critical-infrastructure mandate have made security an audited, board-level obligation.

The enterprises that were moving weren't chasing best practice in the abstract - they were answering a regulator.

More of the financial-services conversation here.

AI ran through almost every room - the opportunity and the worry.

Everyone's deploying it - fraud detection, credit scoring, recommendations, analytics — faster than they can govern it. BSSN described how AI has made fraud “very easy, very personal, very convincing”.

The defender's side is messier: shadow AI, with staff pasting sensitive data into public tools or photographing a screen to get past the controls. As one industrial-group tech leader put it, “with AI, everybody can do things.”

The question underneath - ”who answers when the model decides?” - kept returning; as one bank's cyber lead said, “accountability does not lie in the AI itself”. The companies that offered to help enterprises govern AI, rather than block it, got the most interest.

The clearest gap we heard was in OT.

For energy, utilities, mining, ports and manufacturing, IT security is maturing - but operational technology is still the frontier. It's harder here, with plants scattered across thousands of islands, procured separately from central IT, and running on legacy systems.

Enterprises asked for intelligence, not another dashboard

Regionally-relevant threat visibility, faster detection, and a handle on third-party and supply-chain risk. With local cyber talent in short supply, what landed sounded more like “we'll help you build the capability” than “we'll give you the tool.”

A few things that stood out:

Validate the problem with the customer first, then find a partner. Prove there's a real problem to solve, though local presence is usually the price of entry, especially for critical infrastructure and government.
Listen to the regulators. BSSN, OJK and Komdigi dictate market direction. Alignment is a wedge.
Don't underestimate the SOEs. SIG, the industrial state-owned enterprise we visited, scored 4.23/5 on BSSN's maturity index and had topped a national cyber exercise.
Lead with the problem, bring a local/regional story. A named Indonesian reference beats a global logo wall every time.
Show up in person. Deals here are made over coffee and across the table, not in a single remote pitch.

Indonesia's security spending is being pulled forward by three things at once: a scaling digital economy, tightening regulation, and an increasingly AI-enabled threat landscape. The demand is real and broad, but it's relationship-led, compliance-anchored and partner-mediated. Treat Indonesia as a place to build presence, not just make a sale, and you'll still be there when the market matures.

Special thanks to CyberTIG and the ten companies for entrusting us with this journey.

P.S. Interested in the Indonesian cyber market? Revisit our Cyber Security Market Briefing & Go to Market Workshop with the digital ministry Komdigi here.

About ASEAN Innovation Business Platform (AIBP)

The ASEAN Innovation Business Platform (AIBP) is an initiative focused on enabling innovation and strategic partnerships across public and private organisations in Southeast Asia. Through curated engagement activities, AIBP supports the growth of regional government agencies, enterprises and solution providers in navigating key themes such as innovation, digital transformation, and sustainability.

Learn more at www.aibp.sg

Indonesia: Market Entry a Million Years After Java Man - Still Figuring Out How Not to Go Extinct