Palo Alto Networks, the world’s leading AI cybersecurity company, has released the 2025 Cybersecurity Resilience in Mid-Market Organisations, a benchmark study, offering a first-of-its-kind view into how mid-market organisations across Asia-Pacific and Japan, including the Philippines, are evolving their cybersecurity capabilities in the face of growing threats and accelerating digital transformation.
While mid-market organisations in the Asia-Pacific and Japan, including the Philippines, are making tangible progress in strengthening their cybersecurity posture, key challenges remain. Many organisations are still in the early stages of operationalising AI within their security workflows, and gaps persist in areas such as incident recovery and cyber resilience. Additionally, the complexity of managing multiple tools and fragmented environments continues to hinder efficiency. Addressing these issues will require a more unified, platform-based approach that integrates AI-driven capabilities to enhance performance, streamline operations, and strengthen protection across the board.
“Cybersecurity is no longer just an IT issue, it's a business priority. As threats grow more sophisticated and AI reshapes the threat landscape, our benchmark study reveals that many mid-market organisations are still catching up,” said Michelle Saw, Vice President, Ecosystems, Asia-Pacific and Japan at Palo Alto Networks. “This study helps mid-market organisations see where they stand and take the steps needed to achieve stronger security outcomes. It also highlights the growing importance of partners—who must now evolve their offerings to focus more deeply on education, integration, AI adoption, and advanced technical expertise to better support customer needs.”
Key findings from the study:
Partners matter more than ever: 79% of companies say they will rely on partners to support cybersecurity efforts within two years - up from 53% today.
Cyber budgets are on the rise: 57% of organisations plan to increase cybersecurity spending over the next 12 months. Cyber now accounts for 13.6% of total IT budgets, up from just 6% in 2019.
AI adoption lags behind investment: Despite growing awareness, organisations cited AI-related capabilities as one of the lowest performing areas in their cybersecurity programs.
Cloud security, IAM and SIEM top the priority list: Over the next 24 months, these are the most cited areas for new or increased investment.
Framework implementation is inconsistent: Adoption of NIST 2.0 received the lowest score among the five benchmark categories, underscoring a need for clearer guidance and support. Sectors leading the understanding and adoption of NIST 2.0 and other frameworks include financial services, telecommunications and utility companies.
Key highlights from the Philippines include:
Cybersecurity budgets are on the rise, now accounting for 13.3% of revenue, with the biggest increases projected in security software (47.09%), network security hardware (38.35%), and data protection and privacy (37.86%).
Partner support is accelerating: 61% of Philippine companies currently rely on partners for cybersecurity, a figure expected to rise to 79% in two years. MSSPs (40%) are the most preferred partner type, followed by MSPs and systems integrators.
Robust safeguards but gaps in governance and response: The Philippines scores 3.95 in Govern, 3.06 in Identify, 4.05 in Protect, 4.05 in Detect, and 3.07 in Respond under the NIST framework, revealing areas needing improvement particularly in governance, identification, and response.
Partner selection is driven by technical expertise (35.9%), resiliency capabilities, and knowledge transfer. However, poor solution performance (43%), major breaches, and supply chain issues remain the top reasons for switching partners.
Application and data security, SOC operations, and network security are currently the most deployed cyber solutions in the country.
“It’s encouraging to see the Philippines taking meaningful steps to elevate its cybersecurity efforts, especially with the approval of the National Cybersecurity Plan, a critical move to safeguard institutions, infrastructure, and citizens amid growing threats,” said Steven Scheurmann, Regional Vice-President of ASEAN at Palo Alto Networks. “With the Philippine digital economy valued at
PhP2.25 trillion in 2024, which accounts for 8.5% of the country’s gross domestic product, cybersecurity is no longer optional. The increased budgets among mid-market organisations reflect a deeper understanding that protecting digital assets is essential to sustaining business growth and national progress. This is why partnerships are crucial to improving threat detection and response, enabling the adaptive, intelligent security needed for the digital future.”
“The research indicates that mid-market organisations in the region have made notable advancements in strengthening their cybersecurity posture,” said Tim Dillon, Founder, Director, Principal Analyst End User at Tech Research Asia. “However, there remains substantial opportunity for partners to support continued progress, particularly in the areas of workforce education and training, identity and access management, and application and data security.”
The Cybersecurity Benchmark for Asia-Pacific and Japan, developed in collaboration with Tech Research Asia (TRA), surveyed over 2,800 mid-sized organisations across 12 countries and a range of industries. It offers a snapshot of the region’s cybersecurity maturity and provides practical guidance for improvement. With evaluating performance across five key areas; strategy execution, business integration, operational capabilities, solution maturity, and NIST 2.0 framework adoption, the average score was 19.01 out of 25. While this indicates a moderate level of maturity, the findings reveal clear opportunities to strengthen AI readiness, boost ransomware resilience, and advance framework implementation. This Tech Research Asia Insights Report Asia-Pacific and Japan Edition was commissioned by Palo Alto Networks and completed in April 2025
