Author: admin

The Numbers Indonesia Cannot Ignore

Indonesia recorded 56,128,160 personal data exposures across 461 stakeholders in 2024, according to BSSN’s Indonesian Cyber Security Landscape report. Through August 2025, BSSN counted 3.64 billion cyber attacks. In May 2026, breach disclosures have continued at pace: a high-severity compromise of Brawijaya University internal systems and an active dark-web sale of the Kota Gunungsitoli municipality database have surfaced within days of each other.

Indonesia is ASEAN’s largest digital market. The threat is growing faster than the maturity. The PDP Law (UU No. 27/2022) has been fully in force since October 17, 2024. BSSN Regulation No. 1/2024 requires 24-hour incident reporting to Nat-CSIRT. The PDP Agency, Indonesia’s new data protection authority, is targeted for operational launch in mid-2026. The regulatory clock is running.

This post is the executive briefing for any organization with Indonesian operations or Indonesian customer data. It explains the breach landscape, the regulatory expectations now in force, and the specific control upgrades that will determine whether the next incident is contained, public, or punitive.

What Is Indonesia’s Current Data Protection Regime?

Indonesia’s data protection framework rests on three pillars in 2026:

1. UU No. 27/2022 (PDP Law). Fully enforceable since October 17, 2024. Maximum penalty is 2% of annual revenue plus criminal liability.
2. BSSN Regulation No. 1/2024. Requires reporting of cyber incidents to the Nat-CSIRT within 24 hours, and registration of organizational CSIRTs. BSSN has registered 537 CSIRTs across government and private sector entities.
3. PDP Agency. Targeted for operational launch in mid-2026 pending Presidential Regulation approval. Will hold enforcement authority including monetary penalties and criminal referral.

For multinational organizations, Indonesia’s framework now sits alongside GDPR, NIS2, and DORA in a layered global compliance stack. Each adds its own incident classification logic and reporting deadlines.

The Problem: Indonesia’s Maturity Gap

Volume is overwhelming structural defenses

3.64 billion cyber attacks recorded through August 2025 represents an attack volume no manual SOC can absorb. BSSN reports that 90% of attacks in Indonesia originate from malware, but the actual successful intrusions increasingly involve identity abuse and supply chain compromise as well.

The 24-hour reporting clock leaves no room

BSSN Regulation No. 1/2024 requires Nat-CSIRT notification within 24 hours of incident detection. For many organizations, that window expires before forensic clarity is achieved. Without pre-built incident classification workflows, the report is either rushed and incomplete or late and punitive.

Critical sector incidents continue

The 2024 National Data Centre ransomware attack disrupted 282 government services and was met with a USD 8 million ransom demand. The Brawijaya University compromise alleged in May 2026 and the active dark-web sale of the Kota Gunungsitoli database show that sub-national institutions remain undersecured even as the regulatory environment hardens.

Compliance documentation is not yet operational

Many organizations have policies on paper that meet PDP Law on the surface, but no operational evidence pipeline that proves continuous compliance. When the PDP Agency examines incidents in 2026, paper-only programs will not survive.

What Happens When Indonesian Organizations Do Not Solve This?

• PDP Law penalties of up to 2% of annual revenue, plus criminal liability for executives.
• Nat-CSIRT reporting failures, which are publicly traceable and reputationally costly.
• Customer attrition, particularly for fintech and e-commerce, where data trust is the brand.
• Cross-border vendor exclusion, as multinational customers limit partnership with non-compliant Indonesian providers.

Old Way vs. New Way: Indonesia Incident Posture

How Peris.ai Supports Indonesian Compliance Operations

Peris.ai is registered with BSSN and operates from offices in Jakarta, Singapore, and Abu Dhabi. The platform is engineered to support the specific operational expectations of the PDP Law, BSSN Regulation No. 1/2024, and the incoming PDP Agency. Four components carry the weight.

IRP for 24-hour Nat-CSIRT-ready reporting

Peris.ai IRP captures audit-ready incident documentation from the first alert. The case template is aligned to BSSN’s 24-hour Nat-CSIRT submission format, so the report writes itself as the investigation proceeds. A leading Peris.ai client in financial services reported a 35% reduction in analyst workload after IRP rollout.

BrahmaFusion for automated compliance evidence collection

BrahmaFusion executes continuous control monitoring playbooks against PDP Law and BSSN regulatory baselines. Evidence is collected continuously, not reactively. A Peris.ai client achieved 40% SOC cost savings after this class of automation.

INDRA CTI for Indonesia-specific threat intelligence

INDRA CTI maintains intelligence on actors targeting Indonesian sectors, dark-web sales of Indonesian datasets, and credentials tied to Indonesian organizations. When data attributable to your organization surfaces in a forum, INDRA CTI notifies your team before the breach becomes public.

Corporate Compliance consultation

Peris.ai‘s 1-on-1 corporate compliance service supports organizations through PDP Law alignment, BSSN CSIRT registration, ISO/IEC 27001 (BSSN’s recommended reference standard), and PDP Agency readiness.

Use Case: From Detection to Nat-CSIRT in Under 6 Hours

A mid-market Indonesian e-commerce company using Peris.ai experiences the following.

1. INDRA CTI detects a sample of customer email addresses tied to the company appearing in a Telegram channel known to broker Indonesian datasets.
2. Our XDR confirms an unusual outbound data transfer from one of the company’s customer service tools two days earlier, correlated to an identity that recently failed an AiTM-pattern login defense.
3. BrahmaFusion contains the impacted identity and isolates the source system.
4. IRP opens a case, populates the Nat-CSIRT submission template, and pre-fills 80% of required fields from automated evidence.
5. The compliance team submits the Nat-CSIRT notification within 5 hours 47 minutes of detection, well inside the 24-hour window.

Outcomes That Matter

Conclusion

Indonesia’s regulatory and threat environment in 2026 will not reward paper compliance. The combination of PDP Law enforcement, BSSN 24-hour reporting, the incoming PDP Agency, and an attack volume measured in billions creates an operational threshold that only autonomous threat detection, hyperautomation SOC, and continuous compliance evidence can meet. Peris.ai is built for that threshold, and operates inside Indonesia, for Indonesian organizations and the multinationals that serve them.

Learn how platforms like BrahmaFusion by Peris.ai empower lean security teams to automate incident response, scale compliance operations, and build trust where it matters most. Want more insights? Visit Peris.ai.

FAQ

What is the PDP Law in Indonesia?

The PDP Law, UU No. 27/2022, is Indonesia’s comprehensive personal data protection regulation, fully enforceable since October 17, 2024. Penalties include up to 2% of annual revenue and criminal liability.

When does the PDP Agency launch?

The PDP Agency is targeted for operational launch in mid-2026, pending Presidential Regulation approval. It will hold enforcement authority over the PDP Law.

How quickly must Indonesian organizations report cyber incidents?

BSSN Regulation No. 1/2024 requires reporting to the Nat-CSIRT within 24 hours of detection. BSSN has registered 537 CSIRTs across government and private sector to facilitate this.

What was the 2024 National Data Centre ransomware impact?

The attack disrupted 282 government services and was accompanied by a USD 8 million ransom demand, making it one of the most consequential incidents in Indonesian cyber history.

How does Peris.ai help with Indonesian compliance?

Peris.ai IRP aligns to BSSN’s 24-hour Nat-CSIRT reporting format. BrahmaFusion automates continuous PDP Law and ISO/IEC 27001 control monitoring. INDRA CTI provides Indonesia-specific threat intelligence. Peris.ai‘s Corporate Compliance service guides PDP Law and PDP Agency readiness.

Microsoft’s Security Blog published a post in April 2026 with a clear argument: the alert queue is a relic. “The agentic SOC: Rethinking SecOps for the next decade” laid out a fundamental restructuring of how security operations centers should work, one in which autonomous AI agents investigate, triage, and recommend remediation without human analysts manually reviewing every alert in a queue.

This is not a vendor roadmap item or a 2030 prediction. It is a description of what leading security teams are building right now in 2026. The SIEM, XDR, and SOAR are converging into a single AI-powered detection-investigation-response layer. SOC team structures built around the alert queue model are becoming operationally obsolete.

This post explains the agentic SOC architecture emerging in 2026, why the two-layer model replacing the alert queue represents a structural improvement, and how Peris.ai‘s BrahmaFusion platform positions security teams at the front of this transition.

What Is an Agentic SOC?

An agentic SOC is a security operations center in which AI agents handle routine detection, investigation, and triage decisions autonomously, escalating to human analysts only when genuine judgment or authority is required. The key distinction from traditional automation is the word “agentic”: these systems do not just execute predefined rules. They reason, adapt, and act across multi-step investigation and response sequences.

In a conventional SOC, an alert fires, lands in a queue, waits for an analyst, gets triaged by a human, and if warranted, triggers an investigation. The bottleneck is the human queue. In an agentic SOC, the AI agent handles the queue autonomously: it investigates the alert, correlates it with threat intelligence and historical context, assesses severity, and either closes it with documentation or escalates it with a full investigation summary for human review.

The Two-Layer Agentic SOC Architecture

Microsoft’s April 2026 framework describes two functional layers:

Layer 1: Deterministic Autonomous Disruption

This layer handles known, high-confidence threat patterns with fully automated responses. No human review required. Examples include:

• Known malware signatures detected on an endpoint: automatic isolation
• Credential stuffing attack against an authentication endpoint: automatic session revocation and MFA enforcement
• Brute force attempt exceeding threshold: automatic IP block and account lockout

The defining characteristic of Layer 1 is speed: responses execute in seconds without waiting for any human decision.

Layer 2: Generative Agentic Triage and Investigation

This layer handles novel, ambiguous, or multi-step incidents where a reasoning agent is needed to correlate signals, form hypotheses, and develop a recommended response. Examples include:

• Behavioral anomalies that don’t match known attack signatures
• Multi-stage attack chains spanning endpoint, network, and identity telemetry
• Low-and-slow intrusions that look like normal activity when any single signal is viewed in isolation

Layer 2 AI agents produce investigation summaries with recommended actions, which human analysts review and approve. The analyst’s role shifts from “process every alert” to “review AI-generated case summaries and make final decisions on complex incidents.”

Why the Alert Queue Model Is Failing

The Volume Problem

Modern enterprise environments generate thousands of security alerts per day. No human analyst team can process that volume without significant triage shortcuts. The practical result is alert fatigue: analysts tune out low-priority alerts, miss genuine signals buried in noise, and accumulate backlogs of uninvestigated cases.

The Speed Problem

Attackers are not waiting in your analyst queue. A credential theft and lateral movement sequence can complete in minutes. A ransomware pre-cursor can stage across an environment in under an hour. By the time an analyst reviews a queued alert from six hours ago, the attack may already be in its exfiltration phase.

The Talent Problem

Experienced SOC analysts are scarce and expensive. Building a human team large enough to process enterprise alert volumes at human review speed is not a viable solution for most organizations. The agentic model reduces the analyst requirement without reducing security coverage.

What Happens When Teams Stay With the Old Model

• Alert fatigue leads to missed detections
• Long mean time to detect (MTTD) allows attackers to complete operations before investigation begins
• Analyst burnout from repetitive triage work reduces retention
• Security coverage has a hard ceiling set by team headcount

The Platform Convergence Happening Now

The agentic SOC is being enabled by the convergence of tools that were previously separate:

This convergence is what BrahmaFusion by Peris.ai is built on: a single platform that integrates detection, investigation, response automation, and threat intelligence into a unified agentic operating layer.

How BrahmaFusion Powers the Agentic SOC

The No-Code AI Playbook Builder

BrahmaFusion’s no-code AI Playbook Builder allows security teams to define agentic response workflows without engineering overhead. Playbooks trigger on behavioral indicators, execute multi-step investigation sequences, and perform containment actions automatically. The result is Layer 1 and Layer 2 capability without requiring custom integration development.

A finance startup using BrahmaFusion achieved 40% SOC cost savings by replacing manual triage cycles with automated playbook execution. A leading telco reduced incident response time from 30 minutes to 3.3 minutes.

XDR Integration for Full-Spectrum Telemetry

Peris.ai‘s XDR provides the telemetry foundation that agentic investigation requires: behavioral data across endpoint, network, and cloud environments. Without full-spectrum telemetry, an AI agent investigating a complex incident will reach the same dead ends a human analyst reaches when visibility is incomplete. XDR’s cross-domain correlation enables the Layer 2 investigation capability that makes the agentic model work for novel and multi-stage incidents.

IRP for Human-in-the-Loop Escalation

Peris.ai IRP provides the case management layer where agentic investigations are escalated to human analysts. Rather than presenting raw alerts, IRP delivers AI-generated investigation summaries with full event timelines, recommended response actions, and supporting evidence. The analyst reviews, approves, and escalates. The investigation work is already done.

A finance company CEO using Peris.ai IRP reported a 35% reduction in analyst workload, exactly the shift the agentic SOC model is designed to produce.

100+ Integrations for the Converged Stack

BrahmaFusion integrates with 100+ security and IT tools, enabling the platform convergence the agentic SOC requires. Whether your environment includes legacy SIEM infrastructure, cloud-native detection tools, or a mix of vendor-specific endpoint solutions, BrahmaFusion connects across the stack and provides the unified agentic layer that the alert queue model never could.

A Real-World Agentic SOC Scenario

At 2:47 AM on a Tuesday, an anomalous authentication event fires from a legitimate employee account: the login is from an unfamiliar IP, at an unusual hour, followed immediately by access to a file server the user has never accessed before.

In a traditional alert-queue SOC: the alert sits in the morning queue. By 9 AM, an analyst picks it up. By 10 AM, they’ve confirmed it’s suspicious. By 11 AM, they’ve initiated containment. The attacker has had eight hours.

In a BrahmaFusion agentic SOC: within 90 seconds, the AI agent correlates the authentication anomaly with XDR telemetry, identifies the lateral movement pattern, cross-references INDRA CTI for similar TTPs, and executes a Layer 1 playbook: session revocation and endpoint isolation. A Layer 2 investigation summary is generated and queued for analyst review with a complete timeline. The analyst reviews and approves at 9 AM. The incident is already contained.

Benefits of the Agentic SOC with Peris.ai

Conclusion

The alert queue model served the SOC well for two decades. It is no longer adequate for an environment where attack speed is measured in minutes and alert volume is measured in thousands per day. The agentic SOC is not a future state. Microsoft, Peris.ai, and the organizations running these platforms today are demonstrating that it is the present one.

If your SOC is still built around a human-reviewed alert queue, you are already behind the operational curve. The transition to an agentic model is not just an efficiency upgrade. It is a structural security improvement.

Explore the Peris.ai Automation Layer and BrahmaFusion’s no-code AI Playbook Builder at brahma.peris.ai. Visit Peris.ai to see how leading organizations are building the agentic SOC today.

Frequently Asked Questions

What is an agentic SOC?

A security operations center in which AI agents handle detection, investigation, and triage autonomously, escalating to human analysts only for complex or high-stakes decisions. It replaces the human-reviewed alert queue model.

What are the two layers of the agentic SOC architecture?

Layer 1 handles known, high-confidence threats with fully automated responses (no human review). Layer 2 handles novel or complex incidents through generative AI investigation, producing summaries that human analysts review and approve.

Why is the traditional alert queue model failing?

Alert volume has outpaced human triage capacity, attack speed has outpaced human review cycles, and alert fatigue means genuine threats are regularly missed in high-volume queues.

How does BrahmaFusion enable the agentic SOC?

BrahmaFusion provides a no-code AI Playbook Builder, 100+ integrations, and automated response workflows that execute both Layer 1 containment and Layer 2 investigation sequences without requiring custom engineering.

What is the difference between SOAR and an agentic SOC platform?

Traditional SOAR executes predefined, rule-based playbooks. Agentic SOC platforms use AI agents that reason, adapt, and handle novel situations that predefined rules cannot anticipate.

The first NIS2 audit deadline is June 30, 2026. The full compliance deadline is October 2026. DORA has been in force since January 17, 2025. And the European Commission’s Digital Omnibus package is converging NIS2, GDPR, eIDAS, DORA, and the CER Directive into a single incident reporting pathway.

For CISOs and compliance officers at essential and important entities across Europe, the compliance runway is nearly exhausted. Essential entities face fines up to €10 million or 2% of global annual turnover for failing to meet NIS2 cybersecurity risk-management requirements. Important entities face fines up to €7 million or 1.4% of global turnover. These are not theoretical penalties; national supervisory authorities across Germany, Portugal, and Austria are already actively enforcing.

This post gives CISOs a clear, action-oriented roadmap: what NIS2 and DORA compliance requires in 2026, where most organizations still fall short, and how agentic automation dramatically shortens the compliance gap.

What Is NIS2 DORA Compliance in 2026?

NIS2 (Network and Information Systems Directive 2) is the European Union’s updated cybersecurity framework, requiring essential and important entities to implement at least 10 cybersecurity risk-management measures, including incident response capabilities, supply chain security, access control, and business continuity planning. DORA (Digital Operational Resilience Act) applies specifically to financial entities and their critical ICT third-party providers, mandating digital operational resilience testing, ICT risk management, and incident reporting frameworks. Both are in force in 2026.

Where Are Organizations Still Falling Short on NIS2 DORA Compliance?

1. Incident Reporting Timelines Are Not Operationalized

NIS2 requires notification within 24 hours of becoming aware of a significant incident, with a detailed report within 72 hours. DORA has similar requirements for financial entities. Most organizations have a compliance policy that references these timelines, but lack the automated tooling to generate the required reports at speed during an active incident when security teams are already under maximum pressure.

2. Supply Chain Security Requirements Are Broadly Unfulfilled

NIS2 Article 21 includes explicit supply chain security requirements: organizations must assess and manage security risks in their relationships with direct suppliers and service providers. For organizations with dozens or hundreds of third-party integrations, this represents a significant gap. Manual vendor assessments are neither scalable nor continuous.

3. The 10 Risk-Management Measures Are Partially Implemented

NIS2 Article 21 mandates at least 10 cybersecurity risk-management measures including: policies on risk analysis and information system security; incident handling; business continuity; supply chain security; security in network and information systems acquisition, development, and maintenance; policies and procedures for assessing cybersecurity risk-management measures effectiveness; basic cyber hygiene practices and cybersecurity training; policies and procedures relating to cryptography; human resources security; access control policies; and asset management. Most organizations can check the policy box. Fewer have operationalized these as measurable, continuously monitored controls.

4. Management Body Accountability Is Underestimated

NIS2 explicitly places accountability on the management body of essential and important entities. Senior leadership can be held personally liable for failures to approve and oversee cybersecurity risk-management measures. This is a structural shift from treating cybersecurity as an IT department function.

What Happens When Organizations Miss the NIS2 DORA Compliance Deadline

Essential entities face administrative fines up to €10 million or 2% of global annual turnover. Important entities face fines up to €7 million or 1.4% of turnover. Beyond financial penalties, supervisory authorities can issue binding instructions, suspend certifications, and impose temporary prohibitions on individuals in managerial positions from exercising managerial functions. For financial entities under DORA, non-compliance also creates ICT risk management gaps that increase operational resilience requirements under European Banking Authority oversight.

NIS2 Compliance Gap Analysis: Where Most Organizations Stand Today

How Peris.ai Helps Close the NIS2 DORA Compliance Gap

BrahmaFusion: Automated Evidence Collection and Compliance Playbooks

BrahmaFusion is Peris.ai‘s agentic AI hyperautomation platform. For NIS2 and DORA compliance, BrahmaFusion enables automated evidence collection that continuously documents the operation of cybersecurity controls, compliance playbooks that trigger the correct notification and documentation workflows within NIS2’s 24-hour and 72-hour incident reporting windows, and continuous monitoring across 100+ integrations that generates the asset and control coverage data needed for Article 21 effectiveness measurement.

A finance startup using BrahmaFusion reduced SOC costs by 40% while increasing detection and documentation coverage, directly addressing the resource constraint that most compliance teams face.

Peris.ai IRP: Audit-Ready Incident Documentation and Response Timelines

Peris.ai IRP provides the structured incident case management that NIS2 and DORA notification requirements demand. When an incident is detected, IRP automatically generates a timestamped case record, MITRE ATT&CK mapping, AI-powered incident summaries, and response timeline documentation aligned to regulatory reporting windows. The incident report that supervisory authorities request is generated as part of the response process, not assembled afterward under deadline pressure.

INDRA CTI: Continuous Threat Intelligence for NIS2 Article 21 Risk Management

NIS2 Article 21 requires organizations to conduct ongoing risk analysis and information system security assessments. INDRA CTI provides the continuous external threat intelligence that informs this risk analysis: real-time intelligence on vulnerabilities affecting your industry sector, threat actor campaigns targeting your supply chain partners, and early warning on zero-day exploits being weaponized against your technology stack.

Real-World Scenario: Meeting a 24-Hour NIS2 Notification Requirement Under Pressure

A financial services essential entity under NIS2 detects at 11pm on a Friday that a threat actor has accessed a customer data environment through a compromised vendor integration. The security team is managing active containment while simultaneously needing to generate a notification to their national supervisory authority within 24 hours.

Peris.ai IRP’s automated documentation has already compiled: the incident timeline from first detection through containment actions, the affected systems and data categories, the MITRE ATT&CK techniques observed, and the initial impact assessment. BrahmaFusion’s compliance playbook generates a draft NIS2 initial notification aligned to Article 23 requirements, pre-populated with verified incident data.

The compliance team reviews and submits the notification at 8am Saturday, well within the 24-hour window. The 72-hour detailed report is pre-populated from IRP’s continuous case documentation. No compliance deadline is missed, and the security team’s containment effort is not disrupted by parallel documentation demands.

Benefits at a Glance

Conclusion

The NIS2 DORA compliance deadline is not a future problem. It is a present operational requirement. Essential and important entities that have not operationalized their Article 21 controls, automated their incident reporting workflows, and established continuous risk monitoring have months, not years, to close the gap before audit exposure becomes financial liability.

BrahmaFusion, Peris.ai IRP, and INDRA CTI give compliance teams and CISOs the automation infrastructure to meet NIS2 and DORA requirements at operational speed, without multiplying headcount. The compliance journey starts with visibility. Build it now.

Learn how platforms like BrahmaFusion by Peris.ai empower compliance teams to automate evidence collection, accelerate incident reporting, and maintain continuous control effectiveness documentation. Want more insights? Visit Peris.ai.

Frequently Asked Questions

What is the NIS2 compliance deadline in 2026?

The first NIS2 audit deadline is June 30, 2026, with full compliance required by October 2026. DORA has been in force across all EU nations since January 17, 2025.

What are the fines for NIS2 non-compliance?

Essential entities face fines up to €10 million or 2% of global annual turnover. Important entities face fines up to €7 million or 1.4% of global annual turnover, as well as potential personal liability for management body members.

What does NIS2 Article 21 require?

NIS2 Article 21 mandates at least 10 cybersecurity risk-management measures including incident handling, supply chain security, access control, risk analysis, business continuity, cryptography policies, asset management, and effectiveness measurement.

How does DORA differ from NIS2?

DORA applies specifically to financial entities and their critical ICT third-party providers, focusing on digital operational resilience testing, ICT risk management frameworks, and ICT incident reporting. NIS2 is broader, covering essential and important entities across multiple sectors with cybersecurity risk-management requirements.

How can automation help with NIS2 DORA compliance?

Automation addresses the two biggest compliance execution gaps: incident reporting timelines and continuous control documentation. Platforms like BrahmaFusion by Peris.ai generate compliance-ready documentation during incidents and maintain continuous control evidence that satisfies Article 21 effectiveness measurement requirements without manual compilation.

Indonesia’s digital economy will reach $360 billion by 2030. It already faces 3,300 cyberattacks per week. The cyber defenses are not keeping pace with the growth.

In 2030, Indonesia is projected to host ASEAN’s largest digital economy at $360 billion, up from $130 billion in 2025. It will be one of the fastest-growing digital markets in the world: hundreds of millions of internet users, a booming e-commerce sector, a rapidly digitalizing government, and an explosion of fintech adoption.

And right now, in 2026, Indonesia is already the most attacked nation in the ASEAN region. An average of 3,300 cyberattacks per week, measured across the February to August 2024 period. Nation-state actors. Ransomware groups. BEC fraud operations. Data theft campaigns. All targeting Indonesia because it is valuable, growing, and, in many respects, still building the cyber defenses its ambitions require.

The gap between Indonesia’s digital growth trajectory and its cybersecurity readiness is not just a technology problem. It is a business risk that every enterprise operating in the country needs to take seriously, now, before the next wave of attacks finds the vulnerabilities that current defenses are not monitoring.

Why Is Indonesia the Most Attacked Nation in ASEAN?

Indonesia’s vulnerability is structural, not accidental. Several converging factors make it a disproportionately attractive target:

Scale Without Equivalent Security Investment

The Indonesian digital economy’s scale is enormous: 277 million people, widespread mobile-first internet adoption, and one of the highest smartphone penetration rates in the Asia-Pacific. This scale creates a massive attack surface. But the security investment has not scaled proportionally. Many organizations, particularly small and mid-sized enterprises, operate with minimal dedicated cybersecurity capability.

Regulatory Gap During a Period of Rapid Growth

Indonesia and the Philippines are the only ASEAN nations without a dedicated cybersecurity law. Indonesia relies on broader information technology regulations to address cyber incidents. This creates a compliance environment where security standards are inconsistent across sectors, breach reporting obligations are unclear, and minimum security baselines are unevenly enforced.

The RUU Keamanan Siber dan Ketahanan Siber is in progress, and BSSN is being elevated to ministerial equivalent status. But until these frameworks are fully enacted and enforced, organizations face a regulatory environment that does not compel cybersecurity investment at the pace the threat landscape demands.

Nation-State Interest in ASEAN Infrastructure

Salt Typhoon compromised 600+ organizations across 80 countries specifically targeting telecommunications infrastructure. ASEAN’s rapidly expanding 5G networks and digital government platforms are directly in the crosshair of nation-state espionage operations. Indonesia’s growing role in ASEAN’s digital economy makes its infrastructure strategically valuable as an intelligence target.

What Happens When Digital Growth Outpaces Cyber Defense

• Fintech platforms with millions of users operate on infrastructure with limited security monitoring
• Government digital services hold sensitive citizen data protected by inconsistent security standards
• Supply chain attacks targeting Indonesian vendors cascade into multinational organizations through partner integrations
• Ransomware groups increasingly target Indonesian organizations, knowing response capability is often limited
• 3,300 attacks per week means approximately 470 attacks every single day, against organizations of all sizes

Indonesia in the ASEAN Cybersecurity Landscape

ASEAN’s cybersecurity landscape is characterized by significant variation in maturity across member states:

• Singapore: Highest cybersecurity maturity in ASEAN, comprehensive legal framework, mandatory breach reporting
• Malaysia, Thailand, Vietnam: Progressing regulatory frameworks with increasing enforcement
• Indonesia, Philippines: Highest attack volumes, developing regulatory frameworks, significant investment gaps

ASEAN’s overall cybersecurity posture is constrained by a lack of homegrown cybersecurity capabilities and a unified regional framework. The ASEAN Cybersecurity Cooperation Strategy (CCS) 2021-2025 aimed to address this through policy harmonization, but national implementation has been uneven.

Peris.ai is uniquely positioned in this landscape: headquartered in Singapore with offices in Jakarta (Tokopedia Care Tower), Peris.ai provides regional coverage for ASEAN organizations navigating this complex and rapidly evolving threat environment.

The Old Way vs. The New Way: Cybersecurity for Indonesia’s Digital Economy

How Does Peris.ai Support Indonesian Enterprises?

As an agentic AI cybersecurity company with a registered presence in Indonesia and operational knowledge of the BSSN regulatory environment, Peris.ai is positioned to help Indonesian and ASEAN enterprises build the security capabilities their digital growth requires.

Full platform coverage for Indonesian enterprise environments:

• XDR: Unified detection across endpoint, network, and identity layers, providing the comprehensive threat visibility that traditional perimeter security cannot deliver
• EDR: Endpoint protection covering the diverse device environments common in Indonesian enterprise and SME contexts
• NVM: Network Visibility Monitor providing packet-level inspection to detect nation-state lateral movement and data exfiltration patterns
• INDRA CTI: Real-time threat intelligence with threat actor attribution covering ASEAN-relevant campaigns including Salt Typhoon, Handala, and ransomware groups actively targeting Indonesian organizations
• BrahmaFusion: Agentic AI and hyperautomation platform enabling lean security teams to operate at enterprise scale

The regional presence advantage:

Peris.ai’s Jakarta office means in-country expertise for Indonesian organizations navigating the specific regulatory requirements of BSSN compliance, UU PDP implementation, and the forthcoming cybersecurity law. This is not remote support from Singapore. It is local understanding of the threat landscape, the regulatory environment, and the operational realities of Indonesian enterprise security.

A leading telco using Peris.ai’s platform reduced incident response time from 30 minutes to 3.3 minutes, directly relevant to an environment where 3,300 weekly attacks mean the response clock is always running.

Real-World Scenario: Protecting an Indonesian Fintech During Rapid Growth

An Indonesian fintech platform has grown from 500,000 to 4 million users in 18 months. Its security infrastructure has not scaled proportionally. The platform processes $2 billion annually in transactions and holds personal and financial data for 4 million customers.

Without comprehensive security: The platform is targeted by a ransomware group that identifies its rapid growth and limited security monitoring as an opportunity. Initial access is gained through a credential stuffing attack on a poorly monitored administrative interface. The attack is not detected for 11 days.

With Peris.ai full platform deployment:

• INDRA CTI surfaces credential stuffing activity targeting the fintech’s domain from a known threat actor infrastructure within hours of initial attack attempts.
• EDR detects anomalous authentication patterns on the administrative interface and triggers an alert.
• BrahmaFusion automatically locks the compromised administrative account and initiates an investigation playbook.
• The security team receives a complete incident report. The attack is contained before lateral movement begins.

Four million customer records protected. Business continuity maintained.

Benefits of the Peris.ai Platform for Indonesian Enterprise Security

Conclusion

Indonesia’s path to a $360 billion digital economy is one of the most compelling growth stories in the Asia-Pacific. But every additional billion dollars in digital economic value increases the attractiveness of Indonesia as a cyber target. The organizations that will succeed in this environment are those that build their security posture ahead of their growth curve, not after the breach that makes it a priority.

Peris.ai, with offices in Singapore and Jakarta, is built for exactly this challenge. Real-time threat intelligence, agentic AI response, and regional expertise in the ASEAN threat landscape.

Learn how Peris.ai supports Indonesian enterprise security at peris.ai. Your digital ambition deserves protection that matches its scale.

Frequently Asked Questions

Why is Indonesia the most attacked nation in ASEAN?

Indonesia combines several factors that make it a disproportionately attractive cyber target: ASEAN’s largest population (277 million), one of the region’s fastest-growing digital economies, relatively high-value targets across fintech and e-commerce, and a regulatory environment still developing the enforcement mechanisms to compel consistent security investment across sectors.

How does Indonesia’s lack of a dedicated cybersecurity law affect enterprise security?

Without a dedicated cybersecurity law, Indonesia lacks unified minimum security standards, clear breach reporting obligations, and consistent enforcement across sectors. This creates a compliance environment where security investment is driven by each organization’s own risk assessment rather than regulatory requirement, resulting in significant variation in security maturity across the Indonesian enterprise landscape.

What is Peris.ai’s presence in Indonesia?

Peris.ai has an office at the Tokopedia Care Tower in Jakarta and is registered with BSSN, Indonesia’s national cybersecurity agency. This gives Peris.ai both the regulatory standing and the in-country expertise to support Indonesian enterprises navigating the specific requirements of the BSSN framework, UU PDP compliance, and the forthcoming cybersecurity law.

What should Indonesian enterprises prioritize for cybersecurity investment in 2026?

Given the 3,300 weekly attacks and the imminent strengthening of BSSN’s enforcement powers, Indonesian enterprises should prioritize: unified threat detection coverage (XDR/EDR/NVM), automated incident response capability (IRP/SOAR), real-time threat intelligence relevant to ASEAN threat actors (INDRA CTI), and documentation of security controls for regulatory compliance. Peris.ai’s full platform addresses all four of these priorities.

The $200 Toolkit That Killed Your MFA

For years, security teams have told executives that multi-factor authentication stops phishing. In 2026, that statement is no longer technically accurate. The reason is a commoditized class of phishing infrastructure called adversary-in-the-middle, or AiTM, that you can rent on a dark web marketplace for less than the cost of a mid-tier streaming bundle.

AiTM kits including Tycoon 2FA, Rockstar 2FA, EvilProxy, Greatness, and Mamba 2FA have industrialized session-token theft. They defeat OTP, push notifications, and even hardware tokens used as a second factor. The CrowdStrike 2026 Global Threat Report attributes 82% of detections in 2025 to malware-free identity abuse, and AiTM session theft is the dominant pattern inside that majority.

This post is a technical breakdown. We will look at how AiTM kits work at the HTTP layer, what telemetry signatures detection engineers can hunt, and how Peris.ai builds session-anomaly detection that survives the new normal.

What Is an AiTM Phishing Kit?

An adversary-in-the-middle phishing kit is a reverse proxy that sits between a victim and a legitimate authentication portal. The victim believes they are typing credentials into Microsoft 365 or Google Workspace. They are. The credentials reach the real provider. The MFA challenge fires. The victim approves it. And at the moment the session cookie is issued, the attacker captures it from the proxy, ending the legitimate authentication on the victim side and resuming it on the attacker side.

From the user’s perspective, login worked. From the attacker’s perspective, the user just delivered a fully authenticated session.

Anatomy of the attack flow

• Phishing email or messaging lure points to a look-alike URL.
• The look-alike URL is the AiTM reverse proxy.
• The proxy fetches the legitimate Microsoft or Google login page in real time.
• The victim enters credentials. The proxy relays them.
• The legitimate provider issues an MFA prompt. The victim approves it.
• The session cookie is issued. The proxy logs the cookie and the credentials.
• The attacker replays the session cookie to the legitimate service and is now logged in as the user.

Which MFA Methods Survive AiTM, and Which Do Not?

WebAuthn and FIDO2 are the only widely deployed phishing-resistant standards. CISA’s Phishing-Resistant MFA Implementation Guidance, updated in 2025, explicitly recommends FIDO2 as the standard for high-value identities.

What Detection Engineers Should Hunt

AiTM activity leaves telemetry, but it lives at the seam between authentication logs and session cookie issuance. Detection engineers should baseline and alert on:

• Successful authentication followed by session cookie issuance to an unexpected source IP within seconds.
• TLS fingerprint anomalies, particularly JA3 or JA4 mismatches between the user’s normal client and the source of cookie reuse.
• User-agent strings that do not match the user’s installed inventory.
• Geographic impossibility patterns: successful login from country A, session token used from country B within sixty seconds.
• Anomalous OAuth consent grants immediately following AiTM-pattern logins, which often persist access after credential rotation.
• Mass campaigns targeting energy, finance, and government sectors via SharePoint and Outlook Web Access proxies, consistent with the January 2026 multi-stage AiTM campaign observed by Microsoft.

The Problem: Why Traditional SIEM Misses AiTM

Most SIEM detections operate on authentication events. From the SIEM’s point of view, the login succeeded, MFA was satisfied, and the session is healthy. The fraudulent reuse of the cookie happens out-of-band, often from a different network, and looks like normal user activity unless behavioral baselines are explicit.

This is the structural reason AiTM has become the dominant initial access vector for BEC, VEC, and ransomware deployment in 2026. The kit is cheap, the defenders’ tooling is misaligned, and the user behaves correctly throughout.

How Peris.ai Detects and Contains AiTM Sessions

Peris.ai’s agentic AI cybersecurity stack treats identity as the new perimeter and correlates authentication events with session behavior in real time. Three components carry the detection load.

XDR for identity threat detection

Our XDR ingests authentication and session-cookie telemetry across Microsoft Entra ID, Google Workspace, Okta, and on-premises identity providers. It compares each successful authentication to the user’s behavioral baseline: typical source IPs, TLS fingerprints, user-agent strings, and session reuse patterns. When the post-authentication session deviates, XDR raises an identity-tier anomaly.

BrahmaFusion for automated session revocation

When XDR raises the alert, BrahmaFusion executes the response playbook in seconds. It revokes the active session, forces a step-up authentication, and isolates downstream systems the user had access to. A Peris.ai telco client reduced response time from 30 minutes to 3.3 minutes after BrahmaFusion deployment. Identity-tier incidents are a perfect fit for that automation gain.

INDRA CTI for AiTM kit infrastructure intelligence

INDRA CTI maintains attribution-grade intelligence on AiTM kit operators: domain registration patterns, hosting providers, TLS fingerprints, and kit-specific signatures. When a phishing URL is flagged in your gateway logs, INDRA CTI tells you which kit family hosted it and which downstream actors typically operate it.

Use Case: From Login to Lockout in Under Five Minutes

A mid-size financial firm using Peris.ai sees the following sequence one afternoon.

• An employee receives a phishing email pointing to a Tycoon 2FA-hosted reverse proxy.
• The employee enters credentials and approves the MFA push.
• Microsoft Entra ID logs a successful authentication. The session cookie is issued.
• Within 1.7 seconds, our XDR observes the same session cookie reused from a source IP previously unseen for this user, with a JA4 TLS fingerprint inconsistent with the user’s known clients.
• INDRA CTI confirms the source IP is part of an active Tycoon 2FA campaign cluster.
• BrahmaFusion revokes the session, forces password reset and step-up to a passkey, and opens an IRP case with the full evidence trail.
• Time from successful proxy login to attacker lockout: under five minutes.

For comparison, without behavioral session detection and automation, similar campaigns historically reach mailbox access, OAuth consent persistence, and downstream BEC within an hour.

Outcomes That Matter

Conclusion

The defining phishing technique of 2026 is not cleverness. It is commodity. AiTM kits at USD 200 per month make MFA bypass the default initial access path, not an edge case. Security teams that still equate MFA with phishing resistance will keep losing identities they thought were protected. The path forward is autonomous threat detection at the session layer, phishing-resistant authentication for high-value identities, and the agentic AI cybersecurity backbone that ties them together. Peris.ai is built for that operating model.

Explore the Peris.ai Automation Layer at brahma.peris.ai.

FAQ

What is an AiTM phishing kit?

An adversary-in-the-middle phishing kit is a reverse proxy framework that relays credentials and MFA prompts between a victim and a legitimate provider, capturing the post-authentication session cookie so the attacker can impersonate the user.

Which AiTM kits are most active in 2026?

Tycoon 2FA, Rockstar 2FA, EvilProxy, Greatness, and Mamba 2FA are the most observed AiTM kits according to Talos Intelligence 2026 reporting and Microsoft Threat Intelligence.

Does WebAuthn stop AiTM phishing?

Yes. WebAuthn and FIDO2 bind the cryptographic challenge to the legitimate origin URL, so a reverse proxy cannot replay the authentication. This is the only widely deployed MFA family that is structurally resistant to AiTM.

What telemetry detects AiTM session theft?

Key signals include session cookie reuse from a new source IP within seconds of legitimate login, JA3 or JA4 TLS fingerprint mismatches, and user-agent strings inconsistent with the user’s known clients. Peris.ai XDR baselines and alerts on these.

How fast can Peris.ai contain an AiTM incident?

Peris.ai customer deployments contain AiTM session theft in under five minutes, with mean response times improved by an order of magnitude over manual SIEM workflows.