AI Features in Nearly Half of Philippine Cyber Incidents as Firms Struggle to Coordinate Defenses

High exposure meets gaps in AI oversight

Ninety-three percent of Philippine organizations surveyed by Cisco experienced a cyber incident that disrupted business during the previous 12 months, and nearly half encountered attacks involving artificial intelligence. Yet only 59 percent were very confident they could detect and respond if an AI agent they used became compromised.

The findings, released on October 19, 2026, show a country performing above the global average on Cisco's defense assessment while still struggling with everyday problems: teams working separately, information scattered across systems and security measurements that executives find difficult to understand.

Philippine organizations scored an average of 70 out of 100, compared with 64 globally. Seventeen percent qualified for Cisco's strongest category, called Relentless Defenders, more than twice the global share of 8 percent.

Cisco's Relentless Defense findings place those results within a wider problem: attackers and defenders are adopting AI, but organizations often struggle to coordinate the people responsible for using and controlling it.

What the survey measured

The research covered 8,000 security professionals across 30 markets. Satori Experience conducted the survey in April and May 2026, using a double-blind approach, and Sandpiper completed the analysis and report. Chief information security officers made up 27 percent of respondents.

Cisco scored organizations on three areas: coverage, meaning how completely they protect their systems; speed, meaning how quickly they introduce controls and respond; and friction, meaning internal barriers that delay action. Friction accounted for half the score, while coverage and speed each accounted for a quarter.

Six in 10 practitioners identified an organizational barrier, rather than a technical limitation, when asked what would have most improved their response to a recent incident. The survey therefore gives considerable weight to how people work together, alongside the tools they use.

How AI is changing the threat

Philippine respondents reported a higher prevalence of disruptive incidents than the global sample: 93 percent against 91 percent. Globally, Cisco said 35 percent involved an AI-related attack, compared with the Philippine finding of nearly half.

AI can help attackers produce convincing messages, examine software for weaknesses and automate parts of a campaign. An attack involving AI can therefore include familiar methods carried out faster or at greater scale, rather than an entirely new kind of intrusion.

AI agents create another concern because they can perform tasks and take actions through connected software. A security agent might examine alerts or help investigate suspicious activity. If compromised, its access and permissions become part of the problem a security team must contain.

Philippine confidence in detecting and responding to a compromised agent stood five percentage points above the global figure of 54 percent. Even so, 41 percent of local respondents fell outside the group expressing very high confidence, leaving a substantial share uneasy about managing this risk.

Teams have tools but lack a shared view

Only 41 percent of Philippine respondents said security, networking and IT operated as one coordinated team with shared visibility and tools. A narrower finding covering cybersecurity and networking teams put the figure at 43 percent.

These functions handle different pieces of the same incident. Security staff may identify suspicious behavior, networking staff may need to restrict connections, and IT staff may have to restore affected systems. Shared information and clear authority help those actions happen together.

Thirty-seven percent of Philippine respondents said critical insights were missed because information remained inaccessible. Another 32 percent spent more time collecting and matching information across systems than addressing threats. In practical terms, staff were spending valuable response time assembling a picture of what had happened.

Cisco's published findings included an unnamed Philippine director of security who described fragmented information during the first hour of an incident. The director called for centralized communication and a single shared record to support faster decisions.

Why security spending is difficult to explain

Fifty-three percent of Philippine respondents said their security measurements were too technical to persuade executives. Twenty-eight percent struggled to turn business metrics into information that could influence decisions, while 13 percent lacked a consistent way to measure security performance.

Security teams and company leaders often need answers to different questions. A technical team may count alerts or software weaknesses. Executives deciding budgets need to understand how an investment could reduce disruption, protect important services or help the business recover faster.

Cisco's global findings show a similar communication problem. Forty-three percent said their measurements were too technical to influence executives, and 36 percent struggled to translate security data into business impact. Another 27 percent had no consistent way to measure performance accurately.

The Philippine figures reveal a particular difficulty in making technical information useful to management, even though fewer local respondents reported lacking a measurement system altogether. Having numbers available and using them to make decisions are separate tasks.

AI is also helping defenders move faster

More than nine in 10 Philippine security practitioners reported improvements of at least 25 percent in threat detection and response through AI. More than a third said AI substantially reduced their operational workload.

The global results in Cisco's full research report also show gains among respondents with AI security capabilities deployed. Eighty-seven percent reported detection speed improvements of at least 25 percent, while 85 percent reported improvements of that size in response and remediation, the work of containing an incident and fixing its effects.

AI can help organize alerts, connect related activity and handle repetitive investigation steps. For a team spending much of its time gathering information, reducing that workload can free people to decide which threats need immediate attention.

Extensive deployment of AI agents in Philippine security operations stood at 42 percent. Concerns about exposing sensitive information, compromised systems and the handling of data by outside providers continued to constrain adoption.

Globally, 41 percent cited sensitive data exposure as a major AI security concern, 40 percent worried about AI systems becoming compromised and 37 percent cited security and data handling by outside providers. Those concerns explain why organizations want tighter controls over what agents can access and do.

What stronger defenders do differently

Only 8 percent of organizations globally entered Cisco's Relentless Defenders category. The other groups were Established Defenders at 39 percent, Reactive Defenders at 41 percent and Exposed Defenders at 12 percent, reflecting different combinations of protection, response speed and internal coordination.

The Philippines placed 17 percent of respondents in the strongest category, a lead of nine percentage points over the global share. Its average defense score was also six points higher, at 70 rather than 64.

Cisco's global results connect stronger performance with coordinated operations and tighter control of AI. Its online findings put extensive AI agent deployment at 30 percent among Relentless Defenders, compared with 14 percent among other defenders. The full report's measure specifically covering deployment within security operations gives higher figures, 65 percent and 30 percent.

The same publications present different coordination figures. The online findings say 39 percent of Relentless Defenders operate as one team, compared with 19 percent globally; the full report puts coordination across security, networking and IT at 83 percent for the strongest group and 37 percent for everyone else.

Cisco's full report also says 77 percent of Relentless Defenders were very confident about detecting and responding to a compromised AI agent, compared with 51 percent of other organizations. Comprehensive controls for agents, service accounts and automated systems were reported by 86 percent of the strongest group, against 41 percent globally.

Bigger budgets need faster decisions

Among organizations that increased security spending, 71 percent of Relentless Defenders reported fewer incidents. The figure was 41 percent across the global sample and 39 percent among other organizations. Another 45 percent globally said incidents increased or stayed the same despite higher spending.

Cisco's findings put attention on what happens after a purchase is approved. Globally, only 21 percent said they could fully deploy a new security control within six months after budget and approval had cleared. Fourteen percent could update controls in real time when a new threat appeared, while another 26 percent could do so within 24 hours.

A control is a protective measure, such as restricting access or blocking suspicious activity. Delays in putting it into operation leave security teams waiting even when a company has agreed to pay for protection.

Zaza Soriano-Nicart, managing director of Cisco Philippines, said companies needed to make security part of daily operations and remove barriers between teams:

The organizations that stay ahead will be those that embed security into how they operate, treat it as more than a compliance exercise, and break down operational silos so the right people can make the right decisions at the right time.

Cisco's recommendations include assigning decision authority before an incident, giving teams one shared picture of security information and rehearsing response plans. It also recommends limiting early automation to defined tasks, allowing AI to handle repetitive work while people retain responsibility for sensitive decisions.

The dates and details still missing

The research describes experiences over the 12 months preceding the survey, with fieldwork and publication taking place several months apart:

• Previous 12 months: Respondents described disruptive cyber incidents and their experience using AI in defense.
• April and May 2026: Satori Experience surveyed 8,000 security professionals across 30 markets.
• October 19, 2026: The Philippine findings were released, including the country's score of 70 out of 100.

The Philippine findings do not give an exact percentage for attacks involving AI or a local financial loss total. They also do not identify the affected companies. The published methodology gives the global sample size but no Philippine respondent count.

For Philippine businesses, the concrete challenge is to connect relatively strong assessed capabilities with faster action: fewer inaccessible records, clearer responsibility during incidents and controls that keep pace with the AI systems being introduced.

Key Points

• Ninety-three percent of Philippine organizations surveyed experienced a disruptive cyber incident during the previous 12 months; nearly half encountered attacks involving AI.
• Only 59 percent were very confident they could detect and respond to a compromised AI agent.
• The Philippines scored 70 out of 100, above the global average of 64, and placed 17 percent of organizations in Cisco's strongest category.
• Forty-one percent reported coordinated security, networking and IT teams; 32 percent spent more time gathering information than addressing threats.
• More than nine in 10 Philippine practitioners reported detection and response improvements of at least 25 percent through AI.
• Cisco recommends clearer decision authority, shared security information, practiced response plans and controlled automation.