October is Cybersecurity Awareness Month, and this year’s theme is Don’t Make It Easy for Them.
AI is lowering the barriers to cybercrime. Malicious actors can use it to generate highly convincing phishing emails, impersonate trusted individuals and scale social engineering campaigns. According to Lockton’s 2026 Cyber Threat Report (opens a new window) and CrowdStrike, an 89% increase in attacks by AI-using adversaries was recorded in 2025, while average breakout time fell to 29 minutes, a 70% reduction since 2021.
In Asia-Pacific, 71% of organizations rank AI as their top data security risk. Yet the weakest link remains human: A human element is found in 62% of breaches, and the Lockton report highlights that non-malicious incidents caused by internal decisions and mistakes, are rising from 11% of cyber incidents in 2021 to 25% in 2024. These findings illustrate why employees are the first line of defense.
Four Cybersecurity Habits to Keep Your Computer and Data Safe
AI-enabled attacks are more sophisticated, but we are not consigned to being easy targets. Build these habits at work to make life difficult for cybercriminals:
Use strong passwords and a password manager: Create long, unique passwords for every account and store them in a secure password manager. The stakes are real: in 2025, hackers exploited weak passwords to seize control of water valves at a Norwegian dam and increase the flow by 500 liters per second for four hours, the Lockton report notes.
Turn on multifactor authentication: MFA protects accounts even if passwords are stolen. Australia’s privacy regulator alleges Medibank’s VPN lacked MFA when criminals used a contractor’s stolen credentials, exposing 9.7 million customers’ data. Lockton and insurance markets rank MFA among the most effective preventive measures.
Recognize and report scams: Stay alert to phishing emails, suspicious links and unexpected voice or video requests, even from familiar names. Scams are costly across the region: S$913.1 million lost in Singapore in 2025, where 81.8% of cases involved victims manipulated into transferring money themselves, and RM2.97 billion in Malaysia. In Thailand, the central bank says funds leave a victim’s account in about three minutes, yet victims take 18 hours on average to realize. Report suspected scams immediately and verify payment requests through a second trusted channel; Lockton recommends dual approvals and callback verification.
Update your software: The patching window is closing. In 2018, defenders had around 63 days between a flaw becoming public and being exploited; Mandiant puts the estimated average at minus seven days, meaning attacks often begin before a patch exists. Google tracked 90 zero-days exploited in 2025, a record 48% aimed at enterprise technology.
Good Habits Lower the Odds, Resilience Limits the Damage
Although good cyber hygiene remains the foundation of cyber resilience, no organization can eliminate cyber risk completely. When cyberattacks succeed, the consequences can be severe: IBM-Ponemon found 86% of breached organizations suffered operational disruption and 76% needed over 100 days to recover. One business email compromise at a medium-sized healthcare company cost its cyber policy US$2.4 million across breach response, a class action and a government investigation demand.
Insurers now look for evidence of controls such as MFA and incident response readiness, and insured companies have shown greater resilience. Cyber Risk assessment and insurance complete the picture, making it harder for threat actors to gain a foothold.
How AI changes the claims picture
AI is not creating a new class of loss so much as acting as a force multiplier, increasing the frequency and severity of traditional cyber, crime, professional indemnity and D&O claims. Today's most credible AI-related losses are AI-assisted ransomware and extortion, where attackers move faster and need less technical skill, and deepfake-enabled fraud, where cloned voices and video trick staff into sending money. Beyond attacks, a company's own AI use brings exposures such as wrong outputs, data leakage and autonomous errors, which may fall outside a cyber policy.
How Lockton Can Help
Good habits start with awareness, and resilience takes more than good habits. Our Cyber & Technology team helps organizations in Asia inform themselves about their cyber exposure, improve their resilience and insure residual risks. For further information, visit Cyber & Technology practice page (opens a new window).
Sources: Lockton 2026 Cyber Threat Report (opens a new window) (citing CrowdStrike, Verizon DBIR, IBM-Ponemon, Munich Re); Thales 2026 Data Threat Report; UnitedHealth Group CEO testimony to the US Senate Finance Committee (1 May 2024); Office of the Australian Information Commissioner v Medibank (Federal Court filing, 2024); Singapore Police Force Annual Scam and Cybercrime Brief 2025; Royal Malaysia Police / Inspector-General of Police (June 2026); Bank of Thailand (BOT Symposium 2025); Mandiant M-Trends 2026; Google Threat