Feb 2026
Lim May-Ann
In 2026, CCAPAC observes that the traditional approach towards protecting a “network perimeter” has collapsed. With remote work options driving organizational work, multi-cloud ecosystems being de rigueur, and agentic AI/autonomous AI agents quite possibly outnumbering humans very soon, the “castle-and-moat” security model has collapsed.
There is no longer a “reliable” internal network versus a “dangerous” external one. In this decentralized landscape, identity has emerged as the sole remaining boundary between an attacker and your organization’s most sensitive assets.
The Rise and Fall Failure of the “Shared Secret” Password
The password, a “shared secret” between a user and a server/resource, has become fundamentally incompatible with the 2026 threat landscape.
Generative AI has weaponized social engineering (see our CCAPAC 2025 Annual Report on AI Security in 2025 and Beyond: Emerging Threats and Solutions), allowing attackers to automate the creation of hyper-personalised phishing campaigns and real-time deepfakes that can bypass traditional knowledge-based authentication.
Agentic AI has also led to the creation and proliferation of machine identities i.e. credentials used by AI agents and IoT devices. Managing these through password systems is impossible. When an automated agent might be compromised in milliseconds to trigger a cascade of unauthorised data transfers, the password is no longer a tool; it is a vulnerability.
Zero Trust: The Identity-Centric Architecture
To address this vulnerability, organisations and governments have pivoted to Zero Trust Architecture (ZTA), which operates on the principle of “Never trust, always verify”. Under Zero Trust, access is never granted based purely on location (e.g., being on the office Wi-Fi); instead, every request is authenticated and authorized based on a dynamic combination of identity factors:
- Who you are/verified identity: Is the user (human or machine) who they say they are?
- What’s your device health: Is the hardware used a known hardware? Is it secure and up to date?
- Where are you, addressing contextual risk: Is the request coming from an unusual location or at an odd time?
- Do you need to know this? Invoking principle of least privilege: Does this identity need access to this specific resource to perform its current task?
The Asia-Pacific Context: A Region at Risk
The Asia-Pacific region faces a unique set of challenges in this transition. As the global centre for fintech and high-tech manufacturing, our “attack surface” is vast and high-value.
- The Deepfake Frontier: Southeast Asian financial hubs have seen a surge in “camera injection” attacks, where AI-generated video is used to spoof biometric “liveness checks” during remote onboarding.
- Legacy Interdependence: Many APAC enterprises may be “hybrid-heavy,” where companies use cutting-edge AI tools, but authenticate them through legacy, password-heavy systems. This creates a “soft middle” that may lack the API hooks necessary for modern identity orchestration – and that attackers are aggressively exploiting.
- Mobile-First Vulnerability: While APAC leads in mobile payments, the reliance on SMS-based multi-factor authentication (MFA) remains high. In 2026, AI-driven “SIM swapping” and intercepting one-time passcodes (OTPs) are now trivial tasks for sophisticated syndicates.
From Checkpoints to Continuous Trust
To survive the AI economy, we must stop treating identity as a one-time “checkpoint” at login. We must move toward Continuous, Adaptive Identity. In this model, trust is never permanent. It is a score that fluctuates based on a multitude of other invisible signals. E.g.
- Does the typing cadence match the user?
- Is the user/AI agent’s behaviour consistent with its programmed mission?
- Is the device’s “liveness” telemetry (through a presentation audit) showing signs of tampering?
The Roadmap Forward for Identity
Defending the new perimeter will require a shift in how we think about “digital presence” and identity. CCAPAC offers the following suggestions:
- Kill the Password, Embrace the Passkey: Organizations must transition to phishing-resistant standards like FIDO2. By using device-bound cryptographic keys, we remove the possibility of the “secret password” bring stolen or phished.
- Govern the Machines: Similar to human employees, we must apply the same “Least Privilege” access to AI agents. An AI assistant should only have the identity permissions it needs for its specific task, with automated “just-in-time” access that expires the moment/nanosecond that the task is done.
- Invest in Behavioural Biometrics: Since AI can mimic faces and voices with indistinguishable verisimilitude, we must look at what AI cannot easily fake: the subtle, unique ways humans interact with technology. While this is not a foolproof formula, it is one additional tool in the arsenal against agentic AI threats.
- Regional Policy Alignment and Coordination on Identity Standards: Policymakers across APAC must look into coordinating on identity standards across the region. Regional standards will allow for cross-border “trust anchors” which should enable a credential verified in Singapore to be recognised and trusted in Tokyo.
For example, combining ASEAN’s work on coordinated business identities through a Unique Business Identification Number (UBIN) project, and the existing work on regional payment connectivity (together with its concomitant requirements for Know Your Customer (KYC/eKYC) verification mechanisms) could be the start to a strong ASEAN-driven identity standard.
The AI economy offers us unparalleled efficiency, but it demands a higher price for entry: the absolute certainty of who (or what) is on the other end of the connection.