Frost & Sullivan in conversation with Adrian Hia, Managing Director, Asia Pacific, Kaspersky
By Kenny Yeo, Vice President, Frost & Sullivan
Last year, I sat down with Adrian Hia, Managing Director, Asia Pacific at Kaspersky, for a Frost & Sullivan Growth Podcast on how enterprises in Asia-Pacific can move from AI hype to cyber resilience. One theme we only touched on briefly was the growing complexity between IT and operational technology (OT).
In August, we returned to the studio in Singapore to go one layer deeper into industrial cybersecurity: the cameras, meters, controllers, and connected machines that keep factories, buildings, hospitals, utilities, and transport networks running.
Our conversation reinforced a view we increasingly hear from clients across the region. As OT converges with IT, cloud, the Industrial Internet of Things (IIoT), and now AI, the industrial edge has become part of the enterprise attack surface. And the first gap to close is not technology. It is visibility.
OT Is Now Part of the Enterprise Attack Surface
For decades, cybersecurity programs were built around corporate networks, endpoints, and business data. OT sat in a separate world, managed by engineering and facilities teams and often assumed to be isolated.
That separation is disappearing. Adrian used a simple, everyday example to illustrate the point: the CCTV camera. As surveillance moves from analog to IP-based cameras, video and images are now stored and transmitted across the corporate network. A device that was once peripheral becomes a networked endpoint, and a potential pathway into the data center.
“Today, if you look at a CCTV moving from an analog device to a digital device, all IP cameras means that you’re starting to store all your videos and images on this.”
— Adrian Hia, Managing Director, Asia Pacific, Kaspersky
The threat data supports this concern. Kaspersky ICS CERT’s Threat landscape for industrial automation systems, Q2 2026 report found malicious objects blocked on 19.2% of industrial control system (ICS) computers globally, with East Asia higher at 21.8%. The share of ICS computers targeted by ransomware also rose in almost every region, including by 50% quarter-on-quarter in Southeast Asia and 67% in Australia and New Zealand.
For Asia-Pacific organizations, the implication is clear: industrial cybersecurity is no longer a niche engineering concern. It is a business continuity issue that belongs on the CIO, CISO, and board agenda.
You Cannot Protect What You Cannot See
If there was one message Adrian returned to repeatedly, it was visibility.
Most IT teams can quickly list their laptops, servers, and cloud instances. Ask how many IP cameras, smart meters, building controllers, or connected sensors are deployed, and the answer is far less certain. Many of these assets are bought and run by facilities, engineering, or plant teams, outside the CIO’s line of sight.
Adrian described this as one of the most significant blind spots he sees across customers in the region. Without an accurate picture of what is connected, security teams cannot:
- Assess real exposure across the IT and OT estate
- Identify vulnerable or unsupported devices
- Understand how OT assets connect to corporate networks, cloud services, and third parties
- Prioritize which systems are truly critical to operations
Frost & Sullivan’s research for the 2026 Asia-Pacific Converged IT and OT Security Product Leadership Recognition points to the same issue. Organizations in the region contend with legacy systems not designed for connectivity, fragmented infrastructure, limited visibility across IT and OT, and a shortage of specialized skills.
In our view at Frost & Sullivan, asset visibility is the foundation on which every other OT security control depends. Segmentation, monitoring, threat detection, and incident response are all only as effective as the inventory they are built on.
AI Is Widening the Attack Surface, Including at the Industrial Edge
AI is now commonplace in both our work and personal lives, and industrial organizations are no exception. AI is being applied to predictive maintenance, process optimization, quality inspection, and operational monitoring, while AI agents promise to take on more routine tasks.
Yet every new AI capability introduces new systems, data flows, and access paths that attackers can target. Adrian stressed that the risk is not limited to sanctioned enterprise AI projects. AI agents and tools downloaded locally by employees or operational teams can be just as dangerous, and he highlighted cases of Trojans, malware, and worms embedded in such tools.
This is not a theoretical concern. Between January and early May 2026, Kaspersky detected more than 92,000 attacks involving malware and potentially unwanted applications disguised as popular AI agents and services, and identified more than 15,000 malware samples masquerading as agentic AI software.
For industrial environments, the stakes are higher. An unvetted AI tool on an engineering workstation that connects to OT systems is not just an IT hygiene issue. It can become a bridge between the corporate network and physical operations.
AI security therefore cannot be a separate workstream. It must be built into the wider cybersecurity program, with clear rules on which AI tools are permitted, what they can access, and how they are monitored.
Why OT Security Demands a Different Playbook
One of the most common mistakes we see is the assumption that OT can be secured simply by extending IT controls into the plant. The two environments have fundamentally different priorities.
Adrian illustrated this with the challenge of maintaining systems while they run. A business application can be taken offline for a scheduled patch. Shutting down a power distribution system, production line, or hospital building system has immediate physical and safety consequences.
| Dimension | Enterprise IT | Operational Technology (OT) |
| Top priority | Confidentiality and data protection | Availability, safety, and operational continuity |
| Asset lifecycle | Typically three to five years | Often 15 to 20 years or longer, with legacy systems still in service |
| Patching and changes | Regular, scheduled maintenance windows | Limited windows; changes may require shutdowns and vendor validation |
| Asset ownership | Centrally managed by IT | Often managed by facilities, engineering, or plant operations |
| Impact of an incident | Data loss, financial, and reputational damage | Physical disruption, safety risk, and loss of essential services |
The belief that “air-gapped” systems are automatically safe also needs challenging. With remote access, vendor maintenance links, removable media, and cloud analytics, organizations must understand how data and devices actually move between systems rather than rely on network separation alone.
For Adrian, strengthening OT security is a journey rather than a single project. Organizations need to build capabilities progressively, moving toward a unified view of risk across both IT and OT.
This reflects what we see across the region. Asia-Pacific remains a heterogeneous market, with mature OT security buyers in some countries and first-time adopters in others. Approaches that cut risk quickly with minimal disruption, while preparing for longer-term IT/OT convergence, are the ones that will scale.
Three Priorities for Strengthening Industrial Cyber Resilience
Drawing from our conversation, and consistent with what Frost & Sullivan is seeing across Asia-Pacific, there are three practical priorities for organizations starting or advancing their OT security journey.
- Secure AI before it secures a foothold
Treat AI tools and agents as part of the attack surface. Define which tools are approved, vet downloaded agents and models before use, and limit the data and OT systems they can reach. - Establish visibility across OT assets
Maintain an accurate inventory of OT devices and systems, from IP cameras and smart meters to controllers and engineering workstations, and map how they connect to IT, cloud, and third parties. Visibility is the prerequisite for deciding where protection is needed most. - Assess your posture and bring in specialist expertise
As Adrian noted, an OT security assessment establishes where an organization stands today and is a practical starting point. Given the region’s OT skills shortage, experienced specialists can accelerate progress while internal capabilities are built.
Key Questions for CIOs, CISOs, and Operations Leaders
As you plan for 2027, these are the questions I would encourage leadership teams to ask:
- Do we have a complete, current inventory of every connected OT and IoT device across our sites?
- Who owns OT security today, and is accountability clear between IT, security, and operations?
- Which AI tools and agents are being used in or near our operational environments, and who approved them?
- If a critical OT system were compromised tomorrow, how quickly could we detect it, contain it, and keep operating?
Conclusion: Visibility Before Resilience
As IT, OT, cloud, IIoT, and AI converge, industrial cybersecurity has become a business resilience issue. A security failure can now disrupt production, essential services, and public safety, not just information systems. It is no surprise that Frost & Sullivan identifies cyber-physical convergence and operational resilience across IT/OT ecosystems among the top growth opportunities shaping cybersecurity in 2026.
The good news is that the first step does not require a major transformation. It starts with knowing what you have, how it is connected, and which risks matter most. The question for leaders is no longer how to secure individual systems, but how to maintain visibility and resilience across an increasingly connected, AI-enabled operational environment.
Watch the full conversation between Kenny Yeo and Adrian Hia on the Frost & Sullivan Growth Podcast. To discuss how these trends affect your organization, connect with the Frost & Sullivan Asia-Pacific ICT and Security team.
