AI Can Write Your Code. It Can't Sign Your Incident Report
A wake-up call for ASEAN boardrooms, from Kuala Lumpur, Jakarta and Singapore to Bangkok, Manila and Ho Chi Minh City.
INCIDENT REPORT - DRAFT
Date of breach: the day your next release ships
Root causes: – Code written by an AI assistant, reviewed by no one – An open-source package nobody checked before it was installed – A vendor-built application no one could test without the source code – A forgotten API that never made it into the asset inventory
Deadline to report: 72 hours
How long the flaw sat unfixed: 252 days
Signed by: ______________
Look at the last line.
When something breaks, your regulator won't ask the AI to sign. It won't ask the open-source author, the vendor or the developer who left the API running. It will ask you.
The gap that should keep every leader awake
72 hours. That's roughly how long many ASEAN regulators now give you to report a serious breach.
252 days. That's the average time organisation's take to fix a vulnerability, up 47% in five years.
The window between "known flaw" and "fixed flaw" is where attackers operate, and it's getting wider.
Now add AI. A 2025 study tested code from more than 100 AI models. 45% of the time, it introduced a known security flaw, such as SQL injection, cross-site scripting or broken cryptography. In Java, the language many banks, insurers and telcos run on, the failure rate was above 70%.
And half of all organisation's already carry critical security debt: severe flaws that are known, logged and still not fixed. AI is letting teams write code faster than they can secure it.
ASEAN regulators are no longer asking nicely
Malaysia, the clearest signal in ASEAN
Cyber Security Act 2024 (Act 854), enforced by NACSA. A designated NCII entity that fails to report a cyber incident faces fines of up to RM500,000 and criminal liability. Skipping the mandatory risk assessments and audits carries fines of up to RM200,000.
PDPA (amended). Breach notification and a Data Protection Officer are now mandatory. Fines for breaching the data protection principles now reach RM1 million, with criminal liability on top.
BNM RMiT. Financial institutions must demonstrate control over technology risk, not just claim it.
Indonesia
PDP Law. Now fully enforceable, with administrative fines of up to 2% of annual revenue.
OJK. Raising the bar on IT resilience for financial services.
National Data Centre. The 2024 ransomware attack disrupted services across hundreds of government agencies.
Across ASEAN and beyond
Vietnam: a new Personal Data Protection Law has applied since January 2026, including to foreign companies that process Vietnamese data.
Singapore: breach reporting rules have tightened, and penalties now get board-level attention.
Beyond ASEAN: Japan's Active Cyber Defense law takes effect this month, and South Korea has raised maximum privacy fines from 3% to 10% of global turnover.
The countries differ, but the direction is the same: you will be held accountable for the software you ship, whoever or whatever wrote it.
Why ASEAN is more exposed than most
The race to ship faster has already started
Across ASEAN, regulators have licensed a new wave of digital banks in Malaysia, Singapore, Indonesia and the Philippines. These banks are lean and cloud-native, and they release new features in days, not quarters.
Traditional banks are under pressure to keep up. Many are turning to AI coding assistants, outsourced development teams and faster release cycles to close the gap.
It isn't only banking. Insurers face insurtechs, retailers face e-commerce platforms, telcos face digital-first challengers, and logistics firms face app-based rivals. Every traditional business is being pushed to move at digital speed.
But speed without security doesn't close the gap. It moves the risk. The digital challengers face the same question too: can your security keep up with your release cycle?
In this region, the app is the business
Super apps, QR payments, digital banks, e-wallets and government portals all run on applications. A flaw in that code exposes the business, not just IT.
We build fast with thin security teams
The cyber talent gap across Southeast Asia is real. You can't hire your way out of 252-day fix cycles.
Our software is assembled, not written
It's built from open-source libraries, third-party components, containers and APIs, and now from packages suggested by AI. Some of those suggested packages don't even exist, and attackers register those names first.
The code you didn't write is the code that will hurt you
Much of ASEAN's critical software wasn't built by the companies that run it.
Core banking, telco billing, citizen portals and insurance platforms were often built by system integrators, offshore vendors and software suppliers. Some of it is decades old, and for much of it you don't hold the source code.
The regulator doesn't care who wrote it. If you run critical infrastructure, the obligation, the incident report and the fine sit with you.
So ask your team: "Can we security-test an application if the vendor won't give us the source code?" If the answer is no, a large part of your attack surface has never been tested.
Every leader feels a different pain. It's the same problem
CEO: "Are we moving fast, or just moving risk faster?"
You approved the AI productivity push. Do you know what it's putting into production? When the regulator or the press calls, "we didn't know" is not a defense.
CISO: "I'm accountable for code I never see."
Thousands of alerts, days lost chasing false positives, and critical flaws ageing in the backlog. You report risk to the board that you can't fully measure.
VP Security / Head of AppSec: "Developers see me as the department of no."
Every security gate slows a release. Tools that sit outside developer workflows rarely get used.
CIO / CTO: "Most of my application isn't even my code."
Your software supply chain is your biggest blind spot, and AI just made it bigger.
Developers: "Tell me what's wrong and how to fix it, in my IDE, today."
Developers want to write secure code. They don't want a 200-page report three weeks after the sprint ends.
The next wave is already here, Today, AI suggests code and a human approves it. Tomorrow, AI agents will write, test and commit code on their own, faster than any review board can follow. If your security only works at human speed, it's already obsolete.
Detection is too late. Prevention is the new standard.
Attackers no longer just look for flaws in your code. They plant their own.
Researchers have identified close to half a million malicious open-source packages. They include typosquatted look-alikes, hijacked libraries, and packages built to steal credentials the moment they're installed. Some campaigns have specifically targeted finance and crypto, sectors that are central to ASEAN's digital economy.
The trap is timing. If a scanner flags a malicious package after a developer installs it, the package may already have run on a laptop or build server and taken your secrets with it.
The new standard is a firewall for your software supply chain: risky and malicious packages are blocked before they enter your environment, not reported after the damage is done.
You can't secure what you don't know exists
Every large enterprise has them, a marketing microsite from 2019, a test API someone left exposed, a pilot app from an acquisition. Nobody owns them or patches them, and attackers find them first. Managing application risk starts with an honest inventory. That means continuously discovering every internet-facing app and API, not a spreadsheet updated once a year.
Seven questions every ASEAN leader should ask this quarter
What share of our production code was written or suggested by AI, and was it security-tested?
How many critical vulnerabilities are in our backlog, and how old is the oldest?
If our regulator asked tomorrow, could we prove our applications meet policy?
Do we know every open-source component, and every vendor-built application, in our core systems?
How many alerts does our team chase each week that turn out to be false positives?
Do our developers get fix guidance where they work, or after they've moved on?
Could we meet a 72-hour reporting deadline with confidence today?
If any answer is "I'm not sure," that is your risk.
A buyer's checklist for the AI-coding era
When you evaluate how you'll manage application risk, check whether the approach can do these ten things:
Accuracy you can stake your reputation on. The false-positive rate is low enough that developers trust the findings instead of ignoring them.
Test what you don't own. It analyses compiled applications, including vendor-built and legacy software, not just source code your team controls.
Block before you detect. It stops malicious and risky open-source packages at the point of entry, across public registries and your internal repositories.
AI that fixes your code and your dependencies. Remediation is trained on curated security data, not scraped public code. It suggests fixes for flaws in your own code and safe upgrades for vulnerable libraries.
Gates that don't punish developers. Policies are smart enough to fail a build only when a fix actually exists, so security stops being the "department of no".
Every layer of testing in one place. Static, dynamic, open-source and container testing, plus human penetration testing for the business logic that machines miss.
Discovery of your unknown attack surface. It continuously maps internet-facing apps and APIs, including the ones nobody remembers building.
One risk view, not ten dashboards. Findings from every tool are unified, de-duplicated and prioritised by real business and runtime context.
Built into developer workflows. It works inside the IDE, the pull request and the pipeline, not as a PDF after the sprint.
Proof, not promises. Policy enforcement and audit-ready evidence you can show your regulator, your board and your customers, backed by decades of security research and data from millions of real-world applications.
If your current approach meets fewer than seven, you have a risk gap, and attackers are measuring it more carefully than you are.
The bottom line
ASEAN is running one of the world's fastest digital transformations, and every economy in the region is racing to lead it. But the winners won't be the ones who ship the most code. They'll be the ones whose code customers, regulators and partners can trust. Security debt behaves like financial debt: it compounds quietly until someone calls it in. Across ASEAN, regulators and attackers have both started calling. Go back to the incident report at the top of this article. Today, it's still a draft, and the signature line is still blank. What you do this quarter decides whether you ever have to fill it in, and whether you can sign it with confidence if you do.
AI can write the code. Only you can answer for it. I'd like to hear how leaders across ASEAN are handling the risk from AI-generated code.
CONNECT WITH AUTHOR
Yogesh is a trusted technology advisor with more than 25 years of international experience across AI, Cloud, Analytics, Automation and Digital in multiple industries. That background lets him see application risk the way leaders experience it: as a business, regulatory and reputational issue, not just an IT one. He works with CEOs, CISOs and technology leaders to solve critical business problems, and today his focus is application security and risk in the AI-coding era. He helps organisation's see every exposure across their own code, open-source and vendor software, prioritize what matters to the business, and fix it without slowing developers. Through a customer-centric approach and a strong partner ecosystem, he brings technology, expertise and governance together, so clients can show regulators and boards real progress.
Facing these challenges? Connect with Yogesh for a straight conversation on your AppSec posture, regulatory exposure and where to start.
Comments