Agenda

Securing Indonesia's Maritime Frontier: Cybersecurity Challenges in National Surveillance Systems

• How maritime surveillance systems – radar networks, vessel tracking, and coastal monitoring infrastructure – are becoming high-value targets in Indonesia’s expanding digital defence perimeter
• The operational reality of securing legacy maritime sensor networks alongside modern satellite and AI-driven surveillance platforms, often running on infrastructure never designed with cyber resilience in mind
• What it takes to protect the systems safeguarding Indonesia’s 17,000+ islands and vast territorial waters from both physical and cyber-enabled threats, and where BAKAMLA’s mandate intersects with national cyber defence

Protecting Critical Information Infrastructure in a Digitally Interdependent National Economy

• How a single compromised payment node took down 282 public services and what it takes to stop the cascade before it starts
• Where does TNI’s mandate begin and civilian enterprise obligations end
• Does the military cyber force arrive as a capable, doctrine-driven partner or as a mandate without a mechanism

Where Indonesia's Cyber Resilience Framework Is Working & Where Business Is Still on Its Own

• Addressing the gap between government policy ambition and enterprise operational reality
• Having regulations that fit the workforce Indonesia has, enabling security not just mandating it
• What a shared incident response and cross-enterprise cooperation building the security foundation means for Indonesia’s $200 billion digital economy

What 661 Real Attacks Tell Us About How Indonesian Organizations Will Be Breached Next

• Identity is simultaneously the most targeted and least protected layer of the stack, and attackers are reaching your Active Directory server within 3-4 hours of initial access
• 88% of ransomware payloads deploy outside business hours; 79% of data exfiltration happens at night and on weekends, Sophos MDR fills this gap.
• Indonesian organizations are losing to attackers using basic, proven techniques against fundamental security hygiene failures mandating work towards fixing the foundation first

Trusted by Default, Breached at Scale: FortiBleed and the Supply Chain Blind Spot

• Emergence of structured marketplaces selling network access, ransomware toolkits, and bulk stolen credentials
• Specialization within cybercrime networks where reconnaissance, exploitation, and monetization are separated into services
• Incorporating underground intelligence monitoring into proactive enterprise defence strategy

Building Indonesia's Cyber Risk Backbone: Can Locally Built Solutions Meet the Demands of a $130 Billion Digital Economy?

• Whether local certification is a meaningful quality signal or just a procurement checkbox
• How the domestic cybersecurity industry is keeping pace with the now $130B Indonesian Digital Economy
• Indonesian-built risk management platforms can realistically handle the complexity of securing a super-app, a national bank’s hybrid cloud infrastructure, or a telco network serving 270 million people, and whether the honest answer is a hybrid of local and global solutions

When Cyber Risk Becomes Business Risk: The Conversation Indonesian Boards Are No Longer Avoiding

• How to make the board care about cybersecurity before the breach makes them.
• What does a CEO or board member actually need to understand about cyber risk and what detail is counterproductive?
• Developing internal offensive security capabilities that evolve alongside emerging attack techniques.

You Already Have the Patch. Why Haven't You Applied It?

• Most Indonesian organizations are being breached through unpatched, known vulnerabilities that have had fixes available for weeks or months, the remediation backlog is thus the problem
• Qualys TruRisk Eliminate uses AI-driven risk scoring to automatically identify which vulnerabilities in your specific environment are being actively exploited right now and deploys patches autonomously before attackers can act
• Establishing verification discipline and layered communication controls to reduce human exploitation vectors

Indonesia's Security Blind Spots: Why Your Own Team Will Never Find What a Global Hacker Community Can

• HackerOne’s global community of 300,000+ ethical hackers bring completely fresh eyes finding the vulnerabilities that internal teams and automated scanners consistently miss, before malicious actors find them first.
• Compromise of smaller ecosystem participants providing indirect access into high-value networks and sensitive data repositories
• Embedding real-time third-party risk visibility into procurement, vendor lifecycle management, and contractual security governance

Cybersecurity as a Business Enabler: Why Indonesia's Chambers of Commerce Are Prioritizing Digital Trust

• Why cybersecurity is becoming a competitiveness issue for Indonesian businesses, not just a regulatory checkbox, and what that shift means for companies trying to attract investment and partnerships
• How industry bodies like KADIN are stepping in to help businesses, especially SMEs and mid-market enterprises, build baseline cyber resilience without world-class security budgets
• What role business chambers play in bridging the gap between government cybersecurity policy and the operational reality of Indonesian enterprises

Protecting Data Integrity in an Era of Silent Manipulation and Systemic Tampering

• Data integrity is a regulatory requirement, not just a security best practice and most Indonesian banks cannot currently prove their records haven’t been tampered with
• Subtle manipulation of transaction logs and operational dashboards creates systemic risk that cascades from individual institutions to market-wide trust
• What detection mechanisms specifically look for checksum anomalies, log sequence breaks, behavioural deviations in write patterns and how GravityZone’s XDR layer surfaces integrity violations before they reach the board report

See Everything, Store Everything: The Case for Unlimited SIEM in Indonesia

• Energy Logserver was built specifically for petabyte-scale log retention in high-security environments because you cannot investigate what was never recorded
• Their on-premises, open-architecture deployment keeps every log, every alert, and every forensic artifact entirely within Indonesian infrastructure
• Unlimited data model and flexible open-source licensing makes full-spectrum SIEM accessible to the Indonesian banks, telcos, and government agencies that currently rely on underpowered log management tools

212 million Attack Surfaces: Why Indonesia's Mobile-First Economy Is Only as Secure as Its Weakest App

• Guardsquare’s research reveals a $7 million security blindspot driven by organizational overconfidence
• With 40,000+ API incidents in H1 2025 and 44% of advanced bot activity now targeting the APIs behind mobile apps rather than the apps directly, Indonesian banks and fintechs face a new attack surface they haven’t mapped
• Guardsquare’s ThreatCast platform gives security teams real-time visibility into how their apps are being attacked in production right now not in a lab, not in theory, but on the devices of your actual Indonesian customers at this moment

The CISO Mandate - Leading Security in Indonesia's High-Stakes Digital Economy

• Why the most sophisticated detection stack in your organization cannot protect you from the human decisions made above it
• Why most insider threats aren’t malicious – they’re the predictable result of process gaps, operational pressure, and accountability that nobody clearly owns
• How today’s CISOs are turning security awareness from a training checkbox into measurable operational discipline that holds under pressure

Strategic Cybersecurity Investment in High-Growth Digital Economies: Balancing Expansion, Regulation, and Resilience

• Why Indonesia’s digital expansion is outpacing its security budgets and what enterprises must prioritize when they cannot protect everything equally
• How to allocate a constrained security budget across fraud prevention, cloud governance, incident response, and talent when the attack surface grows faster than the budget does
• How to align security investment with regulatory expectations and national digital ambition before the auditor decides you didn’t

Privileged Access, Public Exposure - Why Indonesia's Biggest Breaches Start With Someone Who Already Had the Keys

• Why over-privileged accounts, not external attackers, are the fastest path to lateral movement across Indonesian banks, telcos, and government networks – and what PDNS 2 taught the country about who really holds the keys to critical systems
• Rethinking privileged access as a living attack surface rather than a static IT control – session, credential, and vendor access that expands quietly until it becomes the breach nobody saw coming
• Why “least privilege” remains a policy statement in most Indonesian enterprises rather than an operational reality, and what it actually takes to enforce time-bound, monitored, revocable access at scale