Cybersecurity spending in Asia Pacific is rising fast but John Yang, Vice President, APJ, Progress Software, says organisations still face gaps in visibility and resilience – with Network Detection and Response (NDR) becoming a critical layer in modern defence.
Cybersecurity spending in Asia Pacific has surged in response to escalating digital threats.
Since 2022, budgets have grown at a steady 12.8% annually and are projected to reach US$52 billion by 2027. This growth reflects the increasing frequency and sophistication of cyberattacks driven by the region’s push toward digital services, cloud adoption and hybrid networks. In Q2 last year alone, organisations faced an average of 2,510 attacks per week — a 23% increase year-on-year.
Yet even as organisations boost investments, many still rely on outdated defences. Traditional approaches — particularly endpoint security — are no longer sufficient. In today’s threat landscape, resilience requires layered protection, broader visibility and smarter, faster detection.
Beyond endpoint protection
Modern environments are more complex than ever. With cloud workloads, remote access and IoT devices in the mix, attackers have more ways to gain access — and defenders have more to keep an eye on. The challenge is not just detecting threats but doing so without overwhelming security teams with noise.
That is why 24/7 monitoring is necessary, but only when it adds clarity rather than confusion. Without the right technology, even the best tools can bury teams in alerts. Many organisations have found that their current solutions catch some attacks but still leave blind spots — or, worse, cause alert fatigue by flagging too many non-malicious activities. NDR can help by providing another layer of context.
AI-driven NDR: supercharging security and solving alert fatigue
NDR systems leverage Artificial Intelligence techniques like machine learning, heuristics and behaviour analysis to efficiently analyse millions of network sessions and surface malicious activity. Unlike traditional intrusion detection systems, they are agnostic to encryption and adapt to new attack methods, covering both north-south and east-west traffic.
Recent advances have introduced LLM-powered features in technology that act as tireless junior analysts, tracking incidents, summarising findings and recommending or even automating response actions. This integration of intelligent automation boosts coverage while freeing skilled analysts to focus on higher-value investigations.
AI-driven NDR platforms also help solve one of the most persistent challenges in security operations: alert fatigue. By correlating and prioritising incidents, NDR ensures teams don’t drown in noise but stay focused on genuine high-risk threats.
Deep historical visibility reveals lateral movement and tracks activity across the network, laying the groundwork for meaningful audits and extended threat investigations. Automated triage and seamless integration with SIEM and SOAR platforms further streamline workflows, reducing the mean time to respond and improving operational efficiency.
Making NDR work: what you need to do to succeed
NDR platforms offer plenty of flexibility, but too much tinkering can backfire. Over-customisation may obscure real threats; under-customisation can lead to alert storms. The secret is to tailor NDR to the unique needs of your environment:
- Define your priorities: Identify specific threats you want to target — for example internal misuse or suspicious east-west traffic. Don’t attempt to monitor everything at once. Focus first on your highest-risk areas.
- Ensure data quality: The effectiveness of NDR depends on the quality of data it ingests. Use reliable sources to avoid missing incidents or generating noise.
- Filter thoughtfully: Start with broad alert filters then refine them based on observed activity. Adjust sensitivity thresholds to match your organisation’s true risk profile.
- Commit to continuous tuning: NDR optimisation is ongoing. Regularly review outcomes, test rules and adapt configurations to ensure your solution grows smarter and more efficient over time.
Staying ahead of the curve
As cyberthreats become more advanced and persistent, organisations can no longer rely solely on traditional security tools or incremental investments in legacy technologies. NDR fills a critical gap, providing holistic real-time visibility across dynamic and distributed networks. In hybrid environments — where cloud services, remote users and IoT devices intermingle — NDR’s agentless, analytics-driven approach is uniquely positioned to uncover threats that would otherwise slip through the cracks.
Ultimately, investing in advanced NDR capabilities is not just a matter of keeping pace with today’s threat landscape — it’s about building resilience for the future. As Digital Transformation continues to accelerate, organisations that equip themselves with integrated intelligent monitoring and response will not only reduce risk and operational complexity but also create a more agile, defensible security posture. For any enterprise seeking to secure its hybrid environment, NDR has become an essential pillar of modern cybersecurity strategy.
