From AI hype to trusted autonomy: Five ways APAC cyber resilience will change in 2026

By Martin Creighan, Vice President, Asia Pacific at Commvault

As APAC economies enter the era of agentic AI, resilience and sovereignty are no longer technical concepts – they are the foundations of leadership, trust, and competitiveness.

From Experimentation to the AI-driven Resilience

Artificial intelligence has matured from pilots to purpose. IDC describes an Agentic Future in which humans and AI act with autonomy and intention. Across APAC, AI-related investments are projected to grow around 1.7 times faster than overall digital technology spending, generating an estimated US$1.6 trillion in economic impact by 2027, while in Singapore more than 70% of companies report adopting AI in some form.

The most visible shift is in AI assistants powering customer engagement, operations, and even cyber response. But these systems are only as trustworthy as the data they learn from. In 2026, AI integrity will become a central pillar of resilience with the ability to trace, verify, and restore the truth in machine learning models.

What’s emerging next is the use of conversational interfaces to run resilience itself. Instead of navigating dashboards and scripts, teams will ask – in natural language – to protect a workload, check a policy, or validate recovery readiness across SaaS, multi-cloud, and hybrid environments. Resilience begins to feel like an always-on, conversational control layer over critical services.

Cloud Sovereignty as Strategy, not Box-ticking

From Singapore’s Digital Sovereignty Framework to India’s Data Protection Act, cloud sovereignty has become the new strategic frontier. Forrester expects that by 2026, roughly half of APAC enterprises will make sovereignty-based controls – such as in-region infrastructure and data residency – a top criterion for cloud and AI platforms.

Sovereignty is about control and choice. In a multi-cloud, multi-region world, enterprises need the freedom to decide where data resides – on-premises, in a private cloud, a local hyperscaler region, or a global cloud – while still maintaining visibility into under whose laws it sits, and how it can be recovered without crossing borders.

Architectures are becoming sovereignty-aware by default, with encryption, access policies, and compliance rules moving with the data – across borders and clouds. When sovereignty is built into design, compliance becomes a competitive advantage. In 2026, this combination of sovereignty and freedom of choice will allow organisations to innovate confidently within trusted boundaries.

Identity Moves to the Centre of Recovery

As digital ecosystems become borderless, identity is replacing infrastructure as the perimeter of security. In Singapore, phishing attempts surged by about 49% to more than 6,100 cases in 2024, with banking, government, and e-commerce among the most spoofed sectors; a reminder that most attacks now begin with stolen or abused identities.

IDC anticipates that by 2026, cyber-resilient organisations will merge identity, data, and recovery policies into one continuous security fabric. Continuity is incomplete if identities remain corrupted. The ability to restore verified user integrity – not just restore systems – will become a cornerstone of operational assurance.

This matters even more as AI starts talking to AI – autonomous agents initiating actions, sharing data, and making decisions on their own. In this AI-centric world, a trusted identity becomes the first checkpoint of safety, and recovery plans must prove that compromised identities have been reset, re-verified, and re-linked to clean data.

Data Rooms Turns Protection into AI-ready Fuel

In 2026, enterprises will recognise that AI initiatives stall not from lack of data, but from the inability to safely access and prepare the data they already have. Across APAC, multiple surveys show that data quality, security, and governance – not enthusiasm for AI – are the primary bottlenecks to scaling projects beyond pilots, with many organisations citing fragmented data estates and compliance concerns as the main reasons initiatives slow or stall.

Historical data will be reframed from “backup insurance” to a strategic intelligence asset, if activated responsibly.

This will accelerate the rise of sovereign, resilience-aware data rooms – secure environments that connect governed backup data directly to AI platforms and data lakes without risky, ad-hoc workflows. By providing controlled, self-service access with built-in classification, lineage, and compliance, data rooms will turn protected data into clean, compliant, AI-ready fuel that can power analytics and AI without breaching local data protection rules.

Quantum Readiness and New Metrics for Clean Recovery

While AI dominates today’s headlines, quantum computing defines tomorrow’s cryptographic risk. Post-quantum cryptography (PQC) readiness is now a resilience imperative.

Data protected under today’s algorithms (RSA, ECC) may be vulnerable within a decade. Forward-looking enterprises are beginning crypto-inventory audits, deploying quantum-safe algorithms, and redesigning backup and recovery systems with cryptographic agility – for example, trialling QKD and PQC over quantum-safe national networks, or working with telcos that now offer quantum-safe national networks.

Quantum readiness of the future is about ensuring that sovereignty, encryption, and recovery will still hold when quantum attacks inevitably occur. For heavily regulated sectors and high-IP manufacturers, that means treating crypto-agility as part of core resilience architecture today.

The Architecture of Trusted Leadership

Governance, sovereignty, and resilience are converging into a single mandate: proof of trust. Boards no longer accept assurances – they expect evidence. Recovery metrics, audit trails, and cleanroom validations are becoming the language of accountability across highly regulated sectors worldwide.

As that shift continues, traditional measures such as Recovery Time Objective (RTO) and Recovery Point Objective (RPO) will not be enough on their own, because they say little about whether restored data is truly trustworthy. Measures such as Mean Time to Clean Recovery (MTCR) – the time needed to bring critical applications, infrastructure and validated-clean data back to a trusted state – will increasingly shape how APAC leaders judge whether their cyber-resilience investments are working.

By 2030, half of the region’s digital value will come from organisations that scale AI responsibly. That responsibility rests on three pillars:

Resilience: ensuring integrity across AI and data pipelines
Sovereignty: retaining lawful control wherever data flows
Quantum readiness: safeguarding today’s information against tomorrow’s threats

Enterprises that embed these pillars into their design will be best placed to move from AI hype to trusted autonomy. They will operate across borders without compromise, turn compliance into credibility and give both humans and AI systems a foundation of data they can safely depend on.