Cloud Security Starts Below the Cloud

Indonesia needs more cybersecurity professionals. That part is obvious. What is becoming less obvious is whether the real problem is still about numbers. The 2026 SANS | GIAC Cybersecurity Workforce Research Report found that 60% of surveyed organizations said their teams lacked the right skills to defend against current threats. More concerning, 27% reported breaches directly linked to capability gaps. That changes the conversation. A company can have a security team, a dashboard full of alerts and a stack of expensive tools. The harder question is whether the people behind them know what to do when something unusual happens. CYBERSECURITY WORK IS MOVING FAST Artificial intelligence is making that question harder. AI can already help with alert analysis, vulnerability prioritization and repetitive investigation tasks. Attackers can use the same technology to make attacks faster and easier to scale. In August 2026, Vice Minister of Communication and Digital Affairs Nezar Patria warned that agentic AI could allow cyberattacks to operate with less direct human involvement. He also highlighted threats such as harvest

Organizations today face an increasingly complex threat landscape. New vulnerabilities emerge daily, attack surfaces expand continuously and attackers are leveraging automation to move faster than ever before. For many years, traditional penetration testing has been an essential part of cybersecurity programs. However, as environments become more dynamic, many organizations are exploring how artificial intelligence can enhance security assessments and provide more continuous visibility. This shift has given rise to AI penetration testing. But how does AI powered penetration testing compare to traditional penetration testing? Is AI replacing ethical hackers, or are the two approaches designed to work together? UNDERSTANDING TRADITIONAL PENETRATION TESTING Traditional penetration testing involves security professionals simulating real world attacks to identify vulnerabilities and weaknesses before attackers can exploit them. HOW TRADITIONAL PENETRATION TESTING WORKS A typical penetration testing engagement may include: * Reconnaissance and information gathering. * Vulnerability identification. * Exploitation and attack path analysis. * Privilege escalation testing. * Manual validation of findings. * Reporting and remediation recommendations. Traditional penetration testing provides deep insights into an organization's security posture

Ask a security team where the organization uses cryptography and the first answers will probably be obvious: TLS certificates, VPNs, encrypted databases and authentication systems. Then keep asking. What about APIs? Code signing? SSH? Embedded devices? Software libraries? Cloud services? Machine identities? Third party applications? The list gets longer rather quickly. That matters because NIST is now telling organizations to begin migrating toward post quantum cryptography. Its first three finalized PQC standards have been available since 2024, and NIST says products, services and protocols will need updates as organizations move away from quantum vulnerable public key algorithms. NIST [https://www.nist.gov/pqc?utm_source=chatgpt.com] The workforce problem starts before anyone changes an algorithm. FIRST, FIND THE CRYPTOGRAPHY NIST’s Migration to Post Quantum Cryptography project describes cryptographic inventory as a record of cryptography used across systems, applications, services, devices and data flows. It can include algorithms, protocols, keys, certificates and the components that depend on them. NIST Pages [https://pages.nist.gov/nccoe-migration-post-quantum-cryptography/?utm_source=chatgpt.com] Building that inventory requires more than a specialist who understands the mathematics behind ML-KEM or ML-DSA. Organizations need people who can: * Identify