Indonesia’s Cybersecurity Talent Problem Is Becoming a Skills Problem

Cybersecurity training has an awkward reputation. For many employees, it arrives as an annual module, a collection of familiar warnings and a quiz that strongly encourages remembering whatever appeared on the previous screen. Meanwhile, the workplace has become considerably less predictable. ENISA’s latest Cybersecurity Month data shows that 74% of surveyed employees had received suspicious emails, messages, voice communications or links at work during the previous six months. Phishing remained the most common example, but employees also encountered attempts to steal personal information, passwords, AI-generated scams, malware and ransomware. ENISA [https://www.enisa.europa.eu/news/cybersecurity-month-work-employees-skills-under-the-looking-glass] Yet only 45% said their organization regularly sends cybersecurity awareness information or updates. The interesting part is that employees don’t appear uninterested. Eighty-five percent said they wanted to improve their cybersecurity skills. ENISA [https://www.enisa.europa.eu/news/cybersecurity-month-work-employees-skills-under-the-looking-glass] The gap is partly about how training is delivered. THE BIGGEST TRAINING PROBLEM MAY BE THE CALENDAR Among employees who identified obstacles to developing cyber skills, 26% cited finding time during work, ahead of cost at 16%, followed by limited information about training and insufficient employer support. ENISA [https://www.enisa.europa.eu/news/cybersecurity-month-work-employees-skills-under-the-looking-glass] That matters because

A penetration testing report with 200 findings might look impressive. But what if some findings cannot be reproduced, several describe the same underlying weakness and the most serious exposure is buried halfway down the list? The number of findings makes a poor measure of security. What matters is whether the testing reveals exploitable weaknesses, demonstrates their potential impact and gives the organisation enough evidence to decide what to fix first. As AI becomes part of security testing workflows, this distinction deserves more attention. Automation can help teams examine larger sets of assets and accelerate parts of an assessment. Yet faster testing only creates value when the results are reliable. A FRESH REMINDER FROM AI SECURITY TESTING On 20 October 2026, the OWASP GenAI Security Project published version 1.0 of its GenAI Red Teaming Manual. Its eight-phase methodology covers planning, reconnaissance, attack surface mapping, exploitation, persistence, impact assessment, reporting and remediation. The manual emphasises reproducible findings and measurable outcomes when evaluating generative AI systems. OWASP's announcement [https://genai.owasp.org/resource/genai-red-teaming-manual-version-1-0/?utm_source=chatgpt.com] offers a timely reference for organisations building

If you only went to the doctor once a year, you probably would not assume you were perfectly healthy for the other 364 days. Health changes over time. New conditions can develop, existing issues can worsen, and unexpected problems may arise between checkups. That is why people increasingly rely on regular monitoring and preventive care rather than waiting for an annual appointment to discover something has gone wrong. Cybersecurity works in much the same way. For many years, annual penetration testing has been considered a cybersecurity best practice. Organizations schedule an assessment, receive a report, address the findings, and repeat the process the following year. In relatively static environments, this approach provided a reasonable level of assurance. Modern organizations, however, no longer operate in static environments. Cloud adoption has accelerated. APIs have become essential to digital services. Development teams deploy updates continuously, and third-party integrations have become increasingly common. As organizations move faster, their attack surfaces evolve just as quickly. A system that was secure six months ago may look very