Where is the event taking place?

The event is being held in the city of Singapore.

What is the primary focus of the summit?

The summit primarily focuses on discussions among senior IT and OT security leaders regarding cyber-resilience and industrial fortification across the APAC region.

What kind of attendees are expected at this event?

The event is designed for senior IT and OT security leaders, indicating a high-level professional audience.

CS4CA: Cyber Security Summit APAC (8th Annual) & APAC Cyber Summit (3rd Edition)

Name: CS4CA: Cyber Security Summit APAC (8th Annual) & APAC Cyber Summit (3rd Edition)
Start: 2027-04-06T00:00:00Z
End: 2027-04-07T00:00:00Z
Location: Singapore

Apr 6–7, 2027Singapore, SingaporeIn-person

Registration open

The CS4CA: Cyber Security Summit APAC, now in its eighth year, and the APAC Cyber Summit, holding its third edition, convene in SGP. This joint event serves as a critical platform for senior IT and OT security leaders to engage in discussions centered on cyber-resilience and the fortification of industrial systems across the broader Asia-Pacific region. The gathering aims to foster collaboration and knowledge exchange among key stakeholders in the cybersecurity domain.

Committees & topics

Topics
Achieving Harmony: Developing Short- and Long-Term OT Strategies · Securing Success: Making OT Security a Strategic Business Priority · Lasting Legacies: Managing Unique Weak Points and Legacy Systems · Protecting the Gateway: Mastering Third-Party Access in OT Security · Building on the Foundations: Navigating Digital Transformation with a Focus on OT Risks · Fortifying the Future: Enhancing Cyber Security Regulation for Greater Resilience · Securing Success: Making IT Security a Strategic Business Priority · Quantifying Security: Measuring, Communicating and Tackling Risk

Why it matters

The convergence of these two significant cybersecurity events underscores the escalating importance of robust cyber defenses in the Asia-Pacific region. As digital transformation accelerates, so too do the sophistication and frequency of cyber threats targeting both information technology (IT) and operational technology (OT) infrastructures. The discussions at this summit are vital for shaping regional cybersecurity strategies and ensuring the continuity of critical services and industries.

Cyber-resilience, a core theme of the event, is not merely about preventing attacks but also about an organization's ability to recover and adapt swiftly in the face of successful breaches. For nations like JPN, AUS, KOR, IND, and CHN, which are deeply integrated into the global digital economy, maintaining high levels of cyber-resilience is paramount to national security and economic stability. The insights shared and networks formed at this event contribute directly to strengthening these capabilities across the region.

Furthermore, the focus on industrial fortification highlights the unique vulnerabilities of critical infrastructure sectors to cyberattacks. These sectors, ranging from energy and manufacturing to transportation, are increasingly reliant on interconnected digital systems. Protecting these systems from disruption is a complex challenge that requires a multi-faceted approach, involving advanced technologies, skilled personnel, and international cooperation. The summit provides a forum for leaders to address these specific challenges and develop actionable solutions.

How to prepare

Delegates preparing for this event should focus on understanding the current threat landscape specific to the Asia-Pacific region, particularly concerning IT and OT environments. Familiarity with recent high-profile cyber incidents and their implications for various sectors will be beneficial. Reviewing concepts related to adaptive cyber defense and cyber confidence-building measures will provide a strong foundation for engaging in discussions.

Effective participation will also require an understanding of stakeholder dynamics in cybersecurity. Consider applying lessons from topics such as "what is stakeholder mapping?" and "stakeholder workshop" to identify key players and their interests within the regional cybersecurity ecosystem. This will enable more targeted and impactful contributions to discussions on collaborative defense strategies and policy development. Additionally, exploring "engagement strategies" can help in maximizing networking opportunities and fostering meaningful connections with other senior leaders.

Given the international nature of the attendees, an appreciation for diverse national approaches to cybersecurity governance and regulation will be advantageous. While the event is held in SGP, perspectives from countries like USA, DEU, and GBR, which often lead in cybersecurity innovation and policy, may also be relevant for comparative analysis. Understanding these varied viewpoints can enrich discussions on best practices and potential regional standards.

Country perspectives

Where the most-relevant 6 countries stand on the core issues in play. Click through for the full country profile.

Singapore

A leading regional hub for cybersecurity innovation and policy development, actively promoting international cooperation.

Role in topic

As the host city, SGP plays a central role in facilitating regional cybersecurity dialogues and initiatives. The nation is known for its proactive approach to cyber defense, investing heavily in infrastructure protection and talent development. Its strategic location and advanced digital economy make it a critical player in shaping APAC's cyber-resilience.

Japan

Focused on securing critical infrastructure and enhancing cyber capabilities in response to evolving threats.

Role in topic

JPN faces significant cybersecurity challenges due to its highly industrialized economy and technological advancement. The country is actively working to strengthen its defenses against state-sponsored attacks and industrial espionage, making its insights into OT security particularly valuable at the summit.

Australia

Committed to strengthening national cyber resilience and fostering public-private partnerships to combat cybercrime.

Role in topic

AUS is a key contributor to regional cybersecurity efforts, emphasizing collaboration between government, industry, and academia. Its experiences in combating sophisticated cyber threats and developing national cyber strategies offer important lessons for other nations in the APAC region.

South Korea

Prioritizing cyber defense due to geopolitical tensions and a highly digitized society.

Role in topic

KOR operates in a complex geopolitical environment, necessitating robust cybersecurity measures. The nation's advanced technological infrastructure and continuous exposure to cyber threats provide unique perspectives on rapid response and adaptive defense strategies, particularly relevant for discussions on cyber-resilience.

India

Working to secure its rapidly expanding digital economy and critical information infrastructure.

Role in topic

IND's massive digital transformation initiatives present both opportunities and challenges in cybersecurity. The country's efforts to protect its vast digital ecosystem and develop indigenous cyber capabilities will be a significant point of discussion, especially regarding scalable security solutions for large populations and diverse industrial bases.

China

Implementing a comprehensive national cybersecurity strategy with a strong focus on data sovereignty and critical infrastructure protection.

Role in topic

CHN's approach to cybersecurity is characterized by its national security framework and extensive digital controls. Its experiences in managing a large-scale digital environment and protecting critical information infrastructure offer a unique perspective on national cyber defense strategies, particularly in the context of industrial fortification.

Topics & background

The background behind each topic and the actors that shape it.

Achieving Harmony: Developing Short- and Long-Term OT Strategies

Operational Technology (OT) — the industrial control systems, SCADA networks, PLCs and sensors that run power grids, water utilities, manufacturing plants and transport networks — was historically air-gapped and managed in isolation from corporate IT. Over the last two decades, the drive for efficiency, remote monitoring and data analytics has progressively converged OT with IT environments, exposing systems originally designed for availability and safety to cyber threats they were never engineered to resist. High-profile incidents such as Stuxnet (2010), the 2015 and 2016 attacks on Ukraine's power grid, TRITON/TRISIS (2017), and the 2021 Colonial Pipeline ransomware event illustrated that OT compromise can produce kinetic, economic and public-safety consequences. In the Asia-Pacific region, rapid industrialisation, Industry 4.0 adoption, and the build-out of smart cities have accelerated the OT attack surface. National frameworks — Singapore's Cybersecurity Act and CCoP 2.0, Japan's METI control system guidelines, Australia's SOCI Act amendments, and India's CERT-In directives — have begun mandating OT-specific obligations for critical infrastructure operators. Yet operators face a strategic tension: tactical, short-term fixes (asset inventory, network segmentation, patching windows) must coexist with long-horizon transformations (zero-trust architectures, secure-by-design procurement, workforce development) that can span decades given equipment lifecycles of 20–40 years. The debate now centres on how organisations and governments sequence these efforts: balancing quick-win risk reduction against architectural overhauls, aligning OT investment cycles with IT refresh cadences, and harmonising engineering, safety and security cultures that have traditionally operated in silos.

Key players

Securing Success: Making OT Security a Strategic Business Priority

OT security has historically been treated as an engineering or plant-floor concern, funded from operations budgets and disconnected from board-level enterprise risk discussions. The convergence of IT and OT, combined with ransomware actors increasingly targeting industrial operators — Colonial Pipeline (2021), JBS Foods (2021), Dole (2023) and multiple APAC manufacturing breaches — has forced executives to recognise that production downtime, safety incidents and regulatory exposure stemming from OT compromise can rival or exceed traditional IT-driven losses. Regulators have reinforced this shift. Australia's SOCI Act now imposes positive security obligations and director-level accountability; Singapore's CSA designates CII sector leads with reporting duties; Japan's revised Economic Security Promotion Act treats certain industrial systems as core infrastructure; and the U.S. SEC's cyber disclosure rules influence multinationals operating across APAC. Cyber insurance markets have likewise tightened underwriting for industrial clients, demanding evidence of OT-specific controls. Despite this, surveys consistently show OT security under-funded relative to IT, with unclear ownership between CISOs, COOs and plant managers. The committee will examine how to translate OT cyber risk into business language — financial impact, safety, continuity, brand — and how governance structures, KPIs and capital allocation models can elevate OT from a technical afterthought to a strategic priority.

Key players

Lasting Legacies: Managing Unique Weak Points and Legacy Systems

Industrial environments are characterised by extraordinarily long asset lifecycles: control systems, RTUs, HMIs and field devices commonly remain in service for 20 to 40 years, far beyond the support windows of their underlying operating systems, firmware and communication protocols. Many APAC utilities and manufacturers still run Windows XP/7 HMIs, unauthenticated Modbus or DNP3 links, and proprietary protocols designed in an era when network exposure was inconceivable. Patching is constrained by uptime requirements, vendor support contracts, safety recertification, and the absence of test environments. Threat actors have repeatedly exploited these weaknesses. The 2015 Ukraine grid attack abused legitimate remote access to legacy HMIs; TRITON targeted Triconex safety controllers; and groups tracked as VOLTZITE/Volt Typhoon have demonstrated persistent interest in legacy OT components across Indo-Pacific critical infrastructure. Vendor end-of-life announcements — including Siemens, Rockwell and Schneider product retirements — force operators into difficult choices between costly replacement, isolation, or compensating controls. The issue is sharpened in APAC by the coexistence of newly built smart facilities with decades-old brownfield plants, and by supply chain dependencies on a small number of OEMs. Delegates must address how to inventory and risk-rank legacy assets, implement compensating controls (segmentation, virtual patching, monitoring), and build credible multi-decade modernisation roadmaps without disrupting essential services.

Key players

Protecting the Gateway: Mastering Third-Party Access in OT Security

OT environments depend on a dense web of third parties: OEMs providing remote diagnostics, system integrators commissioning equipment, maintenance contractors, managed service providers and software vendors pushing updates. Each represents a potential entry path into otherwise segmented networks. The 2020 SolarWinds compromise, the 2021 Kaseya incident, and the 2023 MOVEit campaign demonstrated how supply chain access can cascade across thousands of downstream operators, while industrial-specific cases — including attacks leveraging vendor VPNs into water utilities and energy operators — have shown the same dynamic in OT. In APAC, third-party risk is amplified by the prevalence of foreign OEM support models, offshore engineering centres, and complex multi-tier subcontracting. Regulators have responded: Singapore's CCoP 2.0 includes third-party risk requirements; Australia's SOCI rules cover supply chain hazards; Japan's economic security framework scrutinises foreign vendor dependencies in critical sectors; and the U.S. has introduced Software Bill of Materials (SBOM) expectations through Executive Order 14028 that influence global vendors. Key challenges include enforcing least-privilege remote access, replacing always-on vendor VPNs with brokered jump-host or zero-trust architectures, auditing contractor activity in real time, and contractually obligating vendors to security standards across multi-year service agreements. Delegates will weigh how operators, vendors and regulators can jointly secure the gateway without crippling the legitimate remote support that modern OT depends on.

Key players

Building on the Foundations: Navigating Digital Transformation with a Focus on OT Risks

Digital transformation in industrial sectors — Industry 4.0, Industrial IoT, cloud-based historians, AI-driven predictive maintenance, digital twins and 5G-enabled smart factories — promises significant gains in efficiency, sustainability and resilience. APAC governments have actively championed these agendas: China's Made in China 2025, Japan's Society 5.0, Singapore's Smart Nation, Korea's Digital New Deal, and Australia's Modern Manufacturing Strategy all assume deeper integration of OT data into enterprise and cloud ecosystems. This convergence dissolves the traditional Purdue Model boundaries that once protected control networks. Sensors connect directly to cloud platforms; engineers access PLCs from mobile devices; AI models trained on plant data run in hyperscaler environments. Each new connection expands the attack surface, while the pace of change frequently outstrips security architecture reviews. Incidents at Norsk Hydro (2019), the disruption to Toyota's supply chain via a parts supplier breach (2022), and ransomware impacts on APAC ports and manufacturers underline that transformation initiatives can introduce systemic OT risk if security is bolted on rather than built in. Delegates will consider how to embed secure-by-design principles into transformation programmes, govern cloud-OT data flows, manage the cyber implications of AI in industrial settings, and ensure that digitisation strengthens rather than undermines safety and reliability.

Key players

Fortifying the Future: Enhancing Cyber Security Regulation for Greater Resilience

Cybersecurity regulation across APAC has expanded rapidly but unevenly. Singapore's Cybersecurity Act (2018, with CCoP 2.0 in force from 2022), Australia's Security of Critical Infrastructure Act amendments (2021–2022) and Cyber Security Act 2024, Japan's evolving Economic Security Promotion Act and pending Active Cyber Defence legislation, India's CERT-In directives (2022) and DPDP Act (2023), and China's tripartite regime of the Cybersecurity Law, Data Security Law and PIPL together create overlapping and at times conflicting obligations. The EU's NIS2 and DORA, and U.S. SEC, TSA and CIRCIA rules, further shape multinational compliance baselines. For critical infrastructure operators, these regimes increasingly mandate incident reporting (often within 24–72 hours), risk management programs, board accountability, supply chain controls, and sector-specific OT requirements. Yet fragmentation imposes substantial costs, complicates cross-border incident response, and can leave smaller operators under-protected. Discussions at the ASEAN Regional Forum, the Quad Cybersecurity Partnership, and APEC have sought greater harmonisation, while the UN Open-Ended Working Group on ICTs continues to negotiate norms of responsible state behaviour. Delegates will assess how regulation can drive measurable resilience — incident reporting harmonisation, mutual recognition of standards, sectoral baselines, and incentives for secure-by-design — without imposing duplicative burdens or freezing innovation.

Key players

Securing Success: Making IT Security a Strategic Business Priority

Despite three decades of cyber incidents, IT security in many organisations remains structurally treated as a cost centre rather than a strategic enabler. The shift to cloud, SaaS, remote work and AI-driven business processes has dissolved traditional perimeters and made data, identity and software supply chains the new core assets. Ransomware groups, state-aligned actors and financially motivated intrusion sets have industrialised their operations, with APAC organisations among the most heavily targeted globally — from the 2022 Optus and Medibank breaches in Australia, to attacks on Japanese ports and Indian healthcare providers, to widespread incidents across Southeast Asian financial services. Regulators and markets have responded by elevating cyber to a board-level issue. The U.S. SEC's 2023 cyber disclosure rules, Singapore's MAS technology risk management guidelines, Australia's APRA CPS 234 and CPS 230, Japan's FSA cyber guidance and Hong Kong's HKMA frameworks all require executive accountability, defined risk appetites, and demonstrable controls. Cyber insurance markets, M&A due diligence, and credit rating methodologies increasingly factor cyber posture into commercial decisions. The committee will explore how organisations can move cyber from a compliance checklist to a strategic capability — integrating it with enterprise risk management, aligning investment to business outcomes, professionalising the CISO role, and ensuring that security enables rather than constrains digital growth.

Key players

Quantifying Security: Measuring, Communicating and Tackling Risk

For decades, cybersecurity risk has been communicated through qualitative heat maps and maturity scores that resist comparison with other enterprise risks. As boards, regulators and insurers demand defensible numbers, organisations are turning to cyber risk quantification (CRQ) methodologies — including FAIR (Factor Analysis of Information Risk), Monte Carlo–based loss modelling, and integration with operational risk frameworks such as Basel III for financial institutions. Regulators are aligning: the U.S. SEC requires disclosure of material cyber incidents; APRA's CPS 230 mandates operational risk quantification including cyber; MAS expects scenario-based stress testing; and ENISA and NIST have published guidance on metrics and measurement. The rise of AI, ransomware-as-a-service, and systemic supply chain risks (SolarWinds, Log4j, MOVEit, CrowdStrike's 2024 outage) has sharpened the need to quantify not only direct loss but contagion and concentration risk. Cyber insurance markets, having tightened sharply after 2020, now price coverage based on quantified controls evidence, while rating agencies including Moody's and S&P incorporate cyber into credit assessments. Delegates will examine how to translate technical telemetry into financial exposure, communicate risk to non-technical executives and regulators, set defensible risk appetites, and prioritise mitigation investments where they most reduce expected loss — recognising that measurement itself must avoid false precision and remain grounded in threat intelligence and business context.

Key players