The Philippines is rapidly transforming into a digital finance powerhouse, but this explosive growth in fintech and digital payment platforms brings with it an equally rapid evolution of cyber threats.
As more Filipinos embrace online banking and e-wallets, financial institutions and fintech firms face a critical imperative: bolster their cybersecurity defenses against increasingly sophisticated attacks, including those powered by artificial intelligence.
Digital surge fuels urgent call for enhanced cyber resilience in fintech
Ram Vaidyanathan, Chief IT Security Evangelist at ManageEngine
Ram Vaidyanathan, Chief IT Security Evangelist at ManageEngine, a prominent provider of enterprise IT management solutions, highlights the urgent need for enhanced cyber resilience in the archipelago.
With over a decade of experience in cybersecurity, Vaidyanathan specializes in threat detection and response, as well as proactive identity and access management. His insights underscore that while the digital shift offers immense benefits, it also significantly expands the “attack surface” for cybercriminals.
“The Philippines is an emerging market with a tech-savvy population and high digital engagement,” Vaidyanathan explains. “More consumers are using online banking and making financial transactions online. To keep up, banks and financial institutions are rapidly accelerating their digital transformation efforts.”
However, this rapid digitalization in fintech comes at a cost. The Bangko Sentral ng Pilipinas (BSP) reported that supervised financial institutions in the Philippines lost ₱5.82 billion from cyberattacks in 2024, a slight increase from ₱5.67 billion in 2023. This stark figure emphasizes the growing financial impact of cybercrime in the sector.
Log360: Fortifying Philippine finance against AI threats in fintech
ManageEngine’s key cybersecurity solution, Log360, a unified Security Information and Event Management (SIEM) solution, is proving particularly relevant for Philippine financial institutions. “Log360 provides centralized visibility across their entire digital infrastructure, whether on-premises or in the cloud,” Vaidyanathan notes.
This is crucial for banks with numerous branches and complex digital ecosystems. The solution helps correlate seemingly unrelated events, detecting serious threats that might otherwise go unnoticed. Beyond real-time detection, Log360 facilitates automated incident responses and supports third-party risk management, a growing concern as financial institutions increasingly rely on external applications and vendors.
The cybersecurity landscape in the financial sector is uniquely challenging because it is built on trust. “A breach isn’t just a technical issue; it can lead to instant financial loss, long-term reputational damage, and distrust from customers,” Vaidyanathan stresses. With over 100 million people and a burgeoning digital footprint, the Philippines is a prime target.
One of the most pressing challenges today is ransomware. Attackers are no longer just encrypting data for ransom; they are conducting deeper observations, deleting backup systems, and identifying sensitive assets before launching multi-layered attacks that can pivot from on-premises infrastructure to the cloud. Vaidyanathan also points to the alarming rise of AI-powered cyber threats, such as deepfake scams, voice cloning, and sophisticated phishing attacks.
The Cybercrime Investigation and Coordinating Centre (CICC) recently noted around 200 deepfake cases in the Philippines in just a few weeks, signaling the immediate impact of AI-driven threats.
BSP mandates, AI tools, and zero trust pave path for secure digital future
Recognizing these escalating threats, the BSP is actively pushing for initiatives like the Financial Cyber Resilience Governance Council (FCRGC). Vaidyanathan views this as a positive step that will compel financial entities to institutionalize cyber resilience as a core business imperative, aligning the Philippines with regional and global standards like the EU’s Digital Operational Resilience Act (DORA). “Regulatory mandates like those from BSP will codify cybersecurity practices into law, making them non-negotiable,” he asserts.
AI, while a weapon for attackers, is also a powerful tool for defenders. Vaidyanathan highlights its potential for enhanced threat detection, response, and analysis, building upon foundational machine learning techniques like user and entity behavior analytics (UEBA). AI can flag anomalies such as unusual login times or excessive file access, summarize critical alerts, and assist with investigations. As AI adoption matures in the Philippines, these capabilities are becoming “must-haves” for financial institutions striving to stay ahead.
To fortify their defenses, Vaidyanathan advises Philippine fintech companies to focus on two critical areas: cybersecurity awareness among users and the adoption of the Zero Trust security model. “Humans are often the weakest link,” he says, advocating for real-time, contextual micro-trainings to improve employee behavior. The Zero Trust model, which continuously verifies users and devices regardless of their location, is a fundamental shift in mindset for robust security.
In terms of specific best practices, Vaidyanathan recommends a dual approach of proactive and reactive security. Proactive measures include robust Identity and Access Management (IAM) through role-based and attribute-based access controls and the principle of least privilege. Reactive security hinges on effective SIEM systems for real-time threat detection, alert prioritization, automated first-line responses, and comprehensive incident investigation. Both IAM and SIEM can be significantly enhanced with AI and machine learning for anomaly detection, predictive analysis, and automated response recommendations.
Looking ahead, Vaidyanathan identifies three major trends shaping the Philippine financial sector’s cybersecurity landscape in the next 3 to 5 years: accelerated AI adoption, increased cloud migration, and the resulting expansion of the attack surface.
Financial institutions must match AI innovation with equally intelligent cybersecurity tools, prepare for the complexities of hybrid and fully cloud-based operations, and develop adaptable strategies to secure a broader range of devices, users, and applications outside traditional network perimeters. By embracing these developments proactively, the Philippines can not only defend against evolving threats but also solidify its position as a leader in digital trust and innovation.
