The cyber-extortion landscape is expanding in scale and becoming harder to assess through traditional organisational boundaries. For example, Orange Cyberdefense’s latest Security Navigator findings show that cyber-extortion victims have tripled since 2020 to roughly 19,000 organisations, while the finance and insurance sectors recorded a 71% increase in incidents.

The more consequential shift is how organisations need to think about the dependencies connecting them. Cloud providers, software platforms, managed services and third-party suppliers can create links between businesses that are not always visible through conventional risk assessments.

Charl van der Walt, Head of Security Research at Orange Cyberdefense, describes this as a dense web of interdependence, where a weakness in one part of the ecosystem can create exposure elsewhere.

Security Navigator 2026 found a 71% jump in cyber-extortion incidents in finance and insurance specifically. What’s driving that sector-specific spike, and is it opportunistic or targeted?
Firstly, we argue that the shape of incidents across industries emerges because the attacks are largely opportunistic. Finance as an industry has always ranked high because it’s large and highly digitised. Swings in numbers are not uncommon, and we rarely see the overall ranking of a sector change dramatically year on year.

This year we further argue in the Navigator that the increase in finance and insurance occurred mostly in the USA and the Republic of Korea. Specifically for finance and insurance, the Republic of Korea accumulated 29 victims after seeing no victims previously.

One prominent actor in this sector, Qilin, claimed nearly all victims (27) in this industry in the Republic of Korea. This might point to a common platform or a common service provider that was compromised.

You’ve said the “supply chain” is no longer linear. It’s a web where a single weak vendor can cascade into mass compromise. For a CFO or risk officer, what does that mean for how they should actually be underwriting third-party and counterparty risk today compared to, say, five years ago?

We think that renowned cybersecurity pioneer Dr Dan Geer Jr. sum this best in his writing of the powerful ‘A Rubicon’ paper published in 2018 that is very true and relevant, where he cited that: “dependence is the wellspring of risk; the fact that you yourself may not depend on something directly does not mean that you do not depend on it indirectly. We call this transitive reach of dependence ‘interdependence,’ which in cybersecurity is known as the nature of ‘correlated risk.”

Several incidents illustrate the scale of this interdependence:

• Cl0p’s exploitation of the Cleo managed file-transfer vulnerability accounted for approximately 18% of all cyber-extortion victims recorded in the first quarter of 2025.
• Research indicates that multi-party “ripple events” can produce median losses more than 10 times higher than typical single-party breaches.

Five years ago we were thinking in terms of questionnaires, certifications, annual assessments, individual vendor scores: “How mature is this supplier’s cybersecurity?”

Today we need to think in terms of criticality + connectivity + financial impact + concentration + fourth-party dependencies + substitutability: “If this supplier (or something underneath it) fails, what happens to us, how much could we lose, how quickly can we recover, and how many of our other exposures fail at the same time?”

We argue that this change actually requires a fundamental re-orientation: Instead of asking only how we can offset our business risk (e.g. through insurance), we also need to consider how we can improve the system’s overall resilience since we are interdependent with the supply web.

Strategic technology procurement also comes into play here. Country of origin, jurisdiction, export controls, sanctions, law-enforcement access and the possibility of service denial can therefore become relevant counterparty-risk considerations alongside technical security.

You’ve framed 2026 as requiring a “wartime mindset” in cybersecurity, with a shift from blame to collective resilience. What does that shift look like in practice inside a boardroom?

In a war, even the corporate board understands that the business is inextricably linked to the conflict, and the outcome of the conflict. The board needs to recognise that conflict in cyberspace is impacting society and the economy overall, and the business depends on those domains for its success and survival. It should be asking questions about how and where such dependencies lie, and how they can be managed.

Another wartime shift goes from asking “Who failed?” to asking “How do we become more resilient?” A resilience-oriented organisation focuses on conditions, decisions and recovery rather than individual blame. It seeks to understand why an incident succeeded, whether warning signs were visible, how information flowed and how quickly the organisation adapted.

Boards should ensure that decision rights are established before a crisis, understand how incidents escalate, test recovery processes, examine critical dependencies and verify that security, operations, legal, communications and executive teams can act from a shared picture during an event.

SMEs account for roughly two-thirds of cyber-extortion victims, but they sit inside the supply chains of much larger institutions. Should a bank or insurer be assessing its own risk based on the security posture of its smallest vendors now?

Simply put, yes. But beyond that, our earlier point about contributing to the resilience of the wider system suggests that banks and insurers should be asking how they can contribute to improving the security and resilience of SMEs in their web. A small vendor may become strategically important if it has privileged access, supports critical operations, processes sensitive information, provides services to multiple institutions or relies on widely shared technology platforms.

Attackers often target points of concentration rather than individual organisations. A seemingly minor supplier can become the pathway through which risk spreads across an entire network of customers. The critical question is not whether a supplier is small. It is whether the organisation understands what that supplier connects to, what would happen if it failed, how quickly exposure would be detected and whether essential services could continue while recovery takes place.

Your report frames cybercrime as increasingly entangled with state actors and hacktivism. For institutions in Southeast Asia specifically, how should that geopolitical convergence change the way a risk committee thinks about attribution and response?

Two trends are clear:

1. The Navigator recorded 143 unique cyber-extortion victims across eight Southeast Asian countries between October 2024 and September 2025, up from 103 in the previous reporting period (39%). Four Southeast Asian countries entered the victim dataset for the first time during that reporting period. Cybercrime (especially cyber extortion) is growing everywhere and Southeast Asia is no exception.
2. Establishment (politically motivated state-aligned) hacktivism is increasingly an attribute of modern geopolitical conflict worldwide. It is accelerating and also escalating toward more visible physical impacts.

These threat categories are converging with regards to targets, techniques and impacts. They increasingly overlap with state activity and are both highly opportunistic in nature.

The result is that every organisation is potentially a target, and the distinctions between different types of actors are becoming less meaningful to threat and risk management – which means that simple, actor-oriented, sector-based intelligence and threat assessments are simply too naive now to serve as useful predictors.

For risk committees, this supports a graduated attribution model rather than a single verdict. Confidence in the technical facts of an incident may be high while confidence in the actor’s identity, motivation, or state relationship remains moderate or low.

If a CIO or board member reads only one number from Security Navigator 2026 before their next risk committee meeting, what should it be, and what decision should it change?

The number is 45% – the increase in observed cyber-extortion victims compared with the previous edition.

Risk committees should elevate cyber-extortion resilience as a board-level priority, with explicit oversight of recovery readiness, operational continuity, and the investment required to sustain operations during an extortion event.

Cyber Extortion is a proxy for other security threats. Tackling this one central issue will also cover a multitude of other threats and risks.

The post Q&A: The Cyber Risk Hidden in Business Interdependence appeared first on Bizruption Asia.

It is one signal among several. The Indonesia Investment Authority, the country’s USD 10 billion sovereign wealth fund, is a lead investor. Alongside Singapore’s Granite Asia, it has committed more than USD 1.2 billion to Indonesia’s data centre and AI ecosystem.

CoreWeave has chosen Indonesia for its first Asia-Pacific data-centre presence: three facilities totalling 360 megawatts, targeting operations by 2028. Scale alone does not make a hub.

The Constraint Isn’t Capital

The capital is arriving faster than the workforce to use it. Consultancy Kearney estimates Indonesia’s digital talent demand at around 600,000 professionals a year. Komdigi’s own AI Talent Factory programme, launched in 2025, has not disclosed how many participants it has trained, or how many have found jobs.

The government is not treating this as a real-estate story. Indonesia Investment Authority’s Chief Investment Officer, Christopher Ganis, has named sub-sea cables and supporting infrastructure alongside data centres as priorities. Officials tie that explicitly to data independence and resilience.

Zankore’s own economics illustrate the scale required. Industry estimates put end-to-end AI infrastructure investment at around USD 50 million per megawatt. That would put the Batang project’s ultimate cost in the tens of billions of dollars.

That is the case for optimism. It is also the case for caution. Connectivity, power, talent, capital and regulation all have to move together for infrastructure to become genuine regional advantage rather than a collection of announcements.

This main analysis on Indonesia’s cybersecurity governance gap, “The Governance Behind Indonesia’s Digital Opportunity,” makes the same point from the risk side. The institutions meant to govern this investment are still catching up to it.

The infrastructure case and the governance case are not separate stories. They are the same story, told from opposite ends.

What Indonesia Has That Its Neighbours Don’t

None of this guarantees Indonesia converts scale into regional leadership. Vietnam, Malaysia and Singapore are each building their own version of the same pitch, with their own power grids, talent pipelines and regulatory offers.

What Indonesia has that its neighbours cannot easily match is domestic demand. Its market is large enough that infrastructure built for its own digital economy can also serve the region. Sahabat-AI, the open-source Indonesian-language model set to run on Zankore’s capacity, is a bet on exactly that domestic base.

The right question for investors is not whether Indonesia is building. It plainly is, at a pace few ASEAN peers can match. It is whether the harder inputs, trained people, reliable power, coordinated regulation, arrive on the same timeline as the capital. Indonesia has answered the capital question.

The rest of the answer is still being written.

The post Indonesia Is Laying the Foundations for an AI Hub appeared first on Bizruption Asia.

Indonesia signed Government Regulation No. 33 of 2026 on 16 July 2026 – the long-awaited implementing rule for the country’s 2022 Personal Data Protection Law. It circulated publicly only in late August. The regulation fills in detail on cross-border data transfers, breach notification and impact assessments that businesses had navigated without since the law took effect in October 2024.

It does not complete the picture. Article 58 of the 2022 law calls for a dedicated authority to oversee personal data protection. As of September 2026, that authority has yet to be formally established.

Deputy Minister of Communication and Digital Affairs Nezar Patria said in July, at a US-ASEAN Business Council dinner in Jakarta, that the agency will “operate independently across all its structures.” The presidential regulation establishing it is still being finalised.

The Capital Is Already Moving

The investment cycle is not waiting. Indonesia currently has around 580 megawatts of operational data-centre capacity. Coordinating Minister for Economic Affairs Airlangga Hartarto said, as reported by the Jakarta Post on 12 July 2026, that investors had expressed interest in another 1.3 gigawatts. That represents an estimated USD 15–20 billion in additional investment.

Some of that is already committed. Firmus Technologies, working with Nvidia, is developing a 360-megawatt AI Factory campus in Batam designed for up to 170,000 Nvidia accelerators. Offtake agreements, Firmus says, could generate USD 25–30 billion over six years. EDGNEX has separately committed USD 2.3 billion to a 144-megawatt facility in Cikarang.

Where Digital Growth Meets Governance

 

Two cybersecurity leaders from Indonesia interviewed for this piece describe the same commercial dynamic playing out across Indonesian enterprises. Ardi Sutedja K., chairman of the Indonesia Cyber Security Forum, frames it as a question of pace at the enterprise level.

“In my experience, one of the most significant gaps lies in the speed at which organisations are investing in AI and cloud technologies versus the pace at which their security governance is maturing. Many Indonesian enterprises are quick to adopt new technologies, driven by the promise of increased efficiency and competitive advantage.

“However, the same urgency is not always applied to developing robust security frameworks. This often results in a reactive rather than proactive approach to cyber security, where measures are only put in place after a breach has occurred,” he explained.

Sugiarto RM, founder of the Indonesia CXO Network, sees it playing out across the wider economy.

“Indonesia already has a growing regulatory framework around personal data, critical information infrastructure and financial-sector cyber resilience, while enterprises are simultaneously increasing spending on cloud, AI and digital infrastructure. The challenge is making sure those two curves converge.”

The National Cyber Security Index provides another indication of the governance challenge. Indonesia scores 47.50, receiving full credit for having personal data protection legislation while scoring zero on the indicator for an empowered personal-data protection authority.

The result highlights the distinction between having a regulatory framework on paper and having the institutional capacity to enforce it.

Banks Already Know What Governance Looks Like

The clearest contrast is financial services. Indonesian banks sit inside a supervisory framework where technology governance and cyber maturity are binding requirements, not aspirations.

OJK Regulation 11/2022 established IT-governance rules for commercial banks. SEOJK 29/2022 added annual cyber-maturity assessments. POJK 1/2026, effective since 1 March 2026, tightened information-technology and third-party risk requirements further.

Philip Lee, head of Orange Cyberdefense APAC, told Bizruption.asia that this is the point at which cybersecurity stops being an IT problem and becomes a board one.

“This shift is increasingly driven by the evolving threat landscape, regulatory compliance and growing pressure from shareholders and local governments. With increased regulatory requirements around data protection, critical infrastructure, incident reporting, and cybersecurity governance, boards have become more engaged with the organisation’s operational environments.

“A major cyber incident or compliance failure can directly affect revenue, business continuity, reputation, customer trust and legal exposure. Translating technical risks into business outcomes helps boards understand their risk appetite and accountability. As cybersecurity becomes integrated into enterprise risk management, it is increasingly recognised as a strategic business resilience issue rather than simply an IT expense,” he said.

Banking has a mechanism for making that translation visible. The question for the rest of Indonesia’s digital economy is how the same discipline can develop as the data centres, cloud platforms and AI ventures now absorbing its investment wave continue to scale.”

What Actually Closes the Gap

Ardi frames the work ahead as cultural before it is technical.

“There must be a cultural shift within organisations where cyber security is viewed as a shared responsibility. This involves continuous education and awareness programs to ensure that every employee understands their role in protecting the organisation’s digital assets.”

Sugiarto describes the practical work still outstanding.

“The corresponding governance layer, who owns the risk, how data is classified, what can be put into an AI model, how third-party and cloud risks are assessed, how identities and access are controlled, and how quickly an organisation can recover from a compromise, is often still catching up.”

The measure that matters, Sugiarto added, is not the size of the security budget. It is whether the board understands the cyber risk it is buying, accepting or transferring. Asked what would close the gap, he ranks the constraints directly.

“Regulation is the catalyst, budget is the enabler, talent is the constraint, but governance and accountability are what will actually close the gap.”

That ranking matters for how capital gets allocated. A regulation can set the obligation and a budget can fund the response, but neither guarantees that someone at the top of the organisation is accountable when the controls fail. That accountability is what boards and investors are now being asked to underwrite.

The USD 15–20 billion now moving into Indonesian data centres is part of a much broader digital transformation. As the country’s infrastructure, AI adoption and digital economy continue to expand, the evolution of governance and accountability will become increasingly important to the companies, boards and investors participating in that growth.

For investors, understanding how governance develops alongside that opportunity will be an increasingly important part of the decision-making process.

References:

• Indonesia tumbles in cybersecurity ranking – The Jakarta Post
• Indonesia to set up independent personal data protection agency – ANTARA News
• National Cyber Security Index: Indonesia – e-Governance Academy, version dated 31 December 2025
• Law No. 27 of 2022 on Personal Data Protection, Republic of Indonesia (Article 58)
• Indonesia’s Financial Services Authority Strengthens the Digital Backbone of Banking Sector through Regulation No. 1 of 2026 – SSEK Law Firm
• OJK Enhances Governance and Risk Management for Sustainable Economic Growth – Financial Services Authority (OJK)
• Data Protection & Privacy 2026: Indonesia – Chambers and Partners
• Data Protection Laws of the World: Indonesia – DLA Piper
• IBM Study: ASEAN Data Breach Costs Rise to US$4.12 Million – IBM Newsroom ASEAN, 2026
• Govt eyes Nvidia investment to increase data center capacity – The Jakarta Post
• Indonesia secures US$2.3b Dubai investment for major data centre – Malay Mail

View More

The post The Governance Behind Indonesia’s Digital Opportunity appeared first on Bizruption Asia.

This piece is the evidence file: what the new rule actually looked like, company by company. At issue is not whether AI works, but whether the billions being spent on it can be shown, not just promised, to generate a return.

Four beats, zero protection

Line them up in order and the pattern is unmistakable.

TSMC raised its 2026 capex guidance from USD 52-56 billion to USD 60-64 billion on 16 July. CEO C.C. Wei cited AI megatrend conviction. Its US-listed shares fell anyway.

Alphabet posted its first negative free cash flow quarter since its 2004 listing, at USD 5.9 billion on 22 July. Capex had doubled to USD 44.9 billion. Shares fell in extended trading despite a revenue beat.

Meta’s free cash flow dropped 91% year-on-year to USD 784 million on 29 July. Shares fell in after-hours trading despite a revenue beat.

SK Hynix closed the window on 29 July with a record KRW 60.54 trillion operating profit, up 557% year-on-year. The stock closed 9.61% lower the same day.

The new rule

Four different reports, four different specific misses or firsts, one identical market reaction. That is not coincidence. It is a repricing of what a beat is now required to prove.

Before July, a revenue beat with raised guidance was reassurance. After it, raised guidance reads as a company promising more spending before it has shown the last round paid off.

The rule did not change the numbers companies report. It changed what investors demand those numbers prove. Operating expenditure still gets read on trailing performance. Capital expenditure, for the first time this cycle, is being read on unproven future return.

Not everyone agrees it is new

Michael Field, Chief Equity Strategist, Morningstar, told CNBC on 29 July 2026 that the moves reflect sentiment rather than fundamentals. “Simply put, it’s loss of confidence,” he said.

On that reading, nothing structural changed. Investors got nervous and the nervousness showed up in market-cap losses before AI infrastructure demand itself had shown any sign of slowing.

Both readings can be true at once. Sentiment and structural repricing are not mutually exclusive. A market that has grown genuinely cautious about proof is exactly the market that gets jumpy on any single data point.

The Test Q3 Earnings Will Face

The rule does not reset with the next earnings cycle. Every capex headline between now and October, when Q3 results land, will be read against the same test. Not whether the number is bigger, but whether the company can show what the last increase actually bought.

TSMC, Alphabet, Meta and SK Hynix did not fail that test in July. They simply had not yet been asked to sit it. The next round of hyperscaler and chipmaker earnings will be the first to face it directly.

The post Record Profits, Falling Stocks: The New Rule for AI Earnings Season appeared first on Bizruption Asia.

Three variables in the data are observable before a single dollar is committed. They are board composition, deployment maturity and the barrier the organisation itself names as the biggest obstacle to proof. None of them require inside information.

The Board Test

The first signal is board composition. KPMG’s Global AI Pulse survey found 82% of Asia-Pacific boards now cover AI in their discussions, but only 79% include a director with genuine AI expertise.

That three-point gap is small in isolation. It is the difference between governance and theatre. A board that treats AI as a topic to be briefed on, rather than a competency to be resourced, is already behind.

The Pilot Trap

The second is deployment maturity. Only 32% of Asia-Pacific firms are scaling AI agents across multiple business functions, rather than running isolated pilots. Korea leads the region at 41%. A company still confined to single-function pilots is closer to the 45% than the 55%, regardless of how much it has already spent.

IDC’s own research explains why the gap persists even at well-resourced firms.

Traditional ROI metrics fail to capture indirect benefits such as faster decision-making, improved customer experience and organisational resilience. A company measuring AI only against cost savings is using the wrong ruler. It will show up in the 45% regardless of how the technology actually performs.

The Validation From Outside Asia

The clearest validation of the mechanism comes from outside Asia-Pacific. Grant Thornton’s 2026 AI Impact Survey covered nearly 1,000 senior US business leaders. It found that fully integrated organisations are almost four times more likely to report AI-driven revenue growth than those still piloting: 58% against 15%.

“The organisations pulling ahead in AI are the ones with governance in place,” said Tom Puthiyamadam, Managing Partner of Advisory Services, Grant Thornton Advisors, 13 April 2026. The figure is US data, but the mechanism it describes, that integration maturity predicts value, does not stop at a border.

What To Ask Before The Cheque Clears

The same KPMG survey found the constraint respondents named themselves. 47% cited risk considerations as the single biggest barrier to demonstrating AI’s return, ahead of measurement difficulty or the technology itself.

That is not a technology problem. It is a governance disclosure that any board or investor can ask for directly. For a board or an investor screening AI exposure, that is the question worth asking before the capital commitment not after the earnings call.

The post Three Signals That Predict Which AI Bets Pay Off appeared first on Bizruption Asia.

The post The World’s Most AI-Committed Investors Run Companies That Cannot Deploy It appeared first on Bizruption Asia.

The region needs at least USD 200 billion in annual energy investment by 2030, three-quarters of it in clean energy, per the IEA and Imperial College London. Clean energy investment in Southeast Asia reached USD 47 billion in 2025, up from USD 30 billion in 2015, per the IEA’s World Energy Investment 2025 report.

Progress, but still less than a quarter of what is needed. Almost all remaining investment continues to flow to fossil fuels. For the full picture, see the companion piece: ASEAN Bets Billions on AI After Missing Its Clean Energy Targets.

The Financing Gap Is Not a Shortage of Capital, It Is a Shortage of Bankable Projects

Institutional money is not avoiding ASEAN. Southeast Asia’s clean energy spending represents only 2% of global totals, per the IEA – not because fund managers lack mandates, but because the projects, offtake structures and regulatory frameworks required to deploy at scale do not exist in sufficient volume.

The ASEAN Centre for Energy’s 2025 report identifies three structural barriers: high perceived risk, a fragmented market across ten divergent jurisdictions, and the absence of a coordinated regional pipeline of investment-ready projects.

The cost of debt compounds this directly. Onshore wind across ASEAN carries a nominal cost of 9%-12%, and utility-scale solar 8%-11%. Equivalent projects in developed markets finance at 4%-6%. That 300 to 600 basis point spread is the price of regulatory, political and currency risk.

Until those risks are structurally reduced, available capital and deployed capital will not converge.

Hyperscalers Are Building on the Wrong Side of the Ledger

The USD 1 billion commitments from Google in Thailand, Microsoft and Amazon across Malaysia, Indonesia and the Philippines dominate energy headlines. They should not be confused with supply-side infrastructure spending.

Every dollar deployed in a data centre campus funds energy consumption – it does not fund generation, transmission or storage. Each new hyperscaler facility adds load to a grid that already lacks the clean supply to serve it, widening the financing requirement rather than meeting it.

ASEAN’s power grid alone requires an estimated USD 800 billion in generation and transmission by 2045, per the World Bank’s ASEAN Power Grid Financing Initiative.

JETP: Committed Capital That Has Not Yet Moved

The Just Energy Transition Partnerships for Indonesia and Vietnam are the most substantial concessional mechanism in play.

Indonesia’s JETP carries total commitments of USD 21.4 billion. Financing approvals reached USD 3.1 billion as of December 2025. Total disbursements – combining JETP and AZEC – stood at USD 3.5 billion by February 2026, according to Coordinating Minister Airlangga Hartarto.

The structural constraint is visible in those ratios: JETP financing runs 96%-97% debt and only 3%-4% grants, per the ASEAN Centre for Energy. Sovereigns carrying commercial-rate debt to fund transition infrastructure, while simultaneously managing fiscal ceilings and a Hormuz-driven cost surge, face a compounding squeeze.

The Cirebon-1 coal plant retirement in Indonesia – the first intended live test of JETP’s coal phase-out – stalled over legal uncertainty, community opposition and official liability concerns, revealed IISD’s September 2025 analysis.

The lesson is not that the mechanism cannot work. It is that the distance between pledged finance and deployed finance is where most of the USD 170 billion gap actually lives.

Where the Gap Closes and When

Blended finance had reached USD 19.75 billion across 99 ASEAN transactions as of the most recent Convergence dataset – a 2023 baseline that understates current deployment but signals the architecture is functional. The velocity has not yet matched the shortfall.

The ASEAN Taxonomy and Transition Finance Guidance give allocators definitional clarity to move. Vietnam’s green bond market, flagged by Climateworks Centre as integral to its JETP, remains underdeveloped.

For fund managers, infrastructure investors and corporate treasurers, the operative question is not whether the opportunity is real. It is whether the specific project, jurisdiction and offtake structure has been prepared to institutional standard. Most have not.

The managers building bankable pipelines now are positioned to deploy when the window opens. In ASEAN’s energy transition, the window and the gap are the same thing.

The post The Capital Is Ready but the Projects Are Not. That is ASEAN’s Real Energy Problem appeared first on Bizruption Asia.

One month later, Enerdata confirmed Vietnam had delivered 57% of all ASEAN renewable additions between 2015 and 2024, and that the regional 2030 framework assigns it 73% of all projected additions through the decade.

For the full regional context, see the companion piece: ASEAN’s Clean Energy Decade Went Backwards. AI Is the USD 67 Billion Bet on What Comes Next.

Vietnam’s Renewable Execution Risk Is ASEAN’s Largest Single Point of Failure

If the country executes at PDP8’s required pace, ASEAN’s 2030 targets become achievable. If it stalls – through grid constraints, regulatory reversal or investor withdrawal – those targets miss by a margin no other member state can compensate for.

Indonesia, Malaysia and Thailand combined must multiply their own additions by at least five times versus the 2019–2024 period. Even so, Vietnam’s contribution remains structurally irreplaceable.

Hanoi has demonstrated it can build fast. Between 2019 and 2021, solar additions made the country briefly one of the fastest-growing clean energy markets in the world, reaching nearly 18 gigawatts of installed solar by April 2025 from 86 megawatts in 2018. The problem: it built faster than the network could absorb.

The Grid Cannot Yet Handle What PDP8 Requires

Transmission has not kept pace with generation. Severe curtailment hit solar and wind projects in Ninh Thuan and Binh Thuan – among the country’s highest-resource provinces – as output exceeded the system’s ability to move power north, where load is concentrated.

A 520-kilometre double-circuit 500 kV line completed in August 2024 doubled corridor capacity from 2,500 to 5,000 megawatts. Storms in October and November 2025 again forced significant renewable output offline. Battery storage must reach 10,000-16,300 megawatts by 2030. Today it is effectively zero at utility scale.

IEEFA calculates PDP8 requires more than USD 18 billion in transmission investment alone by 2030. Vietnam Electricity has been under-investing in the network for years because it sells power below cost recovery – a structural constraint the 2024 Electricity Law began addressing but has not resolved.

Norton Rose Fulbright flags bankability of power purchase agreements as a live concern for lenders, citing tariff uncertainty, curtailment exposure and the absence of government guarantees.

The Regulatory Risk That Stopped the Investment Clock

In 2024, authorities moved to retroactively revise purchase prices for 173 solar and wind projects, cutting expected revenues by 25-46%. The Vietnam Chamber of Commerce and Industry warned Parliament in March 2025 that proceeding risked “bankruptcies across the renewable energy sector” and the destruction of investor confidence required to execute PDP8.

The projects at risk are the same ones that proved the country could build at scale. The capital base that proved the model cannot be deterred and replaced simultaneously.

New frameworks – Direct Power Purchase Agreements under Decrees 57 and 58, both in force from March 2025 – replace the feed-in tariff model with competitive pricing. The architecture is structurally correct. Its delivery timeline competes directly with the PDP8 schedule.

The Question Every Vietnam Energy Investor Must Answer Now

The country’s gas fleet – 22,524 megawatts planned under PDP8 as a bridge fuel – is also directly exposed to the Hormuz disruption. LNG priced at crisis levels was not in any pre-February 2026 investment model.

Three questions require immediate answers from anyone holding Vietnam energy assets: whether grid access is contractually secured or subject to curtailment risk; whether PPA structures written under the old tariff regime are defensible against retroactive revision; and whether gas baseload assumptions have been stress-tested against a prolonged Hormuz closure.

Vietnam’s opportunity is real. The execution risk is the highest of any single market in any regional energy framework operating today. Those are not contradictory statements. They are the same investment thesis.

The post One Market. 73% of ASEAN’s Clean Energy Target. One Grid That Has Never Performed at This Scale. appeared first on Bizruption Asia.

The post ASEAN Bets Billions on AI After Missing Its Clean Energy Targets appeared first on Bizruption Asia.

The highest concentrations fall in smart electronics, digital services, and aviation and logistics – precisely the sectors a sovereign cloud region is designed to serve. The infrastructure is arriving faster than the people who can run it.

Microsoft has upskilled over two million Thais in AI over two years through the Ministry of Education and Ministry of Labour partnerships. The current 150,000-worker certification programme offers more than 280 industry-recognised Thai-language courses.

AWS separately targets 100,000 AI-ready workers in Thailand by 2026. The numbers accumulate. They describe different things. Certification in AI literacy – knowing how to use tools – is not the engineering depth required to build, deploy and maintain cloud infrastructure at commercial scale.

Dhanawat Suthumpun, Managing Director of Microsoft Thailand, stated at the launch of the Ministry of Labour programme in November 2025 that demand for Generative AI skills in Thailand’s workforce runs at 41%. Supply of workers who can operate at that level remains far below what the market requires.

Three Deficits

The talent constraint operates at three levels with three different timelines. At the foundation, basic AI literacy is where Microsoft and AWS programmes operate. Progress is real. It addresses adoption, not creation.

In the middle tier – data architects, cloud engineers, ML operations specialists – ManpowerGroup’s 2026 Global Talent Shortage Survey of 39,000 employers across 41 countries found AI model development has overtaken all other skills categories as the hardest to source globally.

In Asia Pacific and the Middle East, 71% of employers cannot fill open roles. Thailand’s position is structurally worse: Singapore consistently pulls the region’s strongest engineers northward, deepening gaps in neighbouring markets.

At the apex – senior AI architects and research scientists – Thailand does not produce enough domestically, and the global market for them runs at salary premiums of 67% above standard software engineering roles, per Glassdoor.

What Policy Does and Does Not Address

Thailand’s response is active but structurally limited. The BOI offers a 200% tax deduction on qualifying AI training expenditure, with additional corporate income tax exemptions for firms investing 1%-3% of payroll in AI programmes.

The Digital Economy Promotion Agency funds SME digital transformation grants. These incentives attract investment. They do not build the engineering pipeline that makes investment productive.

What is missing is the equivalent of Singapore’s SkillsFuture at scale: systematic curriculum reform that builds AI and engineering depth into secondary and tertiary education as core graduate output.

Dr Surachai Sathitkunarat, NXPO President, identified curriculum realignment as the primary structural requirement when releasing the workforce demand survey in June 2025.

That realignment takes a minimum of five years to produce graduates at the level the market requires.

The Return Horizon

Microsoft’s data centre infrastructure will be operational before the engineering base it needs reaches sufficient depth.

That does not invalidate the investment. It defines the risk: that the cloud region functions, for its first years, primarily as a platform for multinationals and large domestic conglomerates with existing technical capability – not the broad economic multiplier Thailand’s hub ambitions require.

The literacy gap closes in programme cycles. The middle-tier gap closes in five to seven years, if curriculum reform starts now. The apex gap closes in a decade.

Investors and boards assessing Thailand’s AI economy thesis need to hold all three timelines and understand which one governs the return horizon on the infrastructure arriving this year.

The post The Talent Gap That Could Derail Thailand’s AI Hub Ambition appeared first on Bizruption Asia.