Is cyber resilience enough?

A tito in Quezon City gets a text on his lunch break. The sender name reflects the government agency, and the message says he has an unsettled violation. The website he taps looks official and takes him through each step, so he pays.

A young mother in Cebu gets a message that seems to come from her bank, telling her that her reward points expire tonight. She enters her name, birthday, address and card details.

A finance officer in Makati gets a message from the CEO’s social media account, urgent and confidential, asking for a transfer before the end of the day. The profile photo and the name are right, and only the account is fake.

October is Cybersecurity Awareness Month, a timely reminder that the fight against cybercrime is no longer just about protecting systems, but also about protecting the people who trust them.

None of the three was beaten by a genius hacker or a clever piece of code. Somebody borrowed the one thing every society runs on, which is trust.

I believe in cyber-resilience. After spending time with the data, though, I keep asking myself whether it is enough.

What the data says

Check Point’s Philippine Threat Landscape Report 2026 tracked 66 active threat actors, and 35 of them, more than half, are financially motivated. When we ask who is coming for us, the answer is people who want our money and have learned that the easiest way to get it is through us, not through our systems.

The report counted 24,875 cases of exposed data across the Philippine organizations it monitored. Customer credentials were the largest category, and information stealer logs were the leading source. 

Nearly 44 percent of the cases were linked to malware harvesting credentials from infected devices. Nobody has to break down a door for this. A piece of malware sits on a device and takes notes on everything its owner types, so your government portal password and your bank password can end up in the same stolen file, waiting to be sold.

Phishing alerts from January to August totaled 2,386, against 2,485 over the same period last year. That is a drop of around four percent, which is hardly a victory. The threat has become a permanent resident.

Impersonation has risen across the three comparable January-to-August periods. This year there were 1,194 alerts. Of these, 972 (81.4 percent) impersonated companies and 222 (18.6 percent) impersonated executives. A familiar face and a familiar name no longer prove anything.

The report also warns that AI-assisted reconnaissance and exploit development could shorten attack timelines, and that AI agents connected to sensitive systems create exposure of their own.

Across all of these findings, the attackers use valid identities, valid credentials, and trusted processes. They don’t break in; they log in. They hack the human, and they do it at scale.

Why resilience alone falls short

Resilience measures how well one organization absorbs a hit and recovers. The scammer does not respect our org charts.

A bank can recover perfectly from an incident and still have a customer who lost her savings and now says, “I don’t trust digital payments anymore.” She won’t name the platform that failed her. That loss of confidence is paid for by all of us, and no single institution can repair it, whether it is a bank, a telco, a regulator or a government agency.

We can respond better with the 3 C’s: collaboration, co-creation, and coopetition.

Collaboration has to cut across industries. A scam that starts as a text message ends in a bank account, and along the way it touches a telco, a social media platform, a payment provider, a regulator and law enforcement.

Co-creation. Public and private sectors should design solutions together, instead of reviewing each other’s. Government brings the mandate, the reach and the authority to enforce, while industry brings speed, technology and a front-line view of fraudsters.

Coopetition takes courage. Fintechs and banks compete hard for the same customers, and they should keep competing on service, innovation and price. They should not compete on safety.

Scams do not carry passports. A fraudster in one country, a mule account in another and a victim in a third can move money in seconds and the evidence moves even faster. The scammers already work together, trading tools, templates, stolen data and tips in open groups without paperwork or approvals. If the people defending the public move slower than the people attacking it, we will always be a step behind.

What to do about it

The report lays out six priorities through 2027: focus on impact, not volume; treat identity and session exposure as a continuous risk; reduce exposure along the common paths of intrusion; extend third-party governance beyond onboarding; govern AI adoption and access and convert threat intelligence into defined response actions.

One rule applies to all six. A finding that sits in a slide deck protects no one, so every credible finding should be validated, given an owner, acted on according to its likely impact, and retested after the fix. Validate, assign, act, retest.

So, is cyber-resilience enough?

I don’t think so, because it covers only the institution. A cyber-resilient Philippines is not a country where attacks never happen. It is one where an attack on one of us becomes a lesson learned by all of us, and where the tito, the young mother and the finance officer are not facing it alone.

In that country, trust is not something fraudsters can borrow, because we have built the people, the partnerships, and the systems to protect it.

The scammers are already working together. It’s about time we do the same and win against them.

*   *   *

Lito Villanueva is the Philippines’ leading and award-winning thought leader in inclusive digital finance. As EVP and Chief Innovation and Inclusion Officer of RCBC, he has driven large-scale digital initiatives that advanced financial inclusion. He is the founding chairman of FinTech Alliance PH, representing 95 percent of the country’s digital retail financial transactions with an aggregate user base in excess of 100 million, and the co-founder and Global Ambassador of the Asia FinTech Alliance. Recognized as a People Asia Men Who Matter 2025, Digital Leader of the Year, Asia Trailblazer, and AGORA Awardee, he continues to shape the fintech landscape in the Philippines and beyond.