Deloitte Indonesia’s Alex Cheung: Cyber resilience must evolve alongside digital transformation

As organisations embrace emerging technologies, he advocates for a balance in innovation, security, accountability, and long-term value.

With the rise of cloud computing, artificial intelligence, data platforms, and connected business ecosystems within organisations, the expansion of Indonesia's digital economy is definitely at an unprecedented pace.

The digital transformation initiatives have gained momentum across industries, hence the challenge is no longer simply adopting new technologies but effectively integrating governance, security, and trust into their transformation journeys.

Providing insight to this is Alex Cheung, a Management Consulting Director within the Technology & Transformation practice at Deloitte Indonesia. Specialising in cybersecurity for over two decades, he has led cybersecurity and IT advisory engagements across Asia Pacific, the United States, and Canada.

He has worked with organisations in the financial services, telecommunications, technology, and healthcare sectors, advising them on strengthening cyber resilience, managing enterprise risks, and navigating complex digital environments. His work further spans cybersecurity strategy, incident response, technology transformation, governance frameworks, and risk management.

Alex is bringing his expertise to the Indonesia Technology Excellence Awards 2026, where he will be returning as one of the judges. In line with this role, Alex shared his views on high-stakes cybersecurity incidents, the evolving threat landscape facing Indonesian organisations, and the importance of embedding security and governance into digital transformation programmes.

How do you approach making high-stakes decisions during a cybersecurity incident?

In high-stakes cyber incidents, my approach is to make decisions through a consultative and structured risk-based approach, such as using the NIST incident response principles, whilst also leveraging my past experiences with cyber resilience and business continuity.

The first priority is understanding business impact — identifying what systems, data, customers, or critical services are affected and determining the potential operational and regulatory consequences. From there, decisions should balance containment speed against business continuity, where downtime can have systemic implications. I also strongly believe executive leadership must be involved early because cybersecurity incidents today are enterprise risk events rather than isolated IT problems.

Finally, transparent stakeholder communication and rapid post-incident lessons learned are essential to strengthening long-term resilience and institutional trust.

Which sectors in Indonesia do you think are most vulnerable to cyber risks today, and why?

All sectors are vulnerable to cyber risks, but in the context of Indonesia, I believe financial services, telecommunications, government services, and rapidly digitising consumer platforms have seen an exponential rise in their cyber threat levels. These industries hold large volumes of sensitive personal and financial data whilst simultaneously undergoing aggressive digital transformation, which expands the attack surface significantly. Financial institutions face increasing exposure from sophisticated fraud, ransomware, third-party ecosystem risks, and AI-enabled cyberattacks as digital banking adoption accelerates across Indonesia.

From Deloitte’s earlier edition of “Future of Cyber”, many organisations are shifting from perimeter-based security toward cyber resilience and zero-trust models. However, maturity levels across Indonesia remain uneven. The challenge is not simply deploying more technology, but ensuring governance, cyber talent, supply chain oversight, and security-by-design principles evolve at the same pace as digital innovation.

How prepared are Indonesian enterprises when it comes to scaling digital transformation and adopting emerging technologies such as AI, cloud, and data platforms?

Indonesian enterprises have made significant progress in adopting cloud, AI, and digital platforms, particularly in banking, telecommunications, e-commerce, and large conglomerates. However, many organisations are still in a transitional phase where technological adoption is advancing faster than governance, cybersecurity, and operational maturity.

One of the biggest gaps I observe is that enterprises often focus heavily on deployment speed and innovation outcomes without fully embedding cyber resilience, data governance, and responsible AI controls from the beginning. This is where frameworks such as Deloitte’s Trustworthy AI become increasingly relevant, particularly around transparency, accountability, fairness, privacy, and human oversight in AI deployment. Many Indonesian enterprises are now recognising that AI governance cannot be treated separately from enterprise risk management and cybersecurity.

Overall, Indonesia has strong momentum and digital ambition, but sustainable scaling will depend on whether organisations can integrate security, governance, and trust into their transformation programmes rather than treating them as secondary considerations.

What role should regulators and the government play in enabling innovation whilst supporting a resilient and future-ready digital ecosystem in Indonesia?

Regulators and government agencies play a critical role in creating an environment where innovation and resilience can coexist rather than compete with each other. In Indonesia, this means developing clear, practical, and forward-looking regulations that encourage responsible adoption of emerging technologies whilst maintaining strong protections for consumers and their data. I believe regulators should increasingly focus on risk-based approaches rather than purely compliance-driven models, especially as technologies such as AI evolve rapidly.

The government also has an important role in strengthening national cyber resilience through public-private collaboration, sector-wide threat intelligence sharing, cyber talent development, and baseline security standards. Earlier editions of Deloitte’s “Future of Cyber” consistently highlight that trust is becoming a strategic economic enabler, not just a regulatory obligation. Countries that successfully balance innovation with resilience and digital trust to become a digital economy will likely become more competitive over the long term.

What improvements would you suggest to strengthen technology strategy alignment, digital governance, and innovation frameworks in Indonesia?

One of the key improvements Indonesia can make is strengthening the alignment between business strategy, technology investment, and enterprise risk management. In many organisations, digital transformation initiatives are still managed primarily as technology programmes rather than enterprise-wide strategic change initiatives involving operations, governance, legal, and IT functions. Stronger digital governance frameworks are needed to ensure accountability for AI, cloud, data management, and third-party ecosystem risks at the board and executive levels. I also believe organisations should adopt more measurable KPIs that integrate strategy, governance, and IT into innovation programmes from the outset.

Ultimately, Indonesia’s long-term competitiveness will depend not only on how quickly organisations innovate, but also on how sustainably and securely they scale innovation across increasingly interconnected ecosystems.

As a judge for the Indonesia Technology Excellence Awards 2026, what factors will you look for in technological projects and solutions?

As a judge, I would look beyond technical sophistication alone and focus more on measurable business impact, scalability, resilience, and long-term sustainability. The strongest technological initiatives are usually those that solve meaningful business or societal problems whilst demonstrating clear operational outcomes and customer value. I would also assess whether cybersecurity, privacy, and digital trust considerations were embedded into the project design (i.e. “security by design”) rather than added later as compliance requirements. In the context of emerging technologies such as AI, I believe responsible innovation is becoming increasingly important, particularly around explainability, governance, ethical use, and risk oversight — areas strongly reflected in Deloitte’s Trustworthy AI principles. Another key factor is execution excellence: whether the organisation successfully aligned leadership, people, processes, and technology to drive transformation outcomes at scale. Ultimately, the projects that stand out are those that combine innovation with resilience, trust, and tangible value creation for customers, stakeholders, and the broader Indonesian digital ecosystem.