Across Asia-Pacific (APAC), security leaders are balancing growing security requirements with operating the capabilities already in place. Every capability enters an organisation with a purpose: to close a gap, improve visibility or support response. Yet as capabilities accumulate, maintaining, coordinating and reporting on them can consume the capacity they were intended to create.
A 2025 IDC InfoBrief sponsored by Lumen reports that only 40% of organisations believe they properly utilise and manage their cybersecurity tools.1
The challenge is not simply how many technologies are in place, but whether the operating model connects them and translates activity into outcomes the business can understand.
The security capability tower
Think of the security environment as a tower built over time. Each block represents a tool, platform, integration, process or provider introduced to address a specific need. In a stacked-block tower, adding, changing or maintaining one block can affect others. As the tower grows, keeping the overall environment connected and governed requires greater coordination.
Stage one: The foundation is clear
At first, the tower is easy to understand. Early investments are intended to improve visibility, detection and response.
With fewer systems and dependencies, the path from signal to action is clearer, as are monitoring, escalation and ownership.
Stage two: Every new block adds weight
For organisations operating across multiple APAC markets, growth can add another layer of complexity. Teams need to manage more consoles, contracts, integrations and alert streams, while knowledge of how the components work together can become concentrated among a few specialists.
The tower appears more capable, but maintaining its connections demands an increasing share of the team’s time and expertise.
Stage three: Coordination becomes the work
As the tower rises across markets, it needs broader monitoring and deeper expertise. Many organisations add providers to fill the gaps, but each new block brings its own scope, console and escalation process. The tower grows, and so does the number of connections holding it together.
Holding those connections in place now takes up the team’s capacity:
- Coverage gaps across APAC time zones
- Scarce expertise concentrated in a few people
- Handovers that stall between teams and providers
- Ownership that blurs over who acts and who decides
Another block alone cannot steady the tower. The connections also matter: clear ownership, defined escalation paths and handovers everyone understands.
A managed service takes on agreed monitoring and response activities within a defined scope. A co-managed service shares those activities with the internal team. In both models, the provider adds coverage, expertise and service reporting, while the organisation retains accountability for risk decisions and business context.
Whichever model is used, it depends on clear ownership, connected workflows, defined escalation paths and understood handovers. When these elements align, external expertise can help manage the operational workload and leave more internal capacity for risk decisions, investigations and resilience.
Stage four: When keeping the tower upright becomes the job
As the tower becomes more complex, executives ask what the combined investment delivers.
Compliance teams need evidence, while security and business leaders need to understand how activity supports resilience and organisational priorities.
When evidence is distributed across systems, processes and providers, the relationship between effort and outcomes becomes more difficult to explain.
Analysts maintain platforms, manage integrations and coordinate handovers, while specialist knowledge can remain concentrated among a few people and reporting remains manual.
Every block can still serve a legitimate purpose. The question is whether upkeep leaves enough capacity for investigation, response and other security priorities.
The tower is still standing, but what began as technology decisions has become a broader question of people, processes, governance and the organisation’s ability to act.
How upkeep accumulates
| 1. Foundation | 2. Expansion | 3. Coordination | 4. Upkeep |
| Core monitoring and defined responsibilities | More tools, data sources, services and integrations | More workflows, providers, handovers and dependencies | More maintenance, reporting and operational oversight |
Figure 1. As security capabilities accumulate, the operating model must keep pace to connect, govern and explain them.
Turning the tower back towards outcomes
In the same 2025 IDC InfoBrief, sponsored by Lumen, surveyed organizations reported: Operational efficiency (33%) as the leading business value, followed by improved risk posture (27%), when asked to select the most important business values to their organization as a result of their cybersecurity efficacy and resilience level.
When security becomes difficult to manage, another technology is not necessarily the answer. Start by examining how existing capabilities work together:
- Which capabilities directly support monitoring, investigation and response?
- Where do connections require significant operational effort?
- Where could ownership, escalation and accountability be clearer?
- What information links security activity to business and risk outcomes?
For APAC security leaders, the priority is to align capabilities, responsibilities and expertise around the outcomes that matter most.
An organisation can build internally, share defined operational responsibilities with a specialist provider through a co-managed model, or assign agreed activities to a managed service within a defined scope.
The goal is balance: less capacity spent on upkeep and more available for investigation, response, risk prioritisation and resilience.
Take the next step
Choose the operating model that fits your requirements
Read the guide: Build, Co-Manage or Buy? A Decision Guide for APAC Security Leaders to compare approaches to retaining, sharing or assigning security responsibilities. Need to discuss a specific challenge?
Need to discuss a specific challenge? Request a complimentary session with Lumen security specialists.
To explore the broader Lumen security portfolio, visit the Lumen security services.
Source
1IDC InfoBrief, sponsored by Lumen, The New Cybersecurity Equation: Risk, Response, and Business Outcomes, #US53083025, February 2025
Percentages and descriptions should be read in the context of the research methodology and respondent base set out in the source.
Disclaimer: Services not available everywhere. Business customers only. Lumen may change, cancel or substitute products and services, or vary them by service area at its sole discretion without notice. ©2026 Lumen Technologies. All Rights Reserved.
Questions about Lumen service? Email apac.mail@lumen.com or call +65 6037 9100 or +61 1300 240 161
