Philippine Outsourcing Sector Faces Cybersecurity Challenges Amid Global Competition

The Philippine outsourcing sector, particularly in the information technology and business process management (IT-BPM) realm, is under increasing pressure to bolster data governance and cybersecurity measures. Analysts warn that recent cybersecurity incidents could significantly undermine client confidence in the industry, which is already grappling with challenges from emerging competitors such as India, Egypt, and Vietnam.

Dominic Vincent D. Ligot, director for AI Ethics & Data Governance at the Philippine AI Business Association, emphasized that while one alleged insider incident should not reflect on the entire workforce of nearly two million, the perception of risk associated with offshore delivery can be detrimental. He noted that prominent breaches can lead clients to question the strength of data control in the Philippines.

“One alleged insider incident must not be generalized across a workforce of nearly two million people. Nevertheless, clients often price risk by location, and prominent breaches can reinforce perceptions that offshore delivery means weaker control.”Dominic Vincent D. Ligot, Director for AI Ethics & Data Governance, Philippine AI Business Association

One recent incident involved a data breach traced back to a former employee at a Manila-based call center, which affected approximately 900,000 customers of the Australian firm Origin Energy Ltd. This breach is reminiscent of a previous vishing attack on Qantas Airlines’ Manila call center, raising concerns about the sector's reputation.

According to Ligot, this incident is indicative of broader governance failures rather than being merely an offshore problem. He outlined the necessity for IT-BPM firms to implement stronger personnel screening, ethical AI usage, and independent security audits to prevent future breaches. Moreover, he advocated for the establishment of robust frameworks for identity and access management based on zero-trust and least-privilege principles.

“Data protection and cybersecurity are fundamental to the trust that underpins the Philippine IT-BPM industry.”IT & Business Process Association of the Philippines

The IT & Business Process Association of the Philippines (IBPAP) acknowledged the importance of data protection and cybersecurity in maintaining trust within the industry. In a statement, the association noted that data protection and cybersecurity are fundamental to the trust that underpins the Philippine IT-BPM industry and highlighted its members' ongoing investments in enhancing safeguards and compliance with relevant laws. It also noted that the industry is actively working to promote responsible practices and increase cybersecurity awareness.

“Incidents involving Philippine-based operations can have a significant reputational impact because international clients entrust BPO companies with highly sensitive customer information.”Ronald B. Gustilo, Digital Pinoys National Campaigner

As the Philippine IT-BPM sector faces slower growth, automation, and the need to transition to higher-value work involving AI and cybersecurity, experts stress that the Philippines must not rely solely on its cost advantages but must also enhance its cybersecurity framework to sustain its position as a global IT-BPM player.

Under the IBPAP's latest roadmap, the IT-BPM sector is projected to generate at least $43.3 billion in revenues and employ 1.85 million AI-enabled workers by 2028, down from earlier forecasts of $59 billion and 2.5 million workers. This adjustment reflects the dual challenges of rapid AI adoption and intensifying global competition.