HKCERT Outlook 2026: incidents hit a record in 2025, and nearly 30% of enterprises still have no dedicated cybersecurity staff
HKCERT recorded 15,877 cybersecurity incidents in 2025, a record and 27% higher than the year before, with phishing at 57%. A survey of 622 enterprises found that nearly 30% still had no dedicated cybersecurity staff, and that SMEs were more cautious than large firms in spending.
The 2025 figures
The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) released Hong Kong Cybersecurity Outlook 2026 at a briefing on 28 January 2026, and published the press release on its website on 29 January. It said 15,877 cybersecurity incidents were recorded in Hong Kong in 2025, a record and 27% higher than the year before.
Phishing remained the main threat, at 57% of incidents. HKCERT said generative artificial intelligence had made phishing messages more realistic and harder to spot. Attacks had also moved beyond ordinary email to social media or instant messaging platforms (for example WhatsApp, 34%) and cryptocurrency platforms (18%).
There were 2,328 incidents involving vulnerable systems, or 15%, more than 3.5 times the year before, which suggested attackers were making more use of misconfiguration and unpatched weaknesses. Botnet-related incidents accounted for about 18%.
Staff and spending among smaller firms
HKCERT also published the Hong Kong Enterprise Cybersecurity Landscape, a study of 622 enterprises (544 SMEs and 78 large enterprises) and 50 cybersecurity service providers. Nearly 70% of enterprises had someone responsible for cybersecurity. By size, 67% of SMEs had staff responsible for cybersecurity, compared with 95% of large enterprises. Only 26% of SMEs had dedicated cybersecurity staff, compared with 59% of large enterprises.
On spending, only 13% of SMEs had increased cybersecurity-related resources in the previous year, compared with 41% of large enterprises. Looking ahead 12 months, SMEs were also more cautious than large enterprises in plans to hire cybersecurity staff, to train, and to raise budgets.
The risks flagged for 2026, and practical first steps
The report listed five main risks for 2026: attacks driven by artificial intelligence; weak rules on how firms use AI, which can increase the chance of a data leak; gaps in the supply chain and among contractors; over-reliance on a single cloud platform, creating a single point of failure; and new risks from AI-enabled devices. The study also found that, among enterprises that used AI, about 35% would enter company data into AI tools.
Smaller firms do not need to match the scale of a large enterprise all at once. They can start by naming someone to keep an eye on day-to-day security, adding an extra step of verification to email and logins, keeping backups separately, patching systems, and setting out which company data must not be entered into public AI tools.
This article is based on public reports and official statements. It is for general reference only, and is not legal advice. If you would like to discuss your own systems or security arrangements, please contact us.
Related services
Please tell us about your current situation
Please call, use WhatsApp, or complete the enquiry form. We will review the situation and recommend a suitable course of action.