If you run a shop or a cafe, the headline "95% of organisations in Indonesia had a cyber incident" probably sounds like a story about banks and big corporations. That is a fair first reaction. But the number deserves a slower read, because what sits underneath it is very close to your till: who holds which account, who is allowed in where, and who notices when something looks off.

What Cisco actually reported

In mid-October 2026, Cisco released its Relentless Defense Report. According to ITBeat's coverage, 95% of organisations in Indonesia had a cyber security incident in the past 12 months, and more than half of those incidents involved AI-enhanced attacks. The report puts Indonesia's average cyber defence score at 72 out of 100, according to IndoTelko.

One figure stands out for small businesses: only 63% of organisations say their security, network, and IT teams work as one unit with shared visibility and tools.

The four headline numbers from Cisco's report on cyber defence in Indonesian organisations: 95% had an incident, over 50% involved AI-enhanced attacks, 63% have coordinated teams, average score 72 out of 100

But that is about big companies, right?

A fair question. The study surveys security professionals inside organisations, not corner stalls or coffee counters. Globally it covers roughly 8,000 professionals across 30 markets, according to DQ India. So do not read 95% as "95% of shops in Indonesia have been attacked". The report does not support that claim.

What you can take home is the pattern. Large organisations trip over the same things as small ones: access nobody clearly owns, data scattered around, and nobody seeing the whole picture. The difference is that in a small shop the owner often does everything, so a single gap shows up directly in daily operations.

Six of the same gaps, shop and cafe edition

These are illustrations, not incidents from any real customer. You may still recognise a few.

  • The business WhatsApp and social accounts sit with one person, and if that account is hijacked, orders and customer trust suffer with it.
  • The till password is shared, so when a price changes or a sale is voided, nobody can say who did it.
  • A staff member left months ago, but their access to groups, the till, and the delivery app is still live.
  • Customer and stock data lives on a personal phone. Lose the phone and the data goes with it.
  • Updates and backups keep being postponed until things quiet down.
  • A message claims to be from a courier, a bank, or a supplier and asks for an OTP code.
Six everyday gaps in shops and cafes, with the core idea: one account, one owner

Notice that almost none of this needs a sophisticated hacker. If more than half of incidents really involve AI-enhanced attacks, scam messages can be produced faster and look cleaner than before, and "you can always spot a scam" stops being a safe assumption. But the doors being knocked on are the same ones: accounts without owners, shared passwords, and access that never gets revoked.

The biggest lesson is coordination, not tools

Cin Cin Go, Managing Director of Cisco Indonesia, stressed that defence speed is driven by operational agility, not just technology. The numbers back that up. The hurdles Indonesian organisations report are not "not advanced enough". They are data that cannot be reached and metrics that are hard to explain to leadership. In all, 46% said they had lost important insights because data was out of reach, and 38% spend more time gathering data than handling threats.

Hurdles in Indonesian organisations: 46% lost insights because data was out of reach, 43% metrics too technical for executives, 38% more time gathering data, 29% struggle to translate metrics, 26% no consistent way to measure

Cisco also compares its top-performing group, which it calls Relentless Defenders, with everyone else. In Indonesia 29% of organisations fall into that group, against 8% globally. Globally, the gap between that group and the rest shows up in things that are organisational: how well coordinated the team is, and how consistent the controls are over accounts, including those held by AI agents. It is not about who bought the most expensive tool.

Global comparison of Relentless Defenders and all other organisations on coordinated teams (83% vs 37%), AI agent controls (86% vs 37%), and fewer incidents after a budget increase (71% vs 39%)

For a small business the translation is simple: if the owner, the cashier, and whoever runs the online shop do not share a picture of who holds what, you are on the right-hand side of that table.

What you can do this week

No big budget needed. One afternoon is enough.

  1. List every business account: WhatsApp, Instagram, marketplace, till, email, delivery app. Next to each, write who is responsible.
  2. Change the till password and any shared logins, then give each person their own login where the system allows it.
  3. Remove access for anyone who no longer works for you.
  4. Turn on two-step verification for the most important accounts, especially email and WhatsApp.
  5. Move customer and stock data off personal phones to somewhere that can be backed up.
  6. Agree on one simple rule: an OTP code is never shared with anyone, whatever the reason.

Closing

If you would like to talk through your own setup, for example how access is split between the till, stock, and online orders, the XETUP team is happy to be a sounding board. Message us on WhatsApp at +62 823 1499 5005 and tell us about your situation first.