The Security Priorities APAC And EMEA Leaders Doubled Down On — And Deprioritized — In H2 2025
Summary
In the second half of 2025, Security and Risk (S&R) leaders in APAC and EMEA reprioritized their focus, with Governance, Risk, and Compliance (GRC) emerging as the top priority due to accelerating regulatory obligations and geopolitical instability, surpassing AI. AI risk management evolved from safe generative AI adoption to securing "agentic AI" systems, necessitating guardrails and red-teaming strategies. Concurrently, API and software supply chain security surged in urgency, driven by API sprawl, SBOM mandates like the EU's Cyber Resilience Act, and stalled DevSecOps advancement. Regional differences persist, with EMEA heavily prioritizing Third-Party Risk Management (TPRM) due to regulations such as DORA, NIS2, and GDPR, while APAC's priorities are more fragmented across numerous themes. Leaders are advised to leverage FAIR-based quantification, regulatory intelligence, continuous control monitoring, and Forrester's AEGIS framework for agentic AI.
Key takeaway
APAC and EMEA S&R leaders in H2 2025 are prioritizing Governance, Risk, and Compliance (GRC) over AI, with AI risk management shifting to securing agentic AI systems. This demands designing guardrails against excessive autonomy, red-teaming AI, and leveraging frameworks like Forrester's AEGIS for policy-as-code controls. Concurrently, API and software supply chain security, driven by SBOM mandates, requires embedding security earlier and managing component risk in AI/ML pipelines.
Topics
- GRC
- Agentic AI Security
- Software Supply Chain Security
- API Security
- Third-Party Risk Management
Best for: VP of Engineering/Data, Director of AI/ML, AI Architect, CTO, Executive, Consultant
Related on AIssential
Editorial summary, takeaway, and curation by AIssential. Original article published by Featured Blogs - Forrester.