The National Cybersecurity Association (NCA) reported that in 2024 alone, there were some 659,000 separate cybersecurity incidents, impacting around 46.15% of government agencies and businesses.
Yet, by international standards, the capacity of Vietnamese businesses and organisations to respond to these incidents remains limited. A report by US-based digital communications technology conglomerate Cisco revealed that only 11% of Vietnamese businesses and organisations have reached a level of readiness to effectively handle cybersecurity breaches.
No absolutely safe systems
In April, the local CMC Technology Group fell victim to a ransomware attack, which disrupted services for more than 10 hours. According to a spokesperson of the company, the attack targeted a small-scaled subsidiary that provided a specialised service to a limited customer base.
Do Van Thinh, director of the cybersecurity monitoring centre at CMC Cyber Security, shared that the group swiftly activated its cybersecurity response protocols, isolating the source of the attack and conducting a thorough review of its information security processes. Within 24 hours, the entire system was back under control, with services of the core subsidiaries unaffected.
Thinh stressed the importance of having sufficient incident-response materials and models, as well as clear response processes and responsibilities, to ensure effective response. Raising cybersecurity awareness across the organisation, he noted, is also crucial.
Vu Ngoc Son, head of research, consulting, and technology development and international cooperation at the NCA, pointed out that most Vietnamese businesses still lack the capabilities, processes, or preparations necessary for countering cybersecurity threats.
A December 2024 survey by NCA found significant security gaps across businesses.
On the technical side:
On the process side:
- 14% lacked antivirus software
- > 24% had no firewalls
- ~ 36 % had no data backup or recovery solutions
- 48% had cybersecurity monitoring in place
- Just 53% had implemented a standardised procedure
- 64.12% proactively assessed their security situation
- ~ 20% of businesses and organisations had no dedicated cybersecurity staff
During the first national-level live cybersecurity drill in April, over 40 vulnerabilities were discovered, highlighting the persistent risks and reinforcing the message that no systems are completely secure.
At a roundtable discussion held by the NCA on May 21, cybersecurity experts noted multiple factors behind the low preparedness of Vietnamese businesses and organisations, including:
- Businesses have inadequate and inconsistent security measures, along with the slow adaptability to constantly updated technology and digital transformation, including the AI boom.
- Organised cybercrime gangs, particularly sophisticated and cross-border ones, have been mushrooming.
- Even some large Vietnamese enterprises with cybersecurity operations centres suffer from a shortage of skilled personnel to manage these systems.
- Compounding the problem, many staff members as well as leaders remain indifferent to cybersecurity, while regulations and security technologies lag behind evolving threats.
Comprehensive investment, concrete measures
Experts stressed that cyberattacks are not only aimed at stealing data or disrupting services but also target key government agencies and big enterprises, threatening national security and social order. The escalation of both the number and sophistication of those attacks demands immediate action to improve cybersecurity readiness.
Cybersecurity is not an optional add-on, Son said. It is a strategic responsibility that must be incorporated early into the core of every business’s risk management plan – from the very top down. He also urged leaders to actively participate in strengthening their companies and organisations’ cyber incident response capabilities.
Human remain the decisive factor, Son added. Regular skill training and awareness improvement for all employees are essential, laying the foundation for effective technological and procedural measures.
Four Vietnamese cybersecurity experts make their mark on the global security landscape:
In early May, Son went on, the NCA launched the first free cybersecurity course on its nCademy platform, equipping individuals with basic information security knowledge. Ongoing free courses, to be updated routinely, will be available on the platform to ensure users stay alert to new cybercrime tactics.
The nCademy app developed by the National Cybersecurity Association.
On the technological side, businesses and organisations need to invest in comprehensive and integrated security solutions that incorporate AI-powered data analysis and connect with global threat intelligence feeds for early detection and response to latent risks.
Equally important are clear incident-response procedures, well-defined roles and responsibilities, and up-to-date emergency contact lists for reporting and addressing incidents swiftly.
Photo series: Prime Minister Pham Minh Chinh attends the launch ceremony of a campaign promoting digital literacy for all in Hanoi on March 2025. (Source: VNA)
Around-the-clock security monitoring, standardised contingency plans and incident response procedures, as well as in-depth training courses and regular technical drills are vital to ensuring staff can respond promptly and effectively.
The National Cybersecurity Incident Response Alliance, established by the National Cybersecurity Centre, gathers government agencies, technology firms, financial institutions, and critical infrastructure providers, aiming to provide information, early warning, and technical support in times of incident.
In a move to strengthen Vietnam’s legal framework, the Ministry of Public Security is proposing to merge the law on cyber information security and the law on cybersecurity into a single cybersecurity law in 2025, which is expected to be submitted to the National Assembly during its 10th session later this year./. VNA
