Springboard Philippines at DICT CyberCon 2026

The Philippines cannot build a resilient digital economy through security software alone. It also needs people who can configure, maintain, monitor, and defend the systems on which businesses and public services depend.

That was the central argument of Jake Ervin Jonathan C. Go, Managing Partner of Springboard Philippines, invited by the Department of Information and Communications Technology (DICT) to speak at Philippine CyberCon 2026 on 20 October at Sheraton Manila Bay in Manila.

Go joined Panel Discussion 3, “Future-Proofing the Cyber Workforce,” presenting an industry perspective on practical training, evolving skills, and operational readiness. His presentation emphasized a simple principle: “Tools scale. People decide.”

Held 20–22 October 2026 for Cybersecurity Awareness Month, the conference carried the official theme “CYBER BALANGAYAN: FORGING A RESILIENT NATION THROUGH COOPERATION, CAPABILITY, AND COLLECTIVE DEFENSE.” DICT organized the program around three pillars: Cooperation (policy dialogue and cross-sector partnerships), Capability (technical discussions and workforce development), and Collective Defense (incident response, resilience, and information sharing).

For conference background, see the DICT official website.

The conference highlighted the importance of collaboration among government, industry, academia, and international partners in strengthening the country’s cybersecurity resilience. Among the key officials present was DICT Secretary Robert Joseph Montes de Claro, who was appointed in October 2026 after serving as President and CEO of the Social Security System (SSS). Other notable attendees included DICT Undersecretaries Rodil Aniban, Leandro Angelo Aguirre, and Christian Mark Guingcangco; Representative Brian Poe Llamanzares of the FPJ Panday Bayanihan Party-list; and Undersecretary Facundo O. Palafox IV of the Office of the Executive Secretary.

Go highlighted the International Telecommunication Union’s (ITU) Global Cybersecurity Index 2024, in which the Philippines scored 93.49 out of 100, placing it in Tier 2 (“Advancing”). This was below several Southeast Asian countries, including Singapore (99.86), Malaysia (98.82), Thailand (99.22), Vietnam (99.74), and Indonesia (100). The index assesses national cybersecurity commitments across five pillars rather than the security of individual organizations.

The Philippines’ capacity-development score increased from 12.74 out of 20 in 2020 to 17.17 out of 20 in 2024, while its cooperation score decreased from 19.41 out of 20 to 17.70 out of 20 over the same period. Although the scores reflect changes in the country’s assessed cybersecurity commitments, strengthening workforce capabilities and cross-sector collaboration remains important. Employers can support these efforts through practical apprenticeships, skills-based hiring, continuous training, university-industry partnerships, and employee retention strategies.

Learn more from the ITU Global Cybersecurity Index.

A small business may not have a security operations center, but it still depends on email, digital payments, customer records, websites, and cloud applications. Account compromise, phishing, ransomware, or a vulnerable web application can interrupt operations and harm customer trust.

Lessons from prominent cyber incidents

• PhilHealth (2023): the Medusa ransomware incident demonstrated the sensitivity of healthcare information and the operational consequences of compromised systems.
• COMELEC (2016): the “Comeleak” incident illustrated the consequences of poor protection of personal data and public-facing systems.
• Bangladesh Bank heist (2016): fraudulent SWIFT instructions and money flows through the Philippines demonstrated how financial crime crosses borders.
• Hong Kong deepfake fraud (2024): an impersonation scam reportedly led to a multimillion-dollar transfer, illustrating why payment verification must not depend on appearances alone.

These examples differ in mechanism and impact; website defacement, confirmed data theft, ransomware, and financial fraud should not be conflated.

PHP and Node.js underpin many business websites, applications, and APIs. Both can be used securely, but outdated runtimes, unmaintained packages, insecure code, and misconfigured hosting create avoidable exposure. Organizations should monitor official security advisories, inventory their versions and dependencies, patch according to risk, and verify remediation.

A visible version number is not always conclusive evidence of patch status: some managed providers backport security fixes. Request vendor advisory references, installed package evidence, and vulnerability test results. Likewise, upgrading a Node.js runtime does not automatically fix vulnerable application dependencies.

Official security references: Node.js security releases and PHP supported versions.

• Enable multifactor authentication, prioritizing phishing-resistant methods where available.
• Use a password manager and unique passwords for all business-critical accounts.
• Maintain tested backups, including one protected or offline copy.
• Patch operating systems, website software, runtimes, plugins, and dependencies.
• Limit administrative privileges and promptly remove former employee access.
• Train staff to recognize phishing, invoice fraud, and impersonation.
• Create a one-page incident response contact and escalation procedure.
• Start with a risk assessment of revenue-critical systems before buying expensive tools.

Cybersecurity basics and employee awareness can often be implemented with limited incremental spending. The important first step is assigning ownership and confirming that the controls work.

Go proposed a continuous pipeline: learn foundational security skills; practice through controlled labs, capture-the-flag exercises, and drills; discover through applied research; serve through supervised operational projects; and teach by mentoring the next cohort. This approach helps connect education to actual enterprise technology stacks.

A practical 90-day plan for employers

• Rewrite entry-level security job descriptions around demonstrated competencies.
• Map current team skills against a role framework and identify priority gaps.
• Create supervised, paid apprenticeship opportunities where feasible.
• Run one incident-response tabletop exercise involving IT, legal, operations, and communications.
• Partner with a school on a real-world capstone or technical lab.
• Support appropriate professional certifications and registration programs.

Singapore provides a model for coordinated governance and professional development, while neighboring ASEAN economies demonstrate the value of sustained national cybersecurity commitments. The Philippines should strengthen applied research, university-industry partnerships, workforce retention, and practical incident readiness—not simply chase a higher index ranking.

Springboard connects technology delivery and talent solutions. Depending on a client’s needs and agreed scope, its teams can support cybersecurity readiness assessments, vulnerability remediation planning, managed IT and infrastructure support, security operations and managed detection partnerships, cybersecurity staffing, secure software development, cloud and systems integration, and AI governance considerations.

Businesses may begin with a narrowly scoped security baseline and expand to recurring managed services as risk and operational complexity grow. Specific certifications, monitoring hours, and security outcomes should be confirmed in a written statement of work.

Explore Springboard Philippines technology and staffing solutions and Springboard insights.

Go also outlined ambitions to work with De La Salle University and other educational and industry partners on internships, hackathons, capture-the-flag events, research, mentorship, and potential support for technology founders. These are Springboard and Go’s proposed directions—not announced DICT programs or contractual commitments.

Cyber resilience requires more than buying tools. It requires an organization that understands its risks, a workforce prepared to respond, and partners who can support secure operations as technology evolves.

If your organization needs a cybersecurity readiness review, managed IT support, secure application maintenance, or specialist technology talent, contact Springboard to discuss an appropriately scoped engagement.

Get started: Contact Springboard Philippines

Primary materials: DICT invitation dated 12 October 2026; Jake Go’s 22-slide “Future-Proofing the Cyber Workforce” presentation dated 20 October 2026. External benchmarks: ITU Global Cybersecurity Index 2024; official PHP and Node.js security resources.

International Telecommunication Union. (2021). Global Cybersecurity Index 2020 (4th ed.). https://www.itu.int/dms_pub/itu-d/opb/str/D-STR-GCI.01-2021-PDF-E.pdf

International Telecommunication Union. (2024). Global Cybersecurity Index 2024 (5th ed.). https://www.itu.int/en/ITU-D/Cybersecurity/Documents/GCIv5/2401416_1b_Global-Cybersecurity-Index-E.pdf