Philippines Cybersecurity Market Size, Share, Growth and Forecast, 2025-2035

Anti-scam rules turn security into a board priority

The Philippines cybersecurity market was valued at USD 249.5 million in 2025 and is projected to increase from USD 284.0 million in 2026 to USD 721.2 million by 2035, registering a CAGR of 10.91% during 2026–2035. Spending comes from banks and e-wallets that must meet new anti-scam rules, IT-BPM and telecom operators that protect client and network data, and government agencies carrying out the national cybersecurity plan. Metro Manila held the largest regional share, 34.9% in 2025, because bank headquarters, regulators and most enterprise security buyers sit in the capital. CALABARZON and Central Luzon is the fastest-growing region at 11.4% a year, as hyperscale data centers in Laguna and Cavite pull security spending beyond the capital. The sharpest commercial change is in authentication, since covered banks and e-wallets had to replace text and email one-time passwords for high-risk transactions by June 2026, which moves budgets toward identity, fraud analytics and managed monitoring.

Where does Philippine security spending go, and who pays for it?

The market counts spending by Philippine organizations on network security, endpoint and extended detection, cloud security and identity and access management, whether bought as licenses, subscriptions or managed services. Buyers include banks, e-wallet operators, IT-BPM firms, telecom carriers, national agencies, hospitals and retailers. Most purchases flow through local partners and telecom groups that bundle vendor platforms with monitoring, integration and incident response.

The estimate excludes consumer antivirus sold to households, physical security systems such as CCTV, and general IT services that carry no security scope. Value is counted at the price the end buyer pays, so global vendors, local distributors, integrators and managed service providers all share in the same sale.

Network tools, in-house systems and banks lead spending

Why do network tools still take the largest share?

Based on solution type, the market is categorized into network security, endpoint and extended detection, cloud security and identity and access management. Network Security led with 35.0% of 2025 value because carriers, banks and agencies still anchor budgets on firewalls and secure gateways, and the Konektadong Pinoy Act, which lapsed into law Aug. 24, 2025, requires data transmission operators to obtain ISO-based or DICT cybersecurity certification within two years of registration. Cloud Security grows fastest at 12.2% a year as workloads move to new capacity, with members of the Data Center Operators of the Philippines running nearly 500 MW in February 2026. Firewall vendors that bundle cloud controls into their platforms keep their share.

How fast are buyers moving security to the cloud?

Based on deployment model, the market is categorized into on-premises, public cloud, private cloud and hybrid cloud. On-Premises deployments led with 37.0% of 2025 value because banks and agencies still run security inside their own server rooms, and Davao City alone proposed in August 2026 to merge 17 to 19 isolated departmental server rooms into one central data center. Public Cloud grows fastest at 12.1% a year as hyperscale supply deepens, since Amazon Web Services is exploring a Philippine cloud region with an investment of up to USD 5 billion over 15 years. Cloud-delivered controls will follow those workloads as tenants move out of in-house rooms.

Which industries carry the heaviest security budgets?

Based on end-use industry, the market is categorized into financial services, IT-BPM and telecommunications, government and public services, and retail, healthcare and digital commerce. Financial Services led with 32.0% of 2025 value because losses are largest there, as BSP-supervised institutions lost P5.82 billion to cyberattacks in 2024, according to figures cited at a Makati Business Club and IBM roundtable in September 2025. Government and Public Services grows fastest at 11.9% a year as the House sponsor of the DICT budget said in September 2025 that lawmakers had raised its 2026 security allocation by P1 billion, with P812 million for the National Security Operations Center. Agency tenders will therefore set the pace for local integrators.

Why are managed retainers gaining on seat licenses?

Based on pricing model, the market is categorized into per-user subscription, per-endpoint subscription, usage-based cloud security and managed-service retainer. Per-User Subscription pricing led with 33.0% of 2025 value because identity and productivity security is sold by the seat, with Microsoft listing Entra ID P1 at USD 7 per user a month in November 2026. Managed-Service Retainer contracts grow fastest at 11.8% a year as buyers outsource monitoring, and Globe Business partnered with Singapore-based Blackpanda in September 2025 to sell IR-1 incident response subscriptions nationwide. Retainers suit firms that employ few or no in-house security analysts.

Seat licenses set entry prices, retainers set big tickets

Philippine buyers pay for security in three ways, by the seat, by the device and by the retainer. Seat prices are set globally in U.S. dollars, so Microsoft’s identity and detection suites list at USD 7 to 12 per user a month, and the peso exchange rate moves local cost more than vendor list changes do. Incident response is the expensive end, since traditional retainers run USD 25,000 to 100,000, which prices out most mid-market firms. Telecom groups and managed providers close that gap by pooling analysts across many clients, which is why bundled subscriptions win small buyers while large banks negotiate enterprise agreements directly.

Payments, regulation and data centers drive spending

Digital payments and anti-scam rules push banks to spend

The move of everyday payments to digital channels widens the attack surface that banks, e-wallets and merchants must defend. Digital transactions made up 57.4% of retail payment volume in 2024, up from 52.8% a year earlier, according to Bangko Sentral ng Pilipinas data reported by BitPinas, so more of the country’s commerce now runs through systems that attackers can reach remotely. Fraud has followed the money, since the Cybercrime Investigation and Coordinating Center logged 18,633 complaints in 2025, with consumer fraud the largest category, GMA News reported in January 2026. Republic Act No. 12010, the Anti-Financial Account Scamming Act signed in July 2024, requires supervised institutions to strengthen fraud prevention and lets them temporarily hold disputed funds. These pressures put fraud tools first in bank budgets as digital payments keep growing.

National plan and privacy rules make security mandatory

Public policy turns security from an optional purchase into a compliance obligation for agencies and regulated firms. Executive Order No. 58, signed April 4, 2024, directs national agencies and government-owned corporations to adopt cybersecurity plans consistent with the National Cybersecurity Plan 2023–2028 and requires the DICT to report progress twice a year. The National Privacy Commission’s Advisory No. 2026-02 of May 2026 requires a full breach report within five days of discovery, Baker McKenzie noted in June 2026. Progress is measurable, as the country rose to Tier 2 with 93.49 points in the ITU Global Cybersecurity Index 2024, up from 77 in 2020 and 1.51 points short of Tier 1, The Manila Times reported. Each requirement creates recurring spending on monitoring, audits and response that does not depend on a single incident.

Download Free Sample

Data centers and IT-BPM growth widen what must be protected

New data center capacity and a larger IT-BPM workforce add systems, identities and client contracts that require protection. IT-BPM export revenues exceeded USD 40 billion in 2025, up 5%, and the IT and Business Process Association of the Philippines projects about 1.97 million workers by the end of 2026, the Philippine Daily Inquirer reported. Foreign clients audit these operations against their own standards, which pushes providers to buy endpoint, identity and monitoring tools. The DICT also targets 1.5 GW of new data center capacity by the end of 2027, the Manila Bulletin reported in February 2026. Amazon Web Services already runs a Manila Local Zone, and Globe signed a multi-year collaboration with AWS on Nov. 6, 2025. Each new campus adds tenants that need cloud and network controls.

A sharp rise in phishing and ransomware raises urgency

Attack volumes are rising faster than most organizations can absorb, which turns security from a budget line into an operating priority. Check Point Software Technologies counted 3,824 phishing websites targeting the Philippines in 2025, up 423% from 731 in 2024, The Philippine Star reported in February 2026, and third-party breach incidents rose from 8 to 29. Ransomware is accelerating, since 31 public claims hit Philippine organizations from January to August 2026, more than the 26 logged across 2024 and 2025 combined, according to the company’s 2026 threat report as covered by the Daily Tribune. Government agencies recorded the highest attack volume, with 72 incidents. Rising incident counts lift spending on detection and response, and they favor suppliers that can offer round-the-clock monitoring.

Passwordless login and telecom services reshape demand

Shift from one-time passwords to biometric and passwordless login

Authentication is shifting away from codes sent by text or email, which scammers intercept easily. Under BSP Circular No. 1213, banks and e-wallets averaging more than P75 million in monthly online transactions had to adopt biometric, behavioral or passwordless methods for high-risk transactions by June 25, 2026. The same rules required covered institutions to upgrade fraud management systems with behavioral anomaly, geolocation and device-change monitoring. In March 2026, the central bank proposed server-side biometric authentication for high-risk transactions and major account changes, BusinessWorld reported. This shift moves budgets toward identity, device intelligence and fraud analytics, where vendors with local integration partners have an edge over those selling from regional offices.

Rise of telecom-led managed detection and response

Telecom groups are emerging as the main channel for security services, because they already own the client relationship and network visibility. ePLDT, the ICT arm of the PLDT Group, was recognized as a Microsoft Solutions Partner for Security in November 2025 and offers threat detection, incident response and remediation on Microsoft tools, InsiderPH reported. Globe Business sells detection and response built on the Secureworks Red Cloak analytics platform, Malaya Business Insight reported. Demand for outsourced monitoring is strong, as a Sophos survey published in September 2025 found that 89% of Philippine organizations experienced cybersecurity burnout, losing an average of 4.2 hours per employee each week. Bundling security with connectivity lowers acquisition cost for carriers, so managed security services should keep gaining share of new contracts.

Download Free Sample

Opening for security operations services in IT-BPM hubs

IT-BPM providers offer an opening for managed security, because their clients demand round-the-clock monitoring that most providers cannot staff alone. Attacks on Philippine BPO firms rose 217% year over year, according to an ASEAN threat report cited by ZigZag Philippines in August 2025. Pressure is broad, since Cisco’s 2025 Cybersecurity Readiness Index found that 54% of Philippine organizations faced cyberattacks in the past year, and ZigZag Philippines launched a managed security operations center service for this demand in August 2025. EY Global Delivery Services launched an AI-powered cybersecurity center in Cebu, the Daily Tribune reported on July 1, 2026, built on CrowdStrike, Zscaler, Tanium and Cyble technologies. Providers that pair local analysts with automation can win domestic contracts and offshore delivery work at once.

Opening for securing AI tools and industrial systems

AI adoption and industrial digitization open a second growth pool beyond classic IT security. The same Cisco index found that 85% of Philippine organizations had an AI-related security incident in the past year, while only 6% reached the mature readiness level, up from 1%. Palo Alto Networks rolled out Prisma AIRS 3.0 and Prisma Browser for Business across ASEAN markets including the Philippines in April 2026, Context.ph reported. Industrial systems are exposed too, as Kaspersky ICS CERT found malicious objects blocked on 19.09% of Philippine industrial control computers in the second quarter of 2025. Vendors that secure AI agents, browsers and plant networks can sell into budgets that barely existed three years ago.

Talent gaps and thin budgets slow wider protection

Can the country close its security talent gap?

The shortage of skilled staff is the main brake on adoption, because tools fail without analysts to run them. Fortinet’s 2024 Cybersecurity Skills Gap report found that 94% of Philippine organizations suffered at least one breach in 2023 and that 77% linked breaches partly to missing skills. A Fortinet-commissioned survey published in June 2025 found fewer than one security expert per 100 employees. Training deals, such as Fortinet’s January 2025 agreement with Manila Central University, help but take years to scale.

Do tight budgets slow mid-market buyers?

Budgets remain thin outside banks and large groups, which limits how much protection most firms can buy. The same Fortinet survey found that security takes about 15% of IT budgets, equal to roughly 1.4% of revenue, among surveyed organizations. Dollar-denominated licenses and incident response fees of up to USD 500 an hour weigh heavily on peso budgets. Mid-market firms therefore delay upgrades or buy single tools, and carrier bundles are the most practical way to widen coverage.

Can public networks keep pace with organized ransomware groups?

Government networks are the most attacked and often the least modernized, which leaves public data exposed. Check Point’s 2026 report counted 15 ransomware groups posting claims against Philippine targets, with Qilin alone behind 29% of cases. Many local governments still run scattered departmental systems, the gap that the Davao City consolidation noted above is meant to close. Shared operations centers and the national public key infrastructure offer agencies the fastest fix.

Could compliance deadlines strain smaller banks and e-wallets?

Regulatory deadlines compress upgrade cycles, which strains institutions with small IT teams. The BSP gave covered institutions until June 2026 to strengthen fraud management systems after anti-scam implementing rules took effect June 25, 2025, and officials kept the deadline firm despite bank requests for extensions, BusinessWorld reported in March 2026. Rural and thrift banks below the P75 million threshold must still assess product risks regularly. Shared platforms and vendor-hosted fraud services offer smaller lenders the fastest route to compliance.

Metro Manila leads while its neighbors grow fastest

Metro Manila leads on regulators, banks and head offices

Metro Manila held a 34.9% share of 2025 value and grows at 10.3% a year. The National Capital Region produced 31.2% of national output in 2024 and grew 5.6%, according to the Philippine Statistics Authority, and it hosts the BSP, the DICT and the head offices of major banks, e-wallets and telecom groups. Most enterprise security contracts are signed here even when systems run elsewhere. Vendors should keep senior sales and incident response teams in the capital, because large banks and agencies buy where regulators sit.

CALABARZON and Central Luzon grow fastest on data center campuses

CALABARZON and Central Luzon held a 29.0% share of 2025 value and grow fastest at 11.4% a year. The two regions produced 14.7% and 11.1% of 2024 output, PSA data show and Central Luzon grew 6.5%. PLDT’s VITRO data center in Santa Rosa, Laguna, inaugurated April 24, 2025, is described as the first AI-ready hyperscale data center in the country, and PLDT plans a 100 MW campus in General Trias, Cavite, from 2026 to 2028. Each campus brings colocation tenants that buy network, cloud and access security.

Download Free Sample

Cebu and Central Visayas build an analyst base

Cebu and Central Visayas held a 19.7% share of 2025 value and grow at 11.1% a year. Central Visayas grew 7.3% in 2024, the fastest pace among the regions in this report, PSA data show. Metro Cebu hosts IT-BPM parks whose clients audit security, and the EY cybersecurity center noted above adds a local pool of analysts. Integrators that place engineers in Cebu can serve domestic buyers and offshore delivery centers without flying teams from Manila.

Davao and Mindanao move through local government budgets

Davao and Mindanao held a 16.4% share of 2025 value and grow at 10.8% a year. Davao Region grew 6.3% in 2024, according to the PSA, which supports spending by banks, retailers and local governments in the south. The Davao City server room consolidation noted above, discussed by the city council on Aug. 25, 2026, will require firewalls, backup and incident response under the Data Privacy Act. Public buyers here move through ordinances and local budgets, so suppliers need patience and local partners.

Download Free Sample

Rules, telecom deals and AI tools mark 2024 to 2026

Biometrics, XDR and cloud access shape buying choices

• Server-side biometrics verify customers on bank servers rather than on the device, which addresses the interception risk that pushed regulators away from text codes.
• Extended detection and response correlates endpoint, email and identity signals in one console, which lets small teams handle alert volumes they could not triage by hand.
• Secure access service edge moves firewall and web filtering into the cloud, which suits hybrid IT-BPM workforces and branch networks spread across the islands.
• AI security controls monitor prompts, agents and data flows in generative AI tools, a need that grows as staff adopt AI without approval.

Global platforms reach buyers through local carriers

Competition in the Philippines cybersecurity market splits between global platform vendors and local telecom service providers. Fortinet and Palo Alto Networks compete hardest for firewall and secure access projects, while Cisco brings networking scale and an integrated security portfolio. Microsoft gains through identity and detection suites bundled with productivity licenses, and TrendAI, the enterprise business of Trend Micro, draws on long ties with the DICT, including training for staff at the 32 security operations centers under the national SOC program. Check Point, Sophos and IBM serve banks, mid-market firms and large enterprises with threat prevention, endpoint and consulting offers. ePLDT and Globe Business resell these platforms with monitoring and connectivity, which gives them the widest reach outside top-tier accounts. Suppliers win on local analyst coverage, response time and compliance support more than on list price.

Who controls supply, and where are the margins thickest?

Philippines cybersecurity supply runs through three layers that each take a different share of the buyer’s spending. Global platform vendors such as Fortinet, Palo Alto Networks, Cisco, Microsoft, Check Point and TrendAI own the technology and capture license margins, while local distributors such as MEC Networks and integrators handle deployment. Telecom groups ePLDT and Globe Business form the third layer, reselling platforms with monitoring and connectivity, and they hold the strongest position with mid-market buyers. Concentration is moderate among platform vendors but highly fragmented among local integrators. Barriers are highest in round-the-clock monitoring, where analyst headcount and certifications decide who can bid, and margins are richest in recurring managed contracts rather than one-off hardware sales.

Which suppliers do Philippine security buyers shortlist?

Regulatory deadlines will steer budgets to 2030

Credence Research’s view is that regulation, more than threat headlines, will decide where Philippines cybersecurity budgets go through 2030. The anti-scam rules forced banks and e-wallets to buy authentication and fraud analytics on a fixed timetable, and similar obligations for agencies and data transmission operators are next. Government and public services spending grows fastest, at 11.9% a year, as the national plan reaches agencies and local governments. Suppliers that combine local analysts, telecom distribution and compliance reporting will capture most new contracts, while vendors selling single products face price pressure.

National output and security budgets anchor the estimate

The Philippines cybersecurity estimate uses 2025 as the base year and forecasts values to 2035. Market values come from the Credence Research model, and segment, pricing-model and regional splits are Credence Research estimates. The size was cross-checked against national output, the share of IT budgets that surveyed firms assign to security, and vendor list prices. Evidence comes from the BSP, the DICT, the Philippine Statistics Authority, ITU, executive orders and laws, company announcements and national press. No interviews or surveys were conducted, and consumer antivirus and physical security are excluded.

Renewals, audits and managed services carry growth

Philippines cybersecurity spending should reach USD 721.2 million by 2035 because the rules adopted from 2024 to 2026 keep generating renewals, audits and upgrades long after their first deadlines. Cloud Security should expand at 12.2% a year as hyperscale campuses in Laguna and Cavite fill and as workloads leave in-house server rooms. Managed retainers will widen coverage among mid-market firms that cannot hire analysts. The main risks are a thin talent pipeline and dollar-priced licenses, although wider training and peso-denominated bundles from carriers could ease both.

What decides whether growth lands low, mid or high?

The range of outcomes turns on enforcement and talent rather than on threat volume, which is rising in every case. A downside path follows if regulators relax deadlines and peso weakness delays dollar-priced renewals. The base case assumes steady enforcement of the anti-scam rules and continued data center construction. An upside path needs the proposed AWS region to proceed, wider agency adoption of the national plan and faster growth in certified analysts, which together would bring mid-market firms into managed contracts sooner.

Note: The depth of individual sections depends on data availability for this market. Volume, capacity, trade and other unit-based metrics are included where applicable.