Human oversight is key to AI security, says Indonesia's BSSN

Artificial intelligence (AI) is fast becoming embedded in every sector from public services to defence, but the key question is organisations are prepared to manage the risks it brings. 

Sulistyo, Deputy for Government Cybersecurity at Indonesia's National Cyber and Crypto Agency (BSSN), said humans remain central role to managing these AI-related risks.  

According to him, strong governance, human oversight and ability to detect and handle cyber incidents would be important as AI adoption moves faster and outpaces organisational readiness.  

He was speaking during the opening address at the National Cyber Security Connect (NCC) 2026 event in Jakarta on October 28.  

He noted that today's AI landscape is very different from the “AI winter” of the 1970s and 1990s when AI development largely stalled and few investors were willing to back the technology.  

That has changed dramatically today. What Sulistyo calls an "AI tsunami" is now sweeping the world, driven by a flood of new AI models developed by global technology companies. 

This has also increased cybersecurity risks for government systems.  

In October 2026, a ransomware attack, accelerated by AI allegedly, in Japan targeted at least 53 companies, potentially exposing more than six million customer records.  

In the US, an AI-assisted intelligence system mistakenly identified cargo aboard a Chinese vessel as components related to nuclear weapons, nearly triggering a military operation.  

Meanwhile in Australia, an AI agent breached the Medicare portal operated by Services Australia in June 2026, accessing its credentials and reaching other government systems.  

"These incidents demonstrate that the ability to harness AI cannot be separated from the ability to secure it," Sulistyo added.  

BSSN strengthens government cyber teams' readiness 

At event, BSSN launched a technical guidance programme on Cyber Incident Technical Preparedness for the central government’s Cyber Incident Response Teams (CSIRTs).

The programme involves 35 central government agencies and aims to improve their technical preparedness and capabilities in responding to various cybersecurity threats.  

In addition to strengthening participants' understanding of attack patterns, the programme equips them with skills in using analytical tools and applying digital investigation techniques.  

These capabilities are needed to examine incidents, identify indicators of attacks, and support response efforts based on the teams' analytical findings. 

Human oversight remains key  

BSSN currently promotes AI adoption through two principles: Securing AI and using AI to secure.

Securing AI means ensuring that the technology itself is safe through data protection, system integrity, access restrictions, and accountability.

Using AI to secure, meanwhile, refers to using AI to strengthen cyber defences, including helping to identify system vulnerabilities.  

Human oversight remains essential to both approaches.  

He outlined three levels of oversight: human in the loop, where humans approve AI outputs; human on the loop, where humans continuously monitor the system and retain their ability to stop it; and human in command, where humans determine the objectives and boundaries of AI use. 

Stronger oversight must be put in place for more autonomous AI systems, he said. 

To strengthen governance, BSSN has adopted the NIST SP 800-61 framework (which is used in the US to handle computer security incidents). 

The framework sets out steps covering risk identification, protection, detection, response, recovery, and continuous improvement.  

Indonesia has also put in place the BSSN Regulation No. 1 of 2024 on Cyber Incident Management and BSSN Regulation No. 2 of 2024, providing frameworks for incident response and managing their escalation into crises.  

Without cybersecurity, the creative economy stalls  

The Ministry of Creative Economy's Deputy for Digital Creativity and Technology, Muhammad Neil El Himam, highlighted cybersecurity as a foundation for business continuity and innovation 

In his keynote address, Himam said that AI development and digital transformation present significant opportunities for Indonesia's creative economy to grow. 

However, increased economic activity in the digital space also brings greater risks of data breaches, identity theft, copyright infringement, and technology misuse.  

"Cybersecurity is not merely a technical issue, but a foundation of trust that determines the sustainability and competitiveness of Indonesia's creative economy," he said.  

Himam outlined three priorities for strengthening digital trust.  

First, security and data protection must be embedded in the innovation process from the outset through security by design and privacy by design principles.  

Instead of an obstacle, security should be seen as an enabler of innovation.

Second, the protection of creative works and intellectual property must be strengthened amid the AI developments.  

The technology must be used safely, ethically, transparently, and responsibly.  

Third, digital security capabilities must be strengthened among startups, creative micro, small, and medium-sized enterprises (MSMEs), application developers, and independent creators.  

This requires greater digital literacy, mentoring, talent development, and access to affordable security solutions.  

"Creativity drives innovation, while security builds the trust that paves the way for sustainable growth in the creative economy," said Himam. 

Both Himam and Sulistyo emphasised that building cyber resilience is a multistakeholder approachmultistakeholder approach, involving the government, industry, academia, communities, and the media. 

Each has a role to play in identifying vulnerabilities, reporting incidents, and ensuring that information shared with the public has been verified.