US$7B opportunity, zero competition: Why SEA integrators are sleeping on Manila’s cyber modernisation

On July 25, Defense Secretary Gilberto Teodoro Jr. directed the Armed Forces of the Philippines (AFP) to broaden its Direct Commission Program (DICOM), accelerating the recruitment of cyber, AI, and engineering professionals into officer ranks. Defense spokesman Arsenio Andolong highlighted the logic: the country possesses a surplus of skilled hackers languishing in unemployment, and the state prefers to utilize this talent rather than risking it to cybercrime.

While most reporting focused on this recruitment aspect, the real opportunity remains untouched. Recruiting a handful of officers does not construct or maintain a contemporary military's cyber infrastructure; it is merely a signal of talent atop an integration, training, and maintenance shortage that a single Philippine agency cannot bridge alone, and one that scarcely any Southeast Asian (SEA) integrator has factored into their pipeline yet.

The magnitude of the opportunity DICOM is part of a larger machine: the AFP's Comprehensive Archipelagic Defence Concept and its Horizon 3 modernization phase, which, for 2026, allocates around ₱430 billion (US$7.08 billion) in defense budget, with tens of billions specifically allocated for cyber and command-and-control systems.

Against this budget lies a workforce gap acknowledged by the Department of Information and Communications Technology (DICT) for years: roughly one cybersecurity professional for every 2,000–3,000 citizens, falling short of a mature-economy benchmark near 1-in-200. Other estimates suggest unmet demand of around 180,000 professionals to cover 10% of critical institutions.

When juxtaposing these two figures, the gap becomes evident: a ₱430-billion (US$7.08 billion) modernization program, lacking a domestic technical bench to execute it and virtually no regional integrators prepared to fill this technical bench. This is not a competitive RFP market yet — it resembles a blank canvas. DICT and the Cybercrime Investigation and Coordinating Center (CICC) have a role to play — and why most third-party vendors overlook nearly half the buyers.

Most external vendors treat the AFP as the sole purchaser. Such is not the case. The Philippines has established a division of labor post the Cybercrime Prevention Act (RA 10175) and the establishment of DICT (RA 10844): law enforcement (National Bureau of Investigation, Philippine National Police Anti-Cybercrime Group), intelligence (National Intelligence Coordinating Agency), national defence (Department of National Defence/Air Force/ Marines/ Space Forces), and—nestled in the middle—network protection, split between DICT and its attached agency, the Cybercrime Investigation and Coordinating Center (CICC).

DICT is the policymaker, drafting the National Cybersecurity Plan and managing the National Cybersecurity and Communications Integration Center (NCERT) and the National Security Operations Centre, monitoring government networks and coordinating incident responses. Pending legislation mandates the reporting of incidents impacting critical infrastructure to DICT/CICC—a compliance layer above any AFP-associated system.

CICC acts as the coordination secretariat—yet operates with a thin technical staff. An agency chairing the National Cybercrime Inter-Agency Committee with scant in-house technical expertise is a market waiting to be exploited. The overlap is a friction point competitors have yet to recognize. DICT's leadership has hinted at redirecting reformed hackers into civilian training, language nearly identical to DND's pitch.

Two agencies are quietly pursuing the same narrow talent pool, uncoordinated. The "zero competition" claim is not hyperbole—most firms do not map the correct buyers. Here are eight strategic moves SEA integrators can pursue before this opportunity expires: Systems integration and interoperability layers — integrating legacy AFP communications, newly acquired foreign platforms, and DICT's NCERT/NSOC feeds into one auditable architecture, rather than multiple siloed point solutions.

Managed detection and response services for under-resourced agencies, where CICC's lack of technical prowess presents an opportunity for outsourced Security Operations Center-as-a-service and incident-response contracts aligned with existing reporting requirements. Workforce-scale training and certification pipelines, akin to the University of the Philippines-DICT microcredentials model, producing hundreds of vetted professionals annually—rather than the limited number DICOM commissions.

Sovereign, auditable software builds—co-developed or locally-developed detection, logging, and command-support tools that satisfy data-sovereignty and joint venture ownership regulations that foreign closed-source vendors cannot comply with. Multi-year sustainment contracts—incorporating maintenance and local technical support from the outset, addressing the primary failure mode noted in prior hardware purchases.

Compliance and reporting tooling—dashboards assisting agencies in meeting the forthcoming DICT/CICC critical-infrastructure incident-reporting mandate, a near-certain procurement avenue once the legislation passes. AI-readiness and data-governance consulting—assessing data pipelines to ensure decision-making and flagging guardrails are in place before deploying any AI models, positioning integrators as foundational builders, not merely platform vendors.

Regional threat-intelligence sharing infrastructure—enabling the AFP to participate in allied information-sharing (e.g., under the US–Philippines defense guidelines) while adhering to data-localization rules, a genuinely untapped niche. Firms checking off two or three of these criteria—rather than solely pitching a single flagship platform—will position themselves as viable candidates during procurement cycles that move slower than news cycles.

The reason for this whitespace, and why it will not persist, stems from the AFP's current modernization process, which is segmented and project-by-project rather than unified. Analysts describe this as piecemeal, with few local firms possessing end-to-end integration expertise at this scale. Past cautionary tales like the Jose Rizal-class frigate program highlight the risks of procuring systems without adequate maintenance plans—risks that cyber platforms face even more significantly.