The Enterprise of Crime: What the UNODC Threat Assessment Means for Every CISO

Cybercrime Is No Longer an Underground Economy

By Eckhart Mehler for CISOsCISO — a perspective on cybersecurity leadership, governance and the decisions that determine whether organizations retain control.

For years, organizations have described cybercriminals as hackers operating in the shadows.

That description is no longer accurate.

The United Nations Office on Drugs and Crime (UNODC) Transnational Organized Crime Threat Assessment – Southeast Asia 2026 paints a far more significant picture. It does not merely describe criminal activity. It documents the emergence of highly organized transnational enterprises that happen to use cyber operations as one of their most profitable business lines.

The distinction matters.

Enterprises defend themselves differently against organized industries than against isolated attackers.

The report shows that cybercrime has evolved into an interconnected ecosystem where identity theft, ransomware, online fraud, cryptocurrency laundering, human trafficking, AI, corruption and financial crime reinforce each other. Each capability strengthens the next.

From a CISO perspective, this changes one fundamental assumption:

We are no longer defending against hackers. We are competing against industrialized criminal organizations.

Cybercrime Has Adopted the Enterprise Operating Model

One of the strongest messages emerging from the report is not technological.

It is organizational.

Modern criminal groups increasingly resemble multinational companies.

Instead of one group performing every activity, they specialize.

One organization develops malware.

Another provides initial access.

Another launders cryptocurrency.

Others specialize in phishing, stolen identities, AI-generated deception, call centers, infrastructure hosting or recruitment.

• Every capability can be purchased.
• Every service can be outsourced.
• Every operation becomes scalable.

The legitimate economy spent decades optimizing specialization and supply chains.

Organized crime simply copied the model.

For defenders, this means attackers no longer require complete expertise.

They only need funding.

Crime Has Become a Service Industry

Cybersecurity professionals have become familiar with concepts such as:

• Ransomware-as-a-Service
• Phishing-as-a-Service
• Malware-as-a-Service

The UN report demonstrates that this model has expanded far beyond technical tooling.

Entire criminal ecosystems now operate through service providers.

Identity providers.

Money laundering providers.

Cryptocurrency exchanges.

Document forgery.

Fake employment.

Social engineering.

Infrastructure hosting.

Human trafficking.

Financial logistics.

Each participant contributes one capability while the ecosystem delivers the complete criminal value chain.

This dramatically lowers the barrier to entry for new threat actors.

The question is no longer:

“Can they develop this capability?”

Instead it becomes:

“Can they purchase it?”

Scam Centers Are Becoming Cyber Enterprises

Public discussion often portrays scam compounds in Myanmar, Cambodia or Laos as large call centers conducting online fraud.

The report suggests something considerably more concerning.

Many of these operations have evolved into integrated cyber enterprises.

They continuously generate:

• new phishing campaigns
• stolen identities
• financial intelligence
• compromised credentials
• fraudulent financial transactions
• AI-assisted deception
• cryptocurrency laundering
• operational intelligence

These are no longer isolated scams.

They are production environments.

The comparison is uncomfortable but useful.

A modern scam center increasingly resembles a software company—except its products are cybercrime.

Identity Is Now the Primary Security Perimeter

One observation appears repeatedly throughout the report:

Identity has become the most valuable commodity.

Credentials.

Personal information.

Government identities.

Corporate accounts.

Financial identities.

Machine identities.

Everything revolves around trusted access.

This reinforces a trend many CISOs have already recognized.

The traditional perimeter is disappearing.

Firewalls remain important.

Networks remain important.

Endpoints remain important.

But identities increasingly determine whether an attacker succeeds.

Identity has become the operational control point of modern cybersecurity.

Organizations still investing primarily in network boundaries while neglecting identity governance are defending yesterday’s architecture.

Artificial Intelligence Will Accelerate Criminal Scale

The report identifies AI as an emerging multiplier for organized crime.

This should surprise nobody.

AI dramatically reduces the cost of producing convincing attacks.

Language barriers disappear.

Localization improves.

Social engineering becomes personalized.

Fraud becomes automated.

Victim selection becomes data-driven.

Campaigns become continuous.

As autonomous AI agents mature, these developments will accelerate further.

The discussion about AI in cybersecurity often focuses on productivity.

The real issue is scale.

AI allows criminal organizations to industrialize persuasion.

Organizations therefore face a strategic choice.

Either security teams adopt AI faster than criminals.

Or they fall permanently behind.

Human Trafficking Has Become a Cybersecurity Issue

Perhaps the most disturbing aspect of the report is one that receives comparatively little attention in cybersecurity discussions.

Many scam compounds rely on human trafficking.

Thousands of individuals are coerced into conducting online fraud.

This changes the nature of social engineering.

These operations gain access to:

• native language skills
• cultural understanding
• regional knowledge
• psychological manipulation
• continuous operational capacity

Social engineering becomes significantly more convincing because humans—not automation alone—remain deeply involved.

Cybersecurity therefore intersects directly with humanitarian issues.

Geography No Longer Limits Criminal Operations

Another important observation concerns geographical expansion.

Pressure from law enforcement has not eliminated criminal organizations.

It has encouraged relocation.

Operations increasingly migrate toward jurisdictions with:

• weaker governance
• limited law enforcement
• corruption
• fragile institutions
• limited international cooperation

From a CISO perspective this creates an important strategic implication.

Country risk is becoming cyber risk.

Organizations operating internationally must evaluate geopolitical exposure alongside traditional cybersecurity assessments.

Third-Party Risk Must Expand Beyond Technology

The report repeatedly illustrates how interconnected criminal ecosystems have become.

Cyber operations interact with:

• financial crime
• logistics
• corruption
• cryptocurrency
• document fraud
• international trade

This should reshape third-party risk management.

Supplier assessments cannot remain focused on technical controls alone.

Organizations increasingly need visibility into:

• ownership structures
• regional exposure
• corruption risks
• financial dependencies
• subcontracting chains
• geopolitical influence

Supply chain security is no longer only about software.

It is about ecosystems.

Governance Is Becoming the Decisive Security Capability

Perhaps the report’s most important lesson is not technical.

It is organizational.

Criminal organizations consistently exploit weak governance.

Weak regulation.

Weak accountability.

Weak coordination.

Weak oversight.

Weak enforcement.

Organizations frequently discuss cybersecurity as a technology challenge.

The report demonstrates something different.

Cybersecurity increasingly succeeds—or fails—because of governance.

The strongest security technology cannot compensate for fragmented accountability.

What the Report Does Not Fully Explore

While the UNODC assessment is exceptionally valuable, several enterprise security topics deserve greater attention.

Critical infrastructure resilience.

Cloud dependency.

Digital sovereignty.

Identity governance.

Operational resilience.

Recovery capabilities.

AI governance.

Machine identities.

Enterprise architecture.

These topics increasingly determine whether organizations retain operational control during major cyber crises.

The discussion therefore needs to evolve beyond cybercrime itself.

The central question becomes:

Can organizations still maintain control when criminal ecosystems become more scalable than corporate security operations?

The New Competition

The cybersecurity industry often speaks about threat actors.

That phrase unintentionally minimizes what has happened.

Threat actors suggest individuals.

The UNODC report describes industries.

• Industries optimize.
• Industries innovate.
• Industries invest.
• Industries scale.

So do criminal ecosystems.

This fundamentally changes the role of today’s CISO.

Our objective is no longer simply protecting systems.

It is preserving organizational control.

• Control over identities.
• Control over trust.
• Control over data.
• Control over suppliers.
• Control over AI.
• Control over recovery.

Because organizations rarely collapse when attackers enter.

They collapse when defenders lose control.

That is the strategic lesson hidden within the UNODC Threat Assessment.

And it extends far beyond Southeast Asia.

Publication Note & Disclaimer
This article reflects my personal professional perspective and does not represent the official policy or position of my employer. Drafting and editorial refinement may have been supported by commercially available AI-assisted tools. The analysis, conclusions and final curation are entirely my own.

For information regarding image credits, copyrights, trademarks and other intellectual property rights, please refer to the Imprint.