Resolution 22: Building digital security posture to protect Vietnam from emerging threats

As data becomes a strategic resource, AI is increasingly integrated into society and more economic and social activities move online, security risks are no longer confined to traditional domains. Cyberattacks, data theft, system encryption, AI-enabled impersonation and online fraud can emerge and spread at high speed.

These are no longer merely anticipated risks. According to the Vietnam Cybersecurity Association’s 2025 Cybersecurity Research and Survey Report, information systems in Vietnam faced around 552,000 cyberattacks in 2025. Although the figure was 19.38% lower than in 2024, the proportion of agencies and businesses reporting damage from cyberattacks increased to 52.3%, from 46.15% the previous year.

The figures point to a requirement that goes beyond improving incident response: more importantly, risks need to be detected and contained before they develop into incidents.

This is also the approach set out in the Politburo’s Resolution No. 22-NQ/TW, dated July 28, 2026, on the National Security Strategy. The resolution calls for renewed thinking, methods and measures to protect national security, with risks to be proactively identified, forecast and managed from an early stage and throughout the development process. It also establishes the principle that “security must go hand in hand with development.”

Security threats evolve with technology

At a training conference for key officials nationwide following the eighth National Congress of the Vietnam Veterans Association on August 3, Lieutenant General Pham The Tung, Deputy Minister of Public Security, said rapid advances in science and technology, particularly dual-use technologies, AI, quantum technology and biotechnology, were changing governance methods and becoming an important component of countries’ overall strength.

Alongside opportunities for development, emerging technologies are also creating or intensifying non-traditional security risks. According to Deputy Minister Tung, cybersecurity, transnational crime, water security, food security, environmental pollution, climate change, natural disasters and epidemics are becoming increasingly complex in nature, scale and impact.

New domains, including cyberspace, low-altitude space, outer space, underground space, the seas and oceans, are also becoming areas that require proactive protection.

Cyberspace illustrates most clearly how the nature and speed of security threats are changing. Attacks can target critical infrastructure, steal data, encrypt systems or exploit personal information to carry out fraud. At the same time, AI is providing additional tools for both defence and attack.

The 2025 cybersecurity report shows that attack methods are increasingly being combined, with distributed denial-of-service attacks, targeted cyber espionage, data theft and ransomware among the prominent threats. In a survey of more than 5,300 agencies and organisations, 47.72% reported a shortage of cybersecurity personnel, while 27.8% had yet to implement internal cybersecurity standards.

The challenge therefore lies not only in increasingly sophisticated attack technologies, but also in ensuring that defensive capabilities keep pace with technological development.

This is why the principle of protecting the country “from early on and from afar” needs to be translated from a guiding approach into a standing capacity for prevention.

“Security must go hand in hand with development”

A notable aspect of Resolution 22 is its approach of integrating security protection into the development process, rather than focusing only on dealing with risks after they emerge.

The resolution calls for national security in the new era to extend to protecting the elements that make up the country’s development capacity and ensuring the stable operation of economic, social and technological systems. It also calls for risks to be proactively identified, forecast and managed from an early stage and throughout the development process.

Under this approach, cybersecurity is not simply about protecting servers or blocking an attack. The scope of protection must also cover digital infrastructure, data, essential information systems, digital sovereignty and technological self-reliance.

The Academy of Security Technology and Industry also notes that the new approach is expanding the concept of protection from safeguarding individual devices and systems to ensuring the continuity of essential systems, the security of digital infrastructure, the reliability of information, data control and technological self-reliance.

This also means incorporating security into the design, development and operation of digital systems from the outset, rather than treating it as an additional layer of protection after a technology has already been deployed.

Turning early prevention into a standing capability

According to Major General Nguyen Van Sau, deputy director of the Vietnam Defence Strategy and History Institute, the rapid development of digital transformation and AI is creating new forms of security risk. Data has become a strategic resource, cyberspace a domain of competition, and AI can be used both to strengthen defence capabilities and to facilitate attacks, impersonation and information manipulation.

He said national security protection must “stay one step ahead”, rather than allowing technology to develop first and responding only after risks emerge. Critical digital systems, databases and AI platforms should be developed according to the principle of “security and safety by design”, with capabilities for detection, early warning, incident response and recovery.

From the perspective of preventive capacity, Maj. Gen. Sau identified three priorities.

First is strengthening technological and data self-reliance. Critical data, digital infrastructure and essential information systems need to be strictly protected, alongside the development of core technologies and domestic AI capabilities in strategic areas.

Second is developing risk-based AI governance. As AI is deployed in areas with major impacts, such as finance, energy, infrastructure and national defence and security, requirements for testing, safety assessment and clear accountability among relevant parties become increasingly important.

Third is building a multi-layered digital defence capability, linking and sharing data among agencies, strengthening monitoring and early-warning systems, and improving the capacity to detect and respond quickly to cyberattacks, AI-enabled impersonation and information manipulation.

Maj. Gen. Sau said this process could be translated into the following sequence: “Early identification – accurate forecasting – timely warning – root-cause prevention – rapid response – effective recovery.” This represents an important shift from responding to incidents to managing risks before they develop into crises.

Building a multi-stakeholder digital security posture

From protecting infrastructure, data and technology to strengthening early warning, response and recovery capabilities, a “digital security posture” cannot be built by specialised forces alone.

Resolution 22 identifies national security protection as a key and regular task of the entire Party, people and armed forces, with the People’s Public Security Forces playing the core role. The resolution also calls for stronger national self-reliance and resilience, linking security assurance with development.

According to Maj. Gen. Sau, this requires coordinated participation by the State, specialised forces, technology businesses and the public. Businesses need to strengthen the protection of their systems and data; people need skills to identify fake news, deepfakes and new forms of online fraud; and management agencies need to improve coordination, data sharing and early-warning capabilities.

“The core is to build an ‘all-people digital security posture’, in which the State plays a facilitating role, specialised forces serve as the core, technology businesses are an important force, and every citizen is a stakeholder in protecting security,” he said.

From this perspective, protecting the country “from early on and from afar” does not simply mean detecting an attack before it occurs. More importantly, it means building the capacity to identify and mitigate risks as digital technologies, data and a digital society develop.

This is also how the principle that “security must go hand in hand with development” can be translated into practice under Resolution 22: ensuring that every advance in digital transformation, AI and emerging technologies is accompanied by stronger self-reliance, resilience and national security protection capabilities.

Party and State leader attends All People's Day for National Security Protection

VOV.VN - Party General Secretary and State President To Lam on July 15 attended the 2026 All People's Day for National Security Protection with residents from ethnic minority groups in Long Luong village of Van Ho commune, the northern mountainous province of Son La.