The people driving cybersecurity adoption in Hong Kong finance

Security technology reaches a bank through procurement, partners and someone willing to make the case internally. Fung runs that machine for Fortinet across Hong Kong and Mongolia, with responsibility for operations, go-to-market strategy and long-term growth.

He came to it after more than two decades across cybersecurity, cloud services, software and IT infrastructure, including leadership roles at Oracle Systems and Hewlett Packard Enterprise, and holds a business administration degree from the Chinese University of Hong Kong. He has also taken part in the city's industry conversation, speaking at the Cybersecurity Symposium in 2025 and at Fortinet's Accelerate programme.

Johnstone has spent two decades getting Hong Kong's security community into the same room. He chairs the organising committee of the city's Cyber Security Summit and chaired its predecessor, the Information Security Summit, two decades earlier, working alongside the Productivity Council and more than a dozen regional security organisations.

The authority behind that convening is unusual. He served as vice-convenor of the ISO working group responsible for the ISO 27001 family and co-edited ISO/IEC 27102 on cyber-insurance in 2019, then implemented those standards himself as chief information security officer at PCCW in telecoms, at the Hospital Authority in healthcare and as chief security officer at AXA in insurance. His position on cyber-insurance is a practical one: a policy cannot address every impact of an incident, and only works alongside a functioning security management system.

Li founded eWalker in 2005 and has spent 20 years testing the defences of institutions that rarely discuss it publicly. The firm has delivered more than 150 security risk assessments and penetration tests for Hong Kong government departments, financial institutions and multinationals, including banks and the Securities and Futures Commission.

The work extends past testing into digital forensics, compliance audit and fraud investigation, with eWalker acting as an authorised dealer for forensics tools used by law enforcement. Li came to it from two decades in enterprise technology, including managing consultant at HP Consulting with responsibility for the financial services sector. He has also served the profession directly, sitting on the Hong Kong Computer Society council across two terms and serving as vice president for member services. His stated aim for the firm is to give clients peace of mind in a world where most transactions are now digital.

Backup used to be an IT chore. Ransomware made it a board conversation, and Ngan sells into that shift, running commercial and public-sector customers across Hong Kong and Macau after close to a decade at Veeam.

Her results look like operational change rather than product sales. Chun Wo Development Group's hybrid cloud and Kubernetes modernisation cut migration time from days to minutes and restored a critical ERP system within four hours. At Veeam's Solution Day in 2023 she presented on the company's security approach and its use of AI and machine learning, taking a technical capability and turning it into something a finance director will fund.

Payment systems only work if people trust them, which makes security the product rather than a feature of it. Ng joined EX.IO as head of security in August 2025 and is now identified as its chief information security officer, specialising in cybersecurity and payment systems after more than 17 years in technology and innovation.

He came from engineering rather than policy, as a principal engineer at Fujifilm Business Innovation Hong Kong, where he spoke publicly on how established technology companies and startups can work together. That experience now extends beyond his employer. Hong Kong Cyberport, wholly owned by the HKSAR Government, lists him on its entrepreneurship vetting team, where he helps assess which technology companies get backed. He holds a doctorate from City University of Hong Kong and is a chartered engineer.

Replacing infrastructure a bank has relied on for decades is the hardest sale in enterprise technology. Transwarp's data platform now serves more than 100 bank customers, including Bank of China, which selected it to migrate Oracle workloads.

Sun founded the company in 2013 after about a decade at Intel, latterly as Asia-Pacific chief technology officer for its datacentre software division, and was part of the team that released the first enterprise Apache Hadoop in China in 2011. Transwarp listed on Shanghai's STAR Market in 2022 and on the Hong Kong Stock Exchange this year, valued at roughly US$1.9bn. For a regulated institution the security question is structural: data that lives inside a platform is defended by that platform's controls, so choosing one is never only a technical decision.

He investigated the attacks first. Wong spent more than a decade in the Hong Kong Police Force, including technology crime investigations, the Cyber Security Centre and three years as an information security officer, before moving to corporate risk as group head of cyber security and technology risk at New World Development.

In April 2025 he founded Syber Couture, which sells local knowledge rather than global scale. The firm advises critical infrastructure operators facing Hong Kong's new regulatory requirements, on the argument that a local company moves faster with an adviser who knows the ordinance, the regulator and the threat picture here. His reason for building it in the city is personal: he was born and raised here, and would rather use his skills for it. On AI he is unsentimental, calling it no magic solution, because an attacker needs to succeed once while a defender must succeed every time.

Xu works on the threats that global security tools struggle to see. She joined TianJi Partners in 2018 as director of global business, leading digital risk protection across phishing, fake websites, rogue apps and impersonation, with particular depth in Chinese-language platforms. In January 2026 she became chief executive of Mandarin Tech.

Her argument is against full automation. Findings are reviewed by native-speaking analysts rather than left to detection software, because false positives waste the attention adoption requires. The company reports resolving over 90 per cent of phishing incidents within 24 hours. She has carried the case to Hong Kong's professional audience, speaking at Revive Tech Asia on anti-phishing and fraud and on ISACA Hong Kong panels in 2025 and 2026 on resilience, governance and third-party risk.

Ye treats compliance as something technology should carry rather than something people should endure. She co-founded RigSec in 2018 to provide regulatory-compliant self-custody for exchanges, custodians, payment providers and digital banks, and it now operates across Hong Kong, Singapore, Taiwan and Japan.

The results are licences. RigSec's clients have secured authorisation from Japan's Financial Services Agency, a Major Payment Institution licence from the Monetary Authority of Singapore and Indonesia's National Digital Asset Depository licence, while the firm has supported applications for the SFC's virtual asset trading platform licence in Hong Kong. PANews named it Best Tool of the Year in 2024. Ye signed a memorandum with Alibaba Cloud at its Hong Kong summit in 2023 to build regulatory technology for local platforms, and she has said since launch the goal was to make compliance less burdensome through technology.

Buyers need a way to compare suppliers. Zhang built one. After a career in enterprise security sales at IBM, Imperva and F5, he founded Z-ONE in 2017 as a market research operation and accelerator for China's cybersecurity industry, publishing vendor analysis and a business maturity rating method.

From Hong Kong he has worked to open new markets for Chinese security technology across Europe, Central Asia, the Middle East and Southeast Asia, arguing that a single perspective on cyber risk is no longer adequate and that defence requires diversity of technology. He convenes as much as he analyses, moderating panels on the Critical Infrastructures Ordinance and on governance for financial institutions. In 2026 he founded THE COI to document Hong Kong's cybersecurity history before the people who built it stop being available to ask.