As AI advances, security cannot stand still

An F1 driver relies on a pit crew to inspect the car, make adjustments, and get it back on track.

Victor Lim, Chief Growth Officer at SC Cyber, sees a similar role for cybersecurity teams as organisations adopt cloud services, AI and other digital technologies.

Security teams must work quickly and collaboratively, helping organisations understand what needs attention and when they are ready to proceed.

Public agencies must deliver new digital services while protecting sensitive information and keeping existing services running.

Digital transformation must also preserve the reliability of services, protect the information entrusted to government, and sustain public confidence.

As those systems change, agencies need to revisit both their security checks and who is responsible for carrying them out.

“Technology is changing faster, and cyber teams can no longer protect a static environment,” Lim says. “Cloud, APIs, AI and third-party integrations are constantly changing the attack surface.”

To Lim, security specialists should be involved throughout a system’s development and use, working alongside technology, data, privacy, and operational teams.

Security assurance has a shelf life

A successful security assessment offers valuable evidence about a system. Its usefulness, however, depends on how much that system subsequently changes.

“A penetration test tells you what was secure or vulnerable at a particular point in time,” Lim says. “But an organisation can change significantly the next moment and day.”

For an agency, this raises a practical question: does an earlier assessment still provide sufficient assurance after a service gains a new integration, accesses a different dataset or introduces an AI capability?

Lim advocates continuous security validation: checking whether controls and the assumptions behind them remain effective as the environment evolves.

Human-led audits and penetration testing remain essential, while AI augmentation enables continuous validation, combining human expertise with AI-driven efficiency to deliver more comprehensive and ongoing security assurance.

When a system changes, teams need to check whether its existing protections still work and address any weaknesses they find.

“The goal is greater confidence, not simply more testing,” he says.

For agencies, completing a security assessment before launching is only the starting point.

They also need to understand when subsequent changes warrant renewed scrutiny, and who is responsible for acting on the findings.

Govern the whole AI system

AI makes this challenge more complex because its security depends on the data, permissions, and systems surrounding it.

“Organisations need to understand what data AI can access, what permissions it has, which systems it can interact with and what actions it is allowed to take,” Lim says.

For a public agency considering an AI-enabled service, decisions about access and authority help define the boundaries within which the system can operate.

An AI tool that retrieves information presents a different set of questions from one permitted to act on that information. The assessment must therefore consider what the wider service enables, including its integrations and any autonomous actions.

“It is therefore not enough to secure the AI model itself,” Lim says. “Organisations need to secure the entire AI ecosystem from data and identity to integrations, outputs and autonomous actions.”

That requires cybersecurity, privacy, data, and governance considerations to enter the design process together. Leaving them until the final review risks postponing decisions that shape the service itself.

“Good cyber governance creates guardrails, allowing organisations to move faster with confidence,” he says.

For government teams, the value lies in making those boundaries clear early enough to guide development: what information a system may use, what it may do and what assurance is needed before it is deployed.

Close the gaps between teams

Technology is only part of the readiness challenge. Lim identifies organisational structure as a major gap between transformation ambitions and cybersecurity capability in Singapore and the region.

“Technology, cybersecurity, data, privacy and risk teams can no longer operate in silos,” he says.

Giving an AI system access to another dataset, for example, requires input from the teams responsible for security, privacy, and the service itself.

Expanding an AI system’s access to information, for instance, raises questions about technical permissions, appropriate data use, and operational need.

Addressing each question separately can leave teams without a shared understanding of the overall risk.

Lim argues that cybersecurity teams need to collaborate from the beginning, while organisations must adapt their structures and ways of working alongside their technology.

These teams need to work through such decisions together during development.

Security specialists need to understand the service’s purpose, while those responsible for the service need to understand the risks and constraints shaping its design.

“Ultimately, transformation readiness is not just about having the technology,” Lim says. “It is about having the organisational capability to secure and govern that technology at the speed at which the business wants to move.”

Build expertise alongside automation

The workforce must evolve, too. Lim sees AI helping security consultants analyse more information, identify potential weaknesses, and automate repetitive activities.

But faster analysis does not remove the need to decide whether a finding is valid, how serious it is or what to do about it.

“The ability to understand context, think like an attacker, assess business impact and make sound risk decisions cannot simply be delegated to a machine,” he says.

For an agency, assessing a weakness means considering which services could be disrupted and who depends on them. Technical findings need to be understood in relation to the people and operations that depend on the system.

Lim argues that future security teams will need deep technical expertise alongside AI capability, organisational understanding, and collaboration across disciplines.

Upskilling must therefore develop practitioners’ judgement as well as their familiarity with new tools.

SC Cyber will bring these themes to GovWare 2026 through its F1 Pit Stop booth concept, linking offensive security, risk and resilience, assurance and compliance, and cyber workforce development.

The concept brings together the areas Lim sees as closely connected: continuous validating systems, governing their technology and AI use and developing the people who secure them.

For public agencies, the pit crew analogy poses a useful test: as digital services gain new capabilities, can the teams responsible for securing them recognise what has changed and respond in time?