How can critical infrastructure be secured in the age of AI?

Artificial intelligence (AI) is changing the game for both attackers and defenders in one main way: speed.

Attackers are now putting AI to work at a speed and volume that human-paced security operations were not built to match.

“Most of the things we do are at human speed, and we need to change them to be able to move at machine speed,” says Elastic’s Chief Information Security Officer, Mandy Andress.

Even an automated reactive programme falls short, she adds, so organisations need to shift from reactive to more proactive mechanisms to ensure incidents are mitigated even before they occur and recover quickly when they do happen.

Singtel Singapore’s Chief Customer Officer, Keith Leong, echoes the need to match the speed of emerging threats: “Attackers are moving so fast, so we have to defend at machine speed too.”

For Singtel, this means harnessing AI and agentic capabilities to accelerate detection, investigation and response, while keeping human judgement and oversight at the centre of security operations.

Singapore’s digital maturity is both a strength and a weakness. With sectors that are tightly interconnected, an incident could easily have a cascading effect.

Singtel sits at the centre of that web as a connectivity provider. It runs the networks that sectors like transport, healthcare, and utilities depend on, making it a critical infrastructure.

Leong notes that this shapes how the company approaches defence: an attack on one operator can impact the rest, so protection must involve the whole ecosystem and partners within it.

At the sidelines of GovWare 2026, part of Singapore’s International Cybersecurity Week, Andress and Leong explain why defending critical infrastructure means moving faster, treating zero trust as a journey, and rethinking how humans and AI agents can work together.

Zero trust as a journey

Both executives agree that the principle of “never trust, always verify” must remain at the centre of cybersecurity efforts.

“Zero trust is a journey,” says Leong, noting that Singtel, like many organisations, has legacy systems that cannot be replaced overnight.

Where these systems cannot support zero trust, they can be isolated and protected with additional controls, while zero trust principles are progressively introduced around them.

Andress notes that many zero trust programmes struggle because organisations treat it as a compliance outcome rather than a direction of travel.

“It’s not ‘I am or I am not’; it is a journey,” she says.

Chasing 100 per cent readiness turns a security programme into a measure of completion rather than effectiveness, and the target keeps moving, she adds. Instead, she suggests measuring how effective the controls are and how well the programme adapts.

For that reason, Andress recommends starting with the highest-risk applications and accounts, then working through lower-risk areas over time.

Neither executive favours a change like a “big bang”.

“Zero trust is not a technology refresh. Trust is given, then continuously verified,” says Leong.

Identity and trust in the age of agents

Andress highlights identity and access management as a priority for securing AI agents.

“As a security practitioner, we've acknowledged for a long time that we have not done identity and access management well, even from a human perspective,” she says.

Copying these processes onto AI agents would therefore multiply the problem of granting too much access, allowing agents to do more than intended, and getting little visibility. It would also widen the potential blast radius, Andress explains.

For agents, identity and access should be designed from the outset rather than copied over from human controls, she says, adding that trust should not be conflated between people and machines because each may require different processes.

Getting this right for agents could, in turn, improve how human access is managed later, she adds.

Organisations also need to define how AI agents and employees will work together, so that both have a clear place in how the organisation operates.

Addressing fragmentation

Fragmentation has always been a struggle in security programmes, according to Andress.

Security teams have long had to choose between niche tools and platforms, and between building capabilities in-house and buying them, she explains.

When security operations are fragmented, detection, investigation, and response capabilities are all spread across disconnected tools and teams, which makes responding to one incident narrative less efficient.

Andress says to expect more tool sprawl before less, however, as new AI-driven threats spawn niche tools that will be absorbed into platforms eventually.

“Think of the antivirus, for example. It is now folded into the operating system,” she adds.

Protecting critical infrastructure requires coordination across an ecosystem of interconnected systems, operators and partners. Clearer regulatory mandates and trusted information-sharing mechanisms can help reduce fragmentation and enable a more coordinated response.

But integration, or “unfragmenting”, does not mean ripping out existing infrastructure, particularly when essential services must remain operational during an incident, says Leong.

Instead, the goal is to connect existing capabilities and coordinate response across the ecosystem, using automation and AI to move at machine speed while retaining human oversight, and without compromising the continuity of essential services.

The next horizon

Which organisations are ready for present and upcoming AI-driven changes will be determined by mindset, says Andress.

Those that think AI is a passing phase are likely to fall behind compared to teams driven by curiosity and continuous learning on the technology.

“The ones who realise it's a change that's here to stay, and those that are excited and energised by learning new things are the ones that are ahead of the curve right now,” she says.

For Leong, the next challenge is already on the horizon. Advances in quantum computing could fundamentally reshape the cyber threat landscape, potentially putting widely used encryption methods at risk.

Preparing for that future requires organisations to think beyond defending against today’s threats and start engineering resilience for those still to come.

Singtel is already taking steps in that direction, combining post-quantum cryptography with quantum key distribution to strengthen the protection of its most critical “crown jewels” — its applications and data.

“Resilience must be designed in from the start, not offered as a plug-in,” he says. 

Ultimately, the next horizon will be shaped by how organisations face this challenge as an opportunity.

“It’s a challenging but exciting time to be in security right now. The answer is not ‘this is how we’ve always done it’, we have to continue challenging ourselves and asking how we can do it better,” says Andress.