How Singapore’s defence ministry turns AI experiments into live cyber defences

Earlier this year, the Singapore Armed Forces (SAF) renamed one of its cyber facilities. 

The Cyber Defence Test and Evaluation Centre would become the Cyber Defence Test and Experimentation Centre (CyTEC). 

For the Digital and Intelligence Service (DIS), which sits under the SAF, the one-word change on paper represents a

shift from simply testing artificial intelligence (AI) tools to embedding experimentation into the day-to-day work of its defenders. 

“Experimentation is no longer just a task for the defender, it is now a posture, and we need to equip our people to master this new reality.  

“With AI, we develop, refine, evaluate in our unique environments, and pivot quickly if we need to,” says Singapore’s Commander Defence Cyber Command (DCCOM), BG Clarence Cai, to GovInsider. 

With cyber threat actors increasingly weaponising AI, the DIS is building, trialling, and deploying its own AI-driven defences. 

BG Cai shares more about how AI capabilities at the DIS are moving from sandboxed experiments to tools used in live defence operations, and where his team draws a line where the tech’s role ends and what the human operator does. 

The sandbox and the stress test 

According to BG Cai, CyTEC has since been equipped with technologies, a sandbox and a platform for defenders at MINDEF to develop their AI capabilities, build in-house tools, and speed up the operationalisation of these tools. 

To move from experimentation to operationalisation, "[his team] tests the capability in realistic environments, understand where it works well and where it doesn't, and validate it with operators.” 

Once the value of the tool has been proven consistently, the tool is gradually introduced into “more operationally relevant scenarios.” 

One of these scenarios is through the Critical Infrastructure Defence Exercise (CIDeX) co-organised by the DIS and the Cyber Security Agency of Singapore (CSA). 

CIDeX is a large-scale cyber exercise bringing together public agencies and organisations from all 11 critical infrastructure sectors. 

“The exercises allow us to subject the AI capabilities we develop to tests in the face of the sophisticated cyber-attacks that we simulate from real-world examples. 

“It even gives us the opportunity of understanding what human cyber defenders would do at the exact same time, play by play,” he notes. 

How AI changes cyber defence work 

AI is changing how cyber defenders work, says BG Cai. 

"We're increasingly looking for leaders who can combine cyber expertise with an understanding of AI, and who can exercise good judgement about when to trust the technology and when to challenge it,” he explains. 

But technical fluency with AI isn’t enough on its own, as he emphasises the importance of leadership skills that scale AI-supported operations.  

These skills include the ability to build teams across agency and organisational lines and to communicate effectively to influence practical outcomes, he says. 

On how the DIS builds AI literacy into its pipeline, BG Cai shares that his team leverages the expertise of many national servicemen who are already tech-savvy to develop AI applications responsibly for operational problems. 

The pipeline starts even earlier, with AI skills folded into the Sentinel Programme, which is the DIS’s youth cyber talent programme for secondary and tertiary students. 

As the recruits become more experienced operators, the emphasis of training shifts from building tools to validating AI outputs, understanding its limitations, exercising judgement, and eventually architecting cyber-AI systems and commanding the next-generation Security Operations Centres (SOCs).

What ‘Advanced Persistent Defence’ looks like  

“The threat from Advanced Persistent Threat actors armed with AI means that we must also organise for persistence in our own terrain – we call this Advanced Persistent Defence,” says BG Cai. 

As AI continues to improve, his team recognises the need for defenders to also have a deep understanding of the networks, systems and adversary behaviours of the sector they protect. 

This is why MINDEF recently updated its approach for its servicemen to specialise in a certain critical infrastructure sector for their reservist cycles, as part of Sectoral Cyber Defence Teams. 

Sector specialisation is only half of it, with the other important part being to “connect weak signals across systems and organisations across Singapore, as there is only so much that AI deployed at organisational-level can do." 

BG Cai recognises that cyber domain is a borderless one and the private sector leads in its global cyber networks, expertise and technology, “especially frontier AI models enriched with the most up-to-date cyber threat intelligence,” he says. 

The experimentation centre (CyTEC) and cyber defence exercise (CIDeX) also bring together the industry, academic, and other cyber practitioners to contribute threat intelligence, research, talent, tools, collaborating towards a shared mission. 

AI does the heavy lifting, human makes final call  

“We trust AI with the heavy lifting, but not the final call,” says BG Cai, stressing the importance of human-in-the-loop particularly so for MINDEF which deals with lethal force and protecting Singapore’s critical infrastructure. 

In practice, that means that AI is given autonomy over the tasks that carry low consequences when they go wrong, including analysing data, surfacing insights, recommending options at scale. 

The moment a decision carries operational weight, the human comes back into the loop.  

"Where there are operational consequences, human judgement, accountability, and oversight remain essential," he says.