Singapore updates cybersecurity strategy to ‘act at the speed of the threat’

Singapore has just launched its third Cybersecurity Strategy, which sets out a more proactive approach to national cyber defence. 

“We seek to act earlier, act on national scale, and act at the speed of the threat,” said Senior Minister and Coordinating Minister for National Security, K Shanmugam. 

He was speaking at the opening ceremony of the Singapore International Cyber Week (SICW) on October 13 at the Sands Expo and Convention Centre, Singapore. 

First launched in 2016 and refreshed in 2021, the 2026 strategy places greater emphasis on national-level cyber defence, protecting organisations and individuals beyond critical infrastructure, and preparing for threats related to artificial intelligence (AI) and quantum computing.    

The strategy responds to a more challenging cyber landscape, with advanced persistent threat (APT) actors increasingly targeting critical information infrastructure (CII), AI letting attackers move faster and at greater scale, and quantum computing eventually undermining existing encryption.

A more proactive approach to cyber defence 

Shanmugam warned that sophisticated cyberattacks are becoming more frequent and that Singapore must prepare for persistent attempts to compromise critical infrastructure.

He cited attacks against energy installations in Poland and a major data breach affecting South Korea as examples of the threats facing essential services.  

Singapore has also faced sustained attempts to compromise its telecommunications infrastructure.  

Shanmugam said the government mounted Operation CYBER GUARDIAN in response to a sophisticated cyber campaign involving APT actor, UNC3886.  

Announced in February 2026, the operation brought together more than 100 cyber defenders from government agencies working closely with telecommunications operators.  

It was Singapore’s largest coordinated cyber incident response effort to date.  

The operation demonstrated why cyber defence cannot be confined to individual organisations.  

Attackers look for weaknesses across interconnected systems, rather than treating government agencies and telecommunications companies as separate targets.  

“Government and industry have to work closely together in response,” he said.  

Strengthening national cyber defence capabilities 

Under the new cybersecurity strategy, Singapore would strengthen its national-level capabilities.  

A key part of Singapore’s approach is to enhance the National Cybersecurity Command Centre (NC3), which Shanmugam described as "Cyber Security Agency’s operations hub for cyber defences."

The enhanced NC3 aimed to strengthen five areas of cyber defence, from building a clearer national picture of emerging threats to accelerating incident response. 

First, it would combine threat intelligence from government agencies, critical infrastructure operators, cybersecurity firms, and international partners to provide a more comprehensive view of the threat landscape.  

This helps authorities identify connections between seemingly separate incidents and detect sophisticated campaigns earlier.  

Second, Singapore would introduce a national Protective Domain Name Service (PDNS) to block access to known malicious domains associated with phishing, malware and other cyber threats.  

The service operates under the Online Criminal Harms Act, with assessment and validation measures to reduce false positives. Users would also be able to appeal or request a review of blocking decisions.  

Third, the government planned to strengthen attack surface management for CII owners, helping them identify internet-facing systems, assess vulnerabilities, and prioritise flaws that are new, severe, or actively exploited by attackers.  

Fourth, selected CII owners would receive stronger threat detection capabilities through privileged threat intelligence and proprietary systems developed by the Centre for Strategic Infocomm Technologies (CSIT), integrated with the NC3.  

Finally, authorities would use AI-enabled systems to track incidents, assess ongoing operations and plan next steps, supporting faster and better-coordinated responses to major cyber incidents. 

AI brings new opportunities and risks  

Shanmugam highlighted that AI was tilting the balance toward cyber attackers by increasing the speed, scale, and sophistication of attacks.  

“AI-enabled cyber threats are really not a matter of if but when,” he said, adding that Singapore would adopt AI in a safe and secure manner. 

According to him, the CSA has developed AI tools to automate discovery and mapping of exposed assets and vulnerabilities, supporting human specialists in testing complex vulnerabilities in web applications.  

Government Technology Agency of Singapore (GovTech Singapore) also uses AI agents to accelerate vulnerability discovery and security testing.  

Rather than developing a separate AI model for every application, Shanmugam said: "We will invest in AI harness engineering, which will give us the flexibility to choose between AI models, and to securely integrate the best available ones with the tools." 

Cybersecurity requires collective action  

During her welcoming remarks, CSA's Chief Executive, Gwenda Fong, said that Singapore’s interconnected economy makes collaboration essential to effective cyber defence.

“No single party has complete visibility of the entire threat landscape,” said Fong. 

Government agencies, infrastructure operators, cloud providers, and cybersecurity companies each hold different parts of the picture.  

Sophisticated campaigns could span multiple systems and networks over extended periods, meaning an isolated incident might be part of a wider operation. 

Fong emphasised that organisations must be able to combine information and expertise quickly enough to act before attackers achieve their objectives. 

“For us, cooperation must go beyond agreeing on principles. It must translate into the ability to work together when it matters,” she noted.  

SICW served as a platform for turning this cooperation into practical action, she highlighted. 

Activities happening at the SICW included a joint exercise by CSA and Google using an agentic AI cyber scenario for international partners, a Frontier AI Governance Workshop with the AI Safety Hub for officials across ASEAN and the wider Asia-Pacific, and a hands-on training by Cloudflare to help CII operators strengthen their AI-enabled cyber defence capabilities.  

Singapore also planned to continue to promote international dialogue and practical collaboration despite growing geopolitical competition in areas such as AI, semiconductors and telecommunications, she concluded.