JFrog has published research on software supply chain security in Singapore, pointing to a gap between formal security policies and the tools used to enforce them.
The Singapore sample covered 174 respondents as part of a wider survey of 1,508 IT professionals across eight countries. The local findings showed strong governance measures on paper, but weaker controls in the areas where developers and security teams manage day-to-day software and AI risks.
Among the stronger indicators, Singapore ranked highest in the survey for network proxy enforcement at 67%. It also recorded the highest rate of scrutiny of AI-generated fixes, with 71% saying they carefully review such changes.
Against that, the study identified several operational weaknesses. Only 25% of organisations said they had adopted secrets detection, close to the global average of 28%. The report described it as the most underused security control in the dataset relative to the volume of threats.
Audit readiness also emerged as a problem. More than half of respondents, 54%, said they need a week or longer to produce compliance proof for each application, despite 95% saying they track application ownership.
Package approval times were another pressure point. The survey found that 59% of developers in Singapore wait a week or longer for approval to use new open-source packages, the slowest rate in Asia-Pacific in the study.
JFrog also highlighted a shadow AI enforcement gap. It found that 18% of organisations in Singapore have policies against unauthorised AI tools but no way to detect violations, the highest policy-only rate in Asia-Pacific.
Read Full Article At Source
