Singapore businesses & digital resilience

Why ticking the compliance box is not enough

Both men keep returning to the same fault line where there is a compliance-first mindset, built for a slower era of risk. A compliance-first organisation may have the right policies, cyber controls, incident response documents and audit records, but still struggle when a real disruption happens. That is because compliance usually prepares a business for known risks and formal requirements. It does not always prepare teams for messy, fast-moving situations such as supplier outages, cloud failures, cyber incidents, system breakdowns or unclear decision-making under pressure.

As Ross put it, “Compliance is designed for known risks. It ensures organisations meet standards that have already been defined. Disruption today is shaped by unknown and rapidly evolving threats.”

Risk frameworks, he noted, remain heavily weighted towards cybersecurity and compliance, while broader exposures such as supplier failure or ecosystem breakdown are addressed less systematically. Compliance can set a baseline. It does not equip an organisation to think on its feet when conditions shift in a way no rulebook anticipated.

The spending pattern reflects the same instinct. 85 percent of Singapore organisations cited high compliance costs, yet 74 percent lacked full-time digital resilience teams and 60 percent lacked a dedicated budget for resilience initiatives. Ross is careful not to read that as simple overspending on compliance, though.

“The picture is more nuanced,” he said. In Singapore, only 35 percent of organisations emphasised compliance, against roughly 91 percent prioritising cybersecurity and about 74 percent focusing on business continuity, with recovery speed trailing at 30 percent. 

He added:

The problem, in other words, is not too much compliance. It is an imbalance, occurring when organisations are well-drilled for known, immediate risks and underprepared for complex, interconnected ones.

The weakest link starts at the front door

For all of Singapore’s strength inside its own systems, confidence collapses the moment operations cross into territory a company does not directly control, which is to say supply chains, cloud providers, and third-party vendors.

Only 22 percent of Singapore organisations reported genuine, first-hand insight into the digital resilience of their suppliers and partners. Stasko argues that this is not really a technology gap at all, saying:

Ross describes the same wall from the research side. Gaining real visibility into a partner’s systems runs into commercial sensitivities, regulatory boundaries and technical complexity, so organisations fall back on periodic audits and certifications, “which provide only a partial and static view”. In an environment where a fault can cascade across interconnected systems within minutes, he said, that is simply not enough.

This is where Stasko’s preferred phrase, shared accountability, has to mean something concrete. In a mature partner agreement, he said, resilience expectations are explicit, responsibilities are clearly defined, and decision-making and escalation paths are agreed in advance. Partners do not just sign up to service levels; they align on how information will be shared in real time and how recovery will be coordinated across parties. In weaker arrangements, those roles stay vague and go unrehearsed, which slows everyone down at the exact moment speed matters most.

“Shared accountability is ultimately about trust built through design and rehearsal,” he said. In a hub economy, nothing stays local

Singapore’s exposure is amplified by what makes it valuable in the first place. It is a regional anchor for finance, trade, logistics, cloud platforms and multinational operations, which means a local disruption does not stay local.

“In a hub economy, disruptions can create ripple effects across regional supply chains, cross-border operations and shared digital dependencies,” Stasko said. The deciding factor is how well organisations actually understand those dependencies, and how fast they can coordinate a response across partners and markets. The research suggests many firms recognise Singapore’s hub status in principle, but are still mapping and testing the full web of cross-ecosystem dependencies that matter to how they run.

The physical layer makes the point vivid. Through January and February 2025, a cluster of subsea cable incidents around Taiwan, several involving vessels with opaque ownership, put regional connectivity in the headlines and underlined how much of the digital economy rides on a finite number of cables on the seabed. Stasko notes that 2025 was a genuinely tough year for North Asia cable operators, including Telstra, with elevated seismic activity, bad weather delaying repair work, and more vessel interactions straining cable operations and recovery efforts. The regional subsea environment does not help: shallow waters, dense shipping corridors, and some of the heaviest cargo and fishing activity in the world.

What is needed is scale and redundancy. Stasko who used Telstra as an example, said its network was supported by a global footprint of more than 30 cable systems, with at least four separate cable landings in each of Singapore, Hong Kong and Japan. That diversity is the whole point: if one route fails, traffic has somewhere else to go.

What “resilience by design” actually means

The report’s title of Resilience by Design: Building Connected Ecosystems for the Age of Disruption, is a thesis, and Stasko spells it out.

“Resilience by design means recognising from day one that disruption is inevitable, and building networks and digital infrastructure to operate through it, not just to recover afterwards,” he said. 

In practice, that means deliberately diversifying routes and providers, eliminating single points of failure, embedding automated failover and recovery, and ensuring systems keep running even when parts of the ecosystem are under stress. It also means designing for speed of recovery, because in a complex environment, planning for a single tidy scenario is wishful thinking.

Telecoms and infrastructure providers sit at a useful vantage point in all this, Stasko argues, because they own the connectivity layer that so many organisations depend on. That position can offer extra visibility and routing options when something breaks elsewhere, letting customers reroute around problems and recover faster rather than discovering a hidden dependency only after it has already failed.

Training for the day the plan breaks

If execution is where Singapore stumbles, training is part of the reason. The country is strong on the basics. 82 percent of organisations run upskilling programmes, and 85 percent run organisation-wide digital resilience training. But only 12 percent mandate the kind of training that builds team adaptability during an actual outage.

Ross has a clear read on why.

“Most organisations prioritise structured training, particularly in cybersecurity, data privacy and compliance, because these are easier to standardise and measure,” he said. Training for live disruption is harder. It means simulating uncertainty, pressure and cross-functional decision-making, none of which fits neatly into a module. As a result, he said, just 17% of Singapore organisations mandate capabilities such as adaptability during outages or coordinated crisis response, “yet these are precisely the skills that determine how effectively organisations respond when disruption unfolds in practice”.

This happens as most organisations are good at delivering formal training that can be packaged into modules, but less prepared to train people for messy, real-world disruption where judgement, coordination and adaptability matter.

The same overconfidence shows up across the pillars. Organisations are far more assured about the things they control directly, internal systems and cybersecurity, than about the external enablers they merely rely on, such as communications networks, power supply and cross-sector collaboration. “Organisations, in effect, are risk-ready within their own walls, but less prepared for disruptions that cascade across systems, markets and partners,” Ross said. Strong internal performance, he warns, can mask weaker ecosystem coordination.

AI and hybrid work raise the stakes

Two compounding factors sit over all of this. Ross expects AI and hybrid work to reshape the resilience equation over the next 12 to 24 months, and not only for the better.

“They increase both capability and complexity,” he said. AI can strengthen resilience through automation and predictive insight, but it introduces fresh dependencies and risks. Agentic AI in particular, he noted, “introduces a whole new way of managing a firm’s operations, yet the risks and vulnerabilities are still poorly understood”. Hybrid work, meanwhile, stretches the operational footprint, adding more nodes of vulnerability and complicating coordination when something goes wrong.

Stasko sees the infrastructure consequence. A distributed workforce relies more heavily on networks, identity systems, cloud platforms, and third-party services across many more locations, which calls for governance models that assume distributed access and continuous operations by default, backed by infrastructure that can maintain security, performance, and recovery across every user and site.

Taken together, both men say, these trends push resilience further away from being a technical issue and towards being an organisational one.

What closing the gap looks like

So what does a Singapore organisation that’s actually closed the strategy-execution gap look like? Ross and Stasko agree on the shape of it.

It assumes disruption will happen and designs operations to hold up under pressure, not just on a good day. It runs realistic scenarios across teams, systems, and partners often enough to see how decisions, dependencies, and escalation paths actually behave. Accountability sits at the executive level and shows up in budgets, operating cadence, and performance measures, not in a policy nobody opens twice. And it spends on recovery, not only prevention, so critical services come back fast when part of the ecosystem buckles.

Ross’s advice to a board chair who’s just finished the report is blunt: 

“Resilience is not a technology problem,” he said. “It is a leadership discipline. Without strong governance and shared accountability, even the most advanced capabilities will fall short when disruption hits.”

Singapore’s strong showing in the report isn’t a sign the job is done. It’s a reminder that good foundations only carry you so far. The country has solid digital capability, mature risk management, and a stable operating environment, but disruption doesn’t respect neat plans, company boundaries, or reporting lines. Singapore ranks highly overall, yet leadership accountability and ecosystem coordination are still the weaker spots, and only 30 percent of organisations say recent responses went mostly or exactly to plan.

That’s where the next phase has to start. Businesses need to stop treating resilience as an IT, cybersecurity, or compliance exercise and instead bake it into how they run day-to-day. Clearer board oversight, shared C-suite accountability, more realistic scenario testing, and tighter work with suppliers, cloud providers, and connectivity partners. As the attached interviews point out, resilience depends on how well organisations coordinate under pressure, not how much tech they’ve bought.

For Singapore, the stakes are higher because of its role as a regional hub for finance, trade, logistics, cloud, and cross-border connectivity. A disruption here rarely stays contained to one company or one market. The more connected the economy gets, the more resilience has to be designed across partners, networks, and borders from the start. The real test isn’t whether organisations can prevent every disruption. It’s whether they can keep moving, decide quickly, and recover together when things go wrong.