New Singapore cybersecurity strategy to tap ‘best available’ AI models for cyber defence

He cited the example of an AI agent gaining unauthorised access to non-public data on a government statistics portal in Australia last month.

“There will be more incidents, more attacks. All of us have to shore up our cyber defences and our resilience to recover when attacks happen,” he said.

SINGAPORE’S CYBER DEFENCE MODEL

Mr Shanmugam said Singapore must “act earlier” in the face of threats.

“Traditional cyber defence relies heavily on protecting systems, periodic assessments, and responding when something has gone wrong,” he said.

“But adversaries are continuously looking for vulnerabilities and trying to establish persistent access.”

He said that Singapore’s defence must hence be continuous, and it needs to monitor and hunt for threats and identify weaknesses before attackers do, and remediate them quickly.

Government and industry must also work together to act on a national scale, said Mr Shanmugam.

As last year’s Operation Cyber Guardian showed, a sophisticated attacker does not see government and telcos as separate silos, and looks for weak points across the system, he said.

“Our national defence has to look across the system too,” said Mr Shanmugam.

He added that Singapore had to also “act at the speed of the threat”.

“If AI allows attackers to identify vulnerabilities and conduct attacks more quickly, then the defenders will have to use AI too,” he said.

The government will progressively deploy AI across Singapore’s national cyber defence operations, including within the National Cybersecurity Command Centre (NC3) and the Government Cyber Security Operations Centre, said Mr.

“We will also work with industry and technology partners to speed up the adoption of AI-enabled cyber defence capabilities. This will be done across our critical sectors,” he said.

He added that such capabilities are already being developed across government, with CSA creating AI tools to automate the discovery and mapping of exposed assets and vulnerabilities, and assist cybersecurity specialists in testing complex vulnerabilities in web applications.

GovTech also uses AI agents to accelerate vulnerability discovery and security testing.

In his speech, Mr Shanmugam laid out the role of NC3, CSA’s operations hub for national cyber defence.

He said it will provide a national cyber situational picture of vulnerabilities and threats.

“NC3 supports the continuous monitoring of critical infrastructure systems. It will also allow cyber defenders to put together valuable threat information from government, from CII owners, cybersecurity companies and international partners,” he said.

It will also help detect threat actors earlier, including advanced persistent threats like last year’s UNC3886.

This will be done through proprietary threat detection systems and privileged intelligence, said Mr Shanmugam.

It will also let Singapore mount an effective national response to major cyber threats, similar to Operation Cyber Guardian, through AI-enabled coordination systems.

“This is going to be Singapore’s model of cyber defence,” he said.

The government will also develop a national protective domain name service (PDNS) to reduce Singapore’s exposure to phishing, scams, malware and other cyber threats, said Mr Shanmugam.

When someone tries to connect to an online domain which is known to be malicious, PDNS can stop the connection “before the threat reaches the user”, he said.

INTERNATIONAL COOPERATION

Mr Shanmugam also emphasised the need for international cooperation amid competition in the domain.

“Even with our shift to a more proactive defence, it’s not going to be possible to prevent all attacks. That makes cooperation even more important,” he said.

He said that everyone should be “realistic about the environment we are in”, given the greater “strategic competition, particularly over critical technologies like AI”.

“Countries will act to safeguard their national interests. Singapore will do the same,” he said.

Mr Shanmugam said that cybersecurity is inherently a collective challenge, as threats cross borders.

“Technology and infrastructure are spread across jurisdictions. No country, however capable, can secure the digital domain on its own,” he said.

“There will be competition, but it does not have to displace all cooperation.”

While countries will not agree on everything, it is important they build up “practical cooperation” to exchange information, respond to incidents, tackle common threats and reduce the risk of wider instability, he said.

SICW hence provides a platform for the sector to speak candidly about those differences, and identify areas where practical cooperation remains possible, said Mr Shanmugam.

“We must have these conversations, which at times may be difficult, and we have to have them now, so that we can try and avoid more difficult consequences later,” said Mr Shanmugam.