\n<\/p>\n
Singapore\u2019s CII sectors are governed by the Cybersecurity Act, which imposes higher security standards and mandatory incident reporting obligations.<\/span><\/p>\n But experts warn that while these companies may be tightly regulated, the ecosystem around them may not be.<\/span><\/p>\n CII operators rely on vendors \u2013 which include SMEs \u2013 for logistics, software development, engineering and professional services.<\/span><\/p>\n Yet,\u00a0many of these smaller firms are not directly regulated under the Act.<\/span><\/p>\n In a highly connected digital ecosystem, weaker cybersecurity at smaller vendors can provide threat actors with a foothold that may lead to larger, more strategically important organisations, experts say.<\/span><\/p>\n \u201cIt is a massive weakness,\u201d said Mr Nicky Choo, vice president and general manager for Asia-Pacific at cybersecurity provider Mimecast.<\/span><\/p>\n \u201cEvery organisation that does business with every large organisation that’s part of the critical infrastructure is a target for attack. So, a lot of cyber attackers now go after the weakest link, which is the easier way in,\u201d he added.<\/span><\/p>\n According to the CSA\u2019s Singapore Cyber Landscape 2024\/2025 report, ransomware cases rose by 21 per cent in 2024, with 159 incidents recorded.<\/span><\/p>\n Manufacturing and professional services were among the most affected, with the majority of the attacks in the professional services industry targeted at SMEs.<\/span><\/p>\n Mr Gaurav Keerthi, CEO of cybersecurity firm Strongkeep, said SME incidents may be more common than official numbers suggest.<\/span><\/p>\n \u201cIt\u2019s a lot of voluntary declaration if there is an incident \u2026 But generally, we think there’s a massive under-reporting of cases in the SME space.\u201d<\/span><\/p>\n He added that attackers are increasingly drawn to smaller firms.<\/span><\/p>\n \u201c(They\u2019re) easier to attack. It’s gotten more lucrative to get some money out of these smaller companies, and many of them have become more digital in the last few years.\u201d<\/span><\/p>\n With over 350,000 SMEs operating in Singapore as of 2024, the sheer volume of smaller firms provides attackers with many potential entry points.<\/span><\/p>\n