\n
On 19 July 2024, a single faulty software update from the cybersecurity firm CrowdStrike took roughly 8.5 million Windows machines offline worldwide. In Singapore, the fallout reached bank counters and Changi Airport, and it was serious enough that the Ministry of Digital Development and Information<\/u> was later asked in Parliament how the country could avoid leaning so heavily on a small handful of technology providers. Nobody had been hacked. One supplier pushed one bad file, and the disruption rippled straight through everyone who depended on it.<\/p>\n
That is the uncomfortable shape of modern risk, and it is the backdrop to a new Economist Impact report, Resilience by Design: Building Connected Ecosystems for the Age of Disruption<\/u>, supported by Telstra International. The study surveyed more than 1,400 senior executives across seven industries and 11 APAC markets, with comparative benchmarks from the United States, United Kingdom and Germany.<\/p>\n<\/p>\nTable of contents<\/p>\n
<\/default:svg><\/button><\/p>\n\n1. A ranking built on strength, exposed by execution<\/li>\n 2. The leadership problem is not awareness; it is ownership<\/li>\n 3. Why ticking the compliance box is not enough<\/li>\n 4. The weakest link starts at the front door<\/li>\n 5. What \u201cresilience by design\u201d actually means<\/li>\n 6. Training for the day the plan breaks<\/li>\n 7. AI and hybrid work raise the stakes<\/li>\n 8. What closing the gap looks like<\/li>\n<\/ol>\n<\/section>\nThe research scores capability across five pillars using a Digital Resilience Barometer:\u00a0<\/p>\n
\n
\nThe external enabling environment<\/li>\n Technology and infrastructure<\/li>\n Risk management<\/li>\n Leadership<\/li>\n Workforce and cultural agility<\/li>\n<\/ul>\n<\/div>\nSingapore came first overall<\/b>, first in risk management, and first in workforce and cultural agility. It placed second in technology and infrastructure. Then the picture changes. It sat sixth in the external enabling environment and tenth in leadership.<\/p>\nA ranking built on strength, exposed by execution<\/h2>\n\nCharles Ross, Head of Policy and Insights, APAC at Economist Impact.<\/p>\n
Photo: Economist Impact<\/p>\n<\/figcaption><\/figure>\n
Charles Ross, Head of Policy and Insights, APAC at Economist Impact, does not see the top ranking and the patchy results as a contradiction<\/b>. He sees maturity.<\/p>\n
\u201cSingapore scores highly because its foundations, risk management, infrastructure and enterprise capability are strong,\u201d he said. \u201cBut resilience is ultimately tested in execution<\/b>, not design.\u201d What he means here is that an organisation\u2019s resilience is not proven by how good its plans, frameworks or systems look on paper. It is proven when something actually goes wrong, and people have to respond under pressure.<\/p>\n
The data bears that out. Only around 30% of Singapore organisations said their responses to recent disruptions went mostly or exactly to plan. When they fell short, Ross said, the reasons were consistent:\u00a0<\/p>\n
\n
\nGaps in scenario planning\u00a0<\/li>\n Weak coordination across teams.\u00a0<\/li>\n<\/ul>\n<\/div>\nPlans tend to assume neat, linear events, whereas real incidents are dynamic<\/b>, fast-moving and cross-functional.<\/p>\n
\u201cSingapore is ahead in capability, but still subject to the same execution gap,\u201d he said. \u201cResilience is less about having a plan, and more about how organisations adapt when that plan inevitably breaks.\u201d<\/p>\n
The scenario-planning weakness is not a rounding error, either. Singapore sat 14 percentage points above the survey average in citing inadequate scenario planning for when responses to threats do not go as expected. For a market that prides itself on preparedness, being an outlier on that point is worth noting.<\/p>\n
The leadership problem is not awareness; it is ownership<\/h2>\n\nLeaders in Singapore recognise the importance of resilience.<\/p>\n
Photo: Pexels<\/p>\n<\/figcaption><\/figure>\n
Scoring tenth in leadership<\/b> is the result that tends to surprise people, and Ross is clear that it reflects how organisations behave, not how the country is governed.<\/p>\n
\u201cSenior leaders in Singapore clearly recognise the importance of resilience<\/b>, but responsibility tends to sit within a single function<\/b> rather than being shared across the enterprise,\u201d he said. Leadership in resilience, he added, needs active governance and cross-functional alignment, and that is where Singapore looks less mature despite its strong operational base.<\/p>\n
The numbers bear out the facts. 71 percent of Singapore respondents said their boards or executive committees do not regularly review the effectiveness of digital resilience plans. Across APAC, only 28 percent of boards review resilience regularly, and fewer still convert those discussions into action. When ownership concentrates in one function, usually IT, the report notes, digital resilience gets treated as a cybersecurity problem rather than a board-level strategic priority. Forty percent of Singapore organisations cited internal siloes as a key reason their responses fail. Ross\u2019s own framing of why that matters is blunt:<\/p>\n
\u201cDisruption is inherently cross-functional. It affects operations, technology, communications and leadership simultaneously. When resilience is owned by a single function, coordination breaks down.\u201d\u00a0<\/p>\n
Roary Stasko, CEO of Telstra International, recognises the 71 percent figure from his own conversations with business leaders.<\/p>\n
\u201cBroadly, this aligns with what we often see across many markets,\u201d he said. \u201cDigital resilience is recognised as important, and it is discussed at senior levels, but the depth and cadence of review and testing vary significantly by organisation.\u201d\u00a0<\/p>\n
The board conversations that actually move the needle, he said, are the practical ones: decision rights under pressure, clarity of escalation, coordination across teams and partners, and whether scenario exercises reflect the realities of today\u2019s ecosystem dependencies.\u00a0<\/p>\n
Progress, in his experience, comes when board attention shifts towards regular testing that builds preparedness over time.<\/p>\n
Why ticking the compliance box is not enough<\/h2>\n\nRoary Stasko, CEO of Telstra International<\/p>\n
Photo: Telstra<\/p>\n<\/figcaption><\/figure>\n
Both men keep returning to the same fault line where there is a compliance-first mindset<\/b>, built for a slower era of risk. A compliance-first organisation may have the right policies, cyber controls, incident response documents and audit records, but still struggle when a real disruption happens. That is because compliance usually prepares a business for known risks and formal requirements. It does not always prepare teams for messy, fast-moving situations such as supplier outages, cloud failures, cyber incidents, system breakdowns or unclear decision-making under pressure.<\/p>\n
As Ross put it, \u201cCompliance is designed for known risks. It ensures organisations meet standards that have already been defined. Disruption today is shaped by unknown and rapidly evolving threats.\u201d<\/p>\n
Risk frameworks, he noted, remain heavily weighted towards cybersecurity and compliance, while broader exposures such as supplier failure or ecosystem breakdown are addressed less systematically. Compliance can set a baseline. It does not equip an organisation to think on its feet when conditions shift in a way no rulebook anticipated.<\/p>\n
The spending pattern reflects the same instinct. 85 percent of Singapore organisations cited high compliance costs, yet 74 percent lacked full-time digital resilience teams and 60 percent lacked a dedicated budget for resilience initiatives. Ross is careful not to read that as simple overspending on compliance, though.<\/p>\n
\u201cThe picture is more nuanced,\u201d he said. In Singapore, only 35 percent of organisations emphasised compliance, against roughly 91 percent prioritising cybersecurity and about 74 percent focusing on business continuity, with recovery speed trailing at 30 percent.\u00a0<\/p>\n
He added:<\/p>\n
\n
\u201cThe real gap lies elsewhere. Far fewer organisations invest in capabilities such as adaptability or vendor risk management. These are the areas that tend to be deprioritised.\u201d<\/p>\n<\/div>\n
The problem, in other words, is not too much compliance. It is an imbalance, occurring when organisations are well-drilled for known, immediate risks and underprepared for complex, interconnected ones.<\/p>\n
The weakest link starts at the front door<\/h2>\n\nShared accountability needs to be in place across the whole partner ecosystem.<\/p>\n
Photo: Pexels<\/p>\n<\/figcaption><\/figure>\n
For all of Singapore\u2019s strength inside its own systems, confidence collapses the moment operations cross into territory a company does not directly control, which is to say supply chains, cloud providers, and third-party vendors.<\/p>\n
Only 22 percent of Singapore organisations reported genuine, first-hand insight into the digital resilience of their suppliers and partners. Stasko argues that this is not really a technology gap at all, saying:<\/p>\n
\n
\u201cThe tools to monitor, assess and share resilience-related risk already exist. What often determines visibility is whether there is a clear mandate and a structured way to apply those tools across organisational boundaries. Without clear contractual rights, shared standards and agreed escalation mechanisms, organisations get stuck relying on self-reported assurances, which rarely deliver the depth of insight leaders actually want when something is going wrong. So the constraint is usually not a lack of technology, but the structure and accountability across the ecosystem.\u201d<\/p>\n<\/div>\n
Ross describes the same wall from the research side. Gaining real visibility into a partner\u2019s systems runs into commercial sensitivities, regulatory boundaries and technical complexity, so organisations fall back on periodic audits and certifications, \u201cwhich provide only a partial and static view\u201d. In an environment where a fault can cascade across interconnected systems within minutes, he said, that is simply not enough.<\/p>\n
This is where Stasko\u2019s preferred phrase, shared accountability<\/b>, has to mean something concrete. In a mature partner agreement, he said, resilience expectations are explicit, responsibilities are clearly defined, and decision-making and escalation paths are agreed in advance. Partners do not just sign up to service levels; they align on how information will be shared in real time and how recovery will be coordinated across parties. In weaker arrangements, those roles stay vague and go unrehearsed, which slows everyone down at the exact moment speed matters most.<\/p>\n
\u201cShared accountability is ultimately about trust built through design and rehearsal,\u201d he said. In a hub economy, nothing stays local<\/p>\n
Singapore\u2019s exposure is amplified by what makes it valuable in the first place. It is a regional anchor for finance, trade, logistics, cloud platforms and multinational operations, which means a local disruption does not stay local.<\/p>\n
\u201cIn a hub economy, disruptions can create ripple effects across regional supply chains, cross-border operations and shared digital dependencies,\u201d Stasko said. The deciding factor is how well organisations actually understand those dependencies, and how fast they can coordinate a response across partners and markets. The research suggests many firms recognise Singapore\u2019s hub status in principle, but are still mapping and testing the full web of cross-ecosystem dependencies that matter to how they run.<\/p>\n
The physical layer makes the point vivid. Through January and February 2025, a cluster of subsea cable incidents around Taiwan<\/u>, several involving vessels with opaque ownership, put regional connectivity in the headlines and underlined how much of the digital economy rides on a finite number of cables on the seabed. Stasko notes that 2025 was a genuinely tough year for North Asia cable operators<\/u>, including Telstra, with elevated seismic activity, bad weather delaying repair work, and more vessel interactions straining cable operations and recovery efforts. The regional subsea environment does not help: shallow waters, dense shipping corridors, and some of the heaviest cargo and fishing activity in the world.<\/p>\n
What is needed is scale and redundancy. Stasko who used Telstra as an example, said its network was supported by a global footprint of more than 30 cable systems, with at least four separate cable landings in each of Singapore, Hong Kong and Japan. That diversity is the whole point: if one route fails, traffic has somewhere else to go.<\/p>\n
What \u201cresilience by design\u201d actually means<\/h2>\n\nResilience by design means recognising from day one that <\/b>disruption is inevitable.<\/p>\n
Photo: Pexels<\/p>\n<\/figcaption><\/figure>\n
The report\u2019s title of Resilience by Design: Building Connected Ecosystems for the Age of Disruption<\/b>, is a thesis, and Stasko spells it out.<\/p>\n
\u201cResilience by design means recognising from day one that disruption is inevitable<\/b>, and building networks and digital infrastructure to operate through it, not just to recover afterwards,\u201d he said.\u00a0<\/p>\n
In practice, that means deliberately diversifying routes and providers, eliminating single points of failure, embedding automated failover and recovery, and ensuring systems keep running even when parts of the ecosystem are under stress. It also means designing for speed of recovery, because in a complex environment, planning for a single tidy scenario is wishful thinking.<\/p>\n
Telecoms and infrastructure providers sit at a useful vantage point in all this, Stasko argues, because they own the connectivity layer that so many organisations depend on. That position can offer extra visibility and routing options when something breaks elsewhere, letting customers reroute around problems and recover faster rather than discovering a hidden dependency only after it has already failed.<\/p>\n
Training for the day the plan breaks<\/h2>\n\nTraining to build team adaptability is often lacking.<\/p>\n
Photo: Pexels<\/p>\n<\/figcaption><\/figure>\n
If execution is where Singapore stumbles, training is part of the reason. The country is strong on the basics. 82 percent of organisations run upskilling programmes, and 85 percent run organisation-wide digital resilience training. But only 12 percent mandate the kind of training that builds team adaptability during an actual outage.<\/p>\n
Ross has a clear read on why.<\/p>\n
\u201cMost organisations prioritise structured training<\/b>, particularly in cybersecurity, data privacy and compliance, because these are easier to standardise and measure,\u201d he said. Training for live disruption is harder<\/b>. It means simulating uncertainty, pressure and cross-functional decision-making, none of which fits neatly into a module. As a result, he said, just 17% of Singapore organisations mandate capabilities such as adaptability during outages or coordinated crisis response, \u201cyet these are precisely the skills that determine how effectively organisations respond when disruption unfolds in practice\u201d.<\/p>\n
This happens as most organisations are good at delivering formal training that can be packaged into modules, but less prepared to train people for messy, real-world disruption where judgement, coordination and adaptability matter.<\/p>\n
The same overconfidence shows up across the pillars. Organisations are far more assured about the things they control directly<\/b>, internal systems and cybersecurity, than about the external enablers they merely rely on, such as communications networks, power supply and cross-sector collaboration. \u201cOrganisations, in effect, are risk-ready within their own walls, but less prepared for disruptions that cascade across systems, markets and partners,\u201d Ross said. Strong internal performance, he warns, can mask weaker ecosystem coordination.<\/p>\nAI and hybrid work raise the stakes<\/h2>\n\nAI and hybrid work will reshape the resilience equation over the next few years.<\/p>\n
Photo: Pexels<\/p>\n<\/figcaption><\/figure>\n
Two compounding factors sit over all of this. Ross expects AI and hybrid work to reshape the resilience equation over the next 12 to 24 months, and not only for the better.<\/p>\n
\u201cThey increase both capability and complexity,\u201d he said. AI can strengthen resilience through automation and predictive insight, but it introduces fresh dependencies and risks. Agentic AI in particular, he noted, \u201cintroduces a whole new way of managing a firm\u2019s operations, yet the risks and vulnerabilities are still poorly understood\u201d. Hybrid work, meanwhile, stretches the operational footprint, adding more nodes of vulnerability and complicating coordination when something goes wrong.<\/p>\n
Stasko sees the infrastructure consequence. A distributed workforce relies more heavily on networks, identity systems, cloud platforms, and third-party services across many more locations, which calls for governance models that assume distributed access and continuous operations by default, backed by infrastructure that can maintain security, performance, and recovery across every user and site.<\/p>\n
Taken together, both men say, these trends push resilience further away from being a technical issue and towards being an organisational one.<\/p>\n