Estonia Cyber Defense Started In a ‘Kindergarten Classroom’ Key takeaways from Estonia’s digital minister at SICW 2026

Conversations about national cybersecurity tend to conjure up images of expensive defense systems, massive budgets, and security agencies working behind the scenes. Liisa-Ly Pakosta, Estonia’s Minister of Justice and Digital Affairs, started somewhere far less technical: with trust.

At Singapore International Cyber Week (SICW) 2026, held under the theme “Cyber at a Crossroads: Shaping the New Cyber Order,” Pakosta delivered a keynote speech before joining a fireside chat with Gwenda Fong, Chief Executive of the Cyber Security Agency of Singapore (CSA) and Singapore’s Commissioner of Cybersecurity. The conversation began from a challenge both countries share: as small, highly digitalized nations, they need cyberspace to remain “open, secure, and trusted.”

That common ground surfaced early in the keynote. Pakosta noted that Estonia, like Singapore, ranks among the most digitalized countries in the world, and compared the origins of Estonia’s digital state to the way Singapore solved its water problem. Both, according to the minister, grew out of an urgent need to engineer a solution that was “great, but cheap and extremely effective.” Pakosta even suggested that Singaporeans might think of Estonia every time they turn on a tap.

A Country With No Money Had to Build Its State on Trust

Estonia’s urgent problem arose in the 1990s, after the country regained its independence from Soviet occupation. It had almost no money, yet it wanted to build an effective democratic system of governance as quickly as possible.

According to Pakosta, the engineering behind Estonia’s digital state rests on three principles, all of which lead back to trust. The first is cybersecurity. The second is full transparency, which is why many public services are built on open-source software, including the country’s online voting system. Pakosta described e-voting as perhaps the most scrutinized and most targeted system in the world, yet because most of its code is open, Estonia and its partners have found vulnerabilities well before malicious actors could.

The third principle is close cooperation with the private sector. In Pakosta’s view, innovation comes from companies, since bureaucrats are good at many things but rarely at innovating. By taking on that risk and letting in the brightest ideas, the Estonian government has digitized almost all of its public services. The one exception the minister cited was divorce. (Couples can now file for divorce online, but they still need to meet an official in person once, according to e-Estonia.)

With databases this tightly connected, the state can deliver services before citizens even ask for them. Since 2014, Estonia has offered life event-based services. When a child is born, for example, families who have given prior consent automatically receive everything they need, from a family doctor and child benefits to the child’s documents. Pakosta stressed that this works only because people own their data and trust the government enough to share it, which in turn demands an extremely high level of cybersecurity.

The 2007 Lesson: Trust Must Be Protected Together

A state whose data is entirely digital, interoperable, and high-quality also becomes a high-value target. Pakosta said that in 2007, Estonia became the first country ever to be hit by a cyberattack from another state, an attack the minister attributed to Russia. At the time, Estonia could still respond by switching off the internet, an option that no longer exists today.

Estonia already had strict cybersecurity rules before 2007, but after the attack, every rule became mandatory and cooperation with companies grew much tighter. The reasoning was simple: when every system is interconnected, it matters little whether a breach happens on the corporate side or the government side, because the damage falls on the same shared trust.

That cooperation extends beyond companies. Pakosta explained that Estonia can also call on a large number of volunteers when a serious situation arises. The volunteer network is well organized, and every member undergoes a background check. This support has become even more important, as Estonia has seen a dramatic rise in cyberattacks since the full-scale escalation of the conflict in Ukraine.

Arrows and Shields: When AI Agents Lead the Attack

Even so, Pakosta acknowledged that 100% cybersecurity does not exist. Throughout history, the minister noted, whenever someone invented an arrow, someone else invented a shield. Governments therefore have to keep adapting under what Pakosta called a “new arrow, new shield” policy.

The newest arrow came up when Fong asked which development had most changed the minister’s thinking about cybersecurity. Pakosta pointed to the moment it became clear that AI agents could lead cyberattacks on their own, comparing the feeling to seeing artillery for the first time after a lifetime of arrows and shields. The leap in scope and speed is so great that the old approach, in which humans gather to work out the best response, is no longer fast enough.

As a result, Estonia has shifted from a reaction model to a continuous monitoring model, because there is no longer any time to prepare a response. Defense has effectively become AI versus AI, with humans still moderating. At the same time, the government has centralized much of its organization to keep pace. Pakosta shared these changes in response to an audience question about how the country’s election system is coping with attackers who use agentic AI.

On another front, Pakosta sees the fundamental task as unchanged: protecting sensitive data, documents, and interoperability. The difference now is that interoperability is extending beyond national borders. The minister hopes to enter Singapore soon with a digital passport stored in a digital wallet rather than a paper one, a change Pakosta believes is “not days, but hours” away and one that will require an entirely new level of cybersecurity.

Cyber Literacy Starts in Kindergarten

Because the challenge is not purely technological, Pakosta emphasized that cybersecurity also has cultural, political, and diplomatic dimensions. On organizational and societal change, the minister drew on experience as a parent of five: children who do not make their beds do not get pocket money. Estonia applies the same logic to cybersecurity, with very concrete rules that everyone is expected to follow.

The bigger shift, however, has happened at the societal level. Estonia teaches digital skills and cybersecurity starting in kindergarten, and the effect reaches far beyond the classroom, because children go home and share what they have learned with their grandparents. As a result, society as a whole has developed a solid understanding of something as invisible as cybersecurity.

The government also offers free cybersecurity and AI training to everyone. Pakosta gave the example of an elderly woman in a remote village who can take both courses at the local library, since the librarians there have already been trained.

Citizens Shouldn’t Have to Know Whether a Service Comes From the State or a Company

From education, the conversation turned to public-private partnership. Fong observed that governments are ultimately accountable for national security, yet much of the digital infrastructure is owned and operated by private companies. Has the balance between the two been struck correctly?

Pakosta replied that the goal of a fully digital society like Estonia’s is for people to barely notice that a government exists, because services simply reach them. The flip side is that people often cannot tell whether a service came from the public or the private sector. The government must therefore work with companies to maintain trust, which matters to both sides well beyond technology or data breaches.

This partnership must be backed by thorough risk assessments that are continually renewed as new risks emerge. Pakosta explained that Estonia defines digital sovereignty in terms of risk rather than geography, which sets it apart from many other countries. The guiding principle, in the minister’s words, is “risk assessment, risk assessment, risk assessment, ongoing risk assessment and no vendor lock.”

A Voice for Small States as Big Tech Grows More Powerful

Looking further ahead, Fong raised threats that may only fully emerge years from now, such as quantum computing, which could break the encryption in use today. Pakosta answered that the one thing humankind can do is make rules. Pointing to nuclear energy, the minister noted that it took from August 1945 until 1970 for the world to regulate it. This time, the world must move much faster, with global rules for both AI and social media.

Here, the similarities between the two countries came into focus again. Pakosta said Estonia and Singapore share the same position on social media: rather than banning it for children, both want platforms to change so that they become safer for everyone, keeping the good and removing the bad.

Fong’s final question went straight to the heart of both countries’ situation. As small, highly digitalized states operating in quite different geopolitical environments, how can they work with industry to secure a meaningful voice in decisions that shape their digital security, especially as big tech grows more influential?

Pakosta said global law and order matters most, along with regulation that prevents the digital divide from widening. Possible solutions include open source, the inclusion of smaller languages and cultures, and greater transparency. In the minister’s view, the growing digital divide is an even worse scenario than cyberattacks led by AI agents. Those attacks can be handled, but a widening divide, both between individuals and between countries, would be a far bigger problem.

Trust Is Hard to Build and Easy to Spoil

Throughout the keynote, the answer Pakosta kept returning to was cooperation among like-minded partners. When a cyberattack hits one place, there is likely spillover somewhere else. Learning from one another is not easy, because it requires openly sharing what happened, which is rarely pleasant. Yet, the minister argued, it is the only way to stay protected. Bad actors may sometimes be more innovative, but whenever good actors unite their ideas, skills, and knowledge, they prove stronger.

Pakosta pointed to Estonia’s cooperation with Singapore as an example, describing the two highly digitalized countries as like-minded partners that support and learn from each other, a relationship that has meant a great deal to Estonia in practice. Fong, in turn, closed the conversation by noting that the future of cybersecurity will be shaped not only by technological advances but also by the choices made today about whether and how to work together.

Pakosta ended on trust itself: hard to build, easy to spoil, and never just a technical issue. It extends to how societies teach their children, support their elderly, make sure no one is left behind, and rebuild confidence after a breach.

For small nations like Estonia and Singapore, the strongest cyber defense may not be technology at all, but the trust that everyone helps protect.

References: Keynote and fireside chat “Liisa-Ly Pakosta x Gwenda Fong,” Singapore International Cyber Week (SICW) 2026; e-Estonia