Let AI Take Over the Task but Not ‘The Learning’ Singapore's Minister Said Juniors still Need Room to Learn from Mistakes.

AI can answer a cybersecurity question in seconds, but judging whether that answer is right still takes someone who understands the work deeply. And if AI absorbs all the entry-level work, a harder question follows: where will the next generation gain the experience to become that kind of expert?

That question ran through the Workforce Development Panel, "Supercharging the Cyber Workforce: AI, Skills, and Accreditation," at Singapore International Cyber Week (SICW) 2026. The session opened with an address by Tan Kiat How, Singapore's Senior Minister of State, who used the occasion to announce that Singapore will establish a Cybersecurity Professional Accreditation Framework. Lightning talks from industry leaders followed, and the session closed with a panel of UK representatives who shared lessons from the path their country began walking years ago.

Although the speakers came from different corners of the field, they agreed on one point. AI does not make cyber professionals less important. If anything, it raises the bar for what it means to be a professional, and the field now needs a system that can show who has actually cleared that bar.

AI Answers Fast, but Who Can Tell if the Answer Is Right?

Tan Kiat How began with a workforce study by the Cyber Security Agency of Singapore (CSA). Eight in ten respondents said their organizations were already using AI-enabled cyber defense tools, while seven in ten rated human judgment and problem-solving skills as essential to using AI effectively.

These figures suggest that AI is not diminishing the role of people but reshaping it. As AI takes on more tasks, cyber professionals will increasingly need to direct these tools, interpret their outputs, validate their conclusions, and make the decisions that follow. Tan Kiat How noted that AI fluency will become part of cybersecurity competence, but stressed that it "is not the same as cybersecurity expertise." AI can generate an answer quickly, yet knowing whether it is the right answer still requires deep professional knowledge.

A separate CSA study, which surveyed around 1,000 cybersecurity and HR professionals, pointed in the same direction. According to Wong Choon Bong, Director of CSA's Workforce and Strategic Partnership Division, more than three-quarters of the cybersecurity professionals surveyed see AI as more of a career opportunity than a threat. Many, however, also worry that some of their skills may become less relevant. In the AI era, Wong Choon Bong concluded, the profession needs to "do more, not less."

Automate the Task, Not the Learning

While encouraging organizations to embrace AI, Tan Kiat How cautioned that they should think carefully about what they automate. He borrowed a distinction that he and his colleagues in medicine often draw between two kinds of friction. Meaningless friction, such as administrative work, is worth streamlining. Meaningful friction, on the other hand, is how people learn by doing. The principle to follow, he said, is to "automate the task, not the learning."

This matters because decisions in cybersecurity often carry real consequences for organizations and the people they serve, and the ability to make the right call comes partly from trial and error. Tan Kiat How therefore asked a pointed question: if automation absorbs both the task and the learning, how will junior professionals make mistakes in a safe environment and learn from them?

Dr. Ning Wang, CEO of Offensive Security (OffSec), echoed this concern. Leaders, she said, must keep enough junior positions open, because no one can become a senior expert without first going through the journey of a junior, making mistakes and working through the struggles along the way. Wong Choon Bong added that the efficiency organizations gain from AI today should not come at the expense of the human expertise they will need tomorrow.

Cyber Analysts Are Shifting From Doing the Work to Orchestrating It

As AI moves into every stage of security operations, the human role is shifting with it. Dr. Lim Woo Lip, Chief Technology Officer for Cyber at ST Engineering, explained that analysts once did nearly everything by hand, from monitoring systems and reviewing alerts to investigating incidents. Today, they work alongside AI that processes information and accelerates investigations, while humans supervise the outputs and make the final decisions. In the future, the role may evolve into an "AI-augmented security orchestrator," someone who coordinates AI-supported operations, validates findings, and helps shape security strategy.

That shift calls for skills well beyond cybersecurity knowledge. According to Dr. Lim, professionals need to understand where AI performs well and where it may fail, know how to secure and govern AI, and think critically enough to challenge its outputs, because "speed is not equal to accuracy." They must also connect cyber risk to business impact and keep learning as both AI and threats evolve. Employers, for their part, need to redesign roles to decide where AI can help and where human accountability must remain, reskill their workforce, and set clear guardrails for AI use.

Dr. Ning added another layer. Professionals, she argued, should focus on outcomes rather than output, since no amount of activity matters if it fails to solve the problem at hand. And the more AI can do, the more fundamentals matter, because without a real grasp of the subject, no one can judge whether AI got it right.

Singapore Will Define What a "Good" Cyber Professional Looks Like

If the work is changing, the profession must change with it. Professionals need clarity on which capabilities to develop, employers need to understand what good looks like, and training providers need to know what the industry will need next. To that end, Tan Kiat How outlined two major steps. First, CSA will work with the Infocomm Media Development Authority (IMDA) and Singapore's skills and workforce development agency to develop a National Competency Framework for Cybersecurity, which will set competency standards for cybersecurity roles, including the use of AI.

The second step is the accreditation framework itself, which will validate and recognize the knowledge, skills, and experience of cyber professionals. Wong Choon Bong explained that candidates will be assessed on a combination of demonstrated technical competencies, relevant professional experience, qualifications and industry certifications, and professional ethics. This allows experienced professionals to prove their capabilities through practical skills and a professional track record, not just the certifications they have collected. Accreditation committees made up of leading experts from different specializations will help develop the criteria and take part in assessments, because professional standards must reflect real-world practice rather than be set by the government alone.

Singapore plans to take a measured approach. The Cybersecurity Professional Office, established in collaboration with the Association of Information Security Professionals (AiSP), will work with the cybersecurity community to develop the details, with a voluntary pilot targeted for the second quarter of 2027 in selected specializations and participating organizations. "We are not trying to create another layer of certificates," Tan Kiat How emphasized. The goal is a framework that gives employers greater confidence, gives professionals greater recognition, and gives the profession a stronger common standard.

Beyond assessment, Singapore also wants to invest in people at every career stage. For young talent, CSA has just signed an agreement with Trend Micro to organize Singapore Cyber Conquest, the national Capture-the-Flag (CTF) competition, at SICW for the next three years. For senior leaders, Tan Kiat How pointed to "a different kind of fluency": the ability to speak with boards, policymakers, and regulators in terms they understand, since cybersecurity is no longer just a back-office function.

A Certification Shows You Passed. Professional Accreditation Shows You Are Accountable

While Singapore is only at the starting line, the UK has been on this road for years. The second half of the session, moderated by Professor Steven Wong, Advisor to AiSP, opened with the most basic question of all: why did the UK choose to professionalize cybersecurity in the first place?

Felicity Powell, Policy Lead for R&D, Skills, and International at the UK's Department for Culture, Media and Sport (DCMS), explained that as the market rushed to train people to close the skills gap, credential inflation followed, making it hard to tell who was genuinely competent. Professionalization answers that problem because it "tells you what good looks like." Felicity compared it to aviation: passengers trust that their pilot can land the plane safely because a professional framework stands behind that pilot, just as one stands behind doctors, lawyers, and engineers. Cybersecurity, she argued, has become critical infrastructure in exactly the same way.

Giles Grant, CEO of the UK Cyber Security Council, drew a clear line between three things that are often confused. A qualification answers whether a person has been taught. A certification answers whether they can pass a structured technical test. Professional registration, however, answers whether they are accountable. It comes with a code of ethics, continuing professional development (CPD), periodic reassessment, a public register from which titles can be revoked, and peer assessment.

Scott Beale, CEO of ISC2, added that passing an exam only proves what someone knew on a given day, whereas belonging to a system that requires continuing education shows that they are keeping pace with a fast-changing field. And because cyber threats routinely cross borders, a common language of knowledge and ethics helps organizations trust the people they work with, wherever those people are based.

How Do You Assess Judgment When an Exam Cannot?

Knowledge and skills can be tested in an exam, but ethics and judgment are far harder to measure. Debi McCormack, Programs and Partnerships Director at The Cyber Scheme, one of the bodies licensed to assess candidates, said one surprise was how much guidance candidates needed. Technical professionals are so used to working in teams that they instinctively say "we did this." Assessors had to draw them out until they could say "I made this decision." That matters most in ethical situations, such as when a client asks for a finding to be left out of a report. Explaining that you decided to refuse demonstrates both your ethics and your ability to make a judgment call.

On assessment design, Nick Benson, CEO of CREST International, said the challenge is to be "rigorous and workable." His first principle is that candidates should not have to go through the same assessment twice when they have already passed one that is at least as rigorous. His second is to put employers at the center, since they see their employees' conduct and ethics in real work every day. His third is to allow the same standard to be met in different ways, accommodating differences in location and learning style, including candidates who are neurodivergent.

Lessons From the UK: Don't Start at the Top of the Pyramid

The question Singapore most wanted answered was which mistakes to avoid from the outset. Giles acknowledged that the UK took years and initially got it wrong, because it started with process rather than with demand. The hardest part, he said, is not building the framework but winning hearts and minds, especially among professionals who already suffer from certification fatigue. His advice: "Think big, start narrow. Test, verify and scale." He added that if the Singapore government requires accreditation for certain public sector roles, it would go a long way toward driving early adoption.

Debi added that the UK's biggest misstep was to begin by assessing at the Chartered level, the very pinnacle of the profession. As a result, most professionals felt the titles were irrelevant to them and out of reach. Her advice is to start with the core of the workforce and to listen closely to the first candidates who go through the process, because if it feels unwieldy or unfair, no one will sign up.

In the UK, demand has grown fastest where titles are mandated, such as work on critical national infrastructure and in the public sector. Still, Debi has noticed that candidates' initial reluctance tends to turn into pride once they earn their titles, and over the past 12 months, more people have been saying "I chose to do this" rather than "my boss told me to." On cost, which remains a barrier for young professionals, Debi and Nick agreed that employers need to invest more, much as law firms invest in the careers of trainee lawyers, because employers ultimately benefit from having qualified people on their teams.

As AI Raises the Bar, Professionals Must Rise With It

Both halves of the session arrived at the same place. In closing, Tan Kiat How said that while AI will transform many cybersecurity tasks, it will also raise the premium on expertise, judgment, and responsibility. The goal, therefore, is broader than training people to use the latest tools. It is to build professionals who understand technology, know its limits, and can make sound decisions when it counts.

When AI can answer almost any question, the most valuable asset becomes the person who can tell which answer is right, along with a system that can confirm that person deserves to be trusted.

Source: Workforce Development Panel, "Supercharging the Cyber Workforce: AI, Skills, and Accreditation," Singapore International Cyber Week (SICW) 2026 (Opening Address by Tan Kiat How; lightning talks by Dr. Ning Wang, Dr. Lim Woo Lip, and Wong Choon Bong; and the panel discussion "UK's Professionalisation Journey, and Lessons for Singapore's Implementation")