Singapore Launches Its Cybersecurity Strategy 2026 Command Center, Domain Blocking, AI-Powered Defense

In the depths of winter in December 2025, Poland was hit by a coordinated wave of cyberattacks. The targets included more than 30 wind and solar installations, as well as a combined heat and power plant that supplied heat to nearly 500,000 people. Months earlier, in April 2025, South Korea's largest mobile carrier had reported a breach that compromised sensitive data from nearly 27 million user records.

Were these isolated accidents, or pieces of a larger picture that no one has yet seen in full?

That question set the tone for the Opening Ceremony of Singapore International Cyber Week (SICW) 2026, held under the theme "Cyber at a Crossroads: Shaping the New Cyber Order." Three speakers took the stage: 

• Gwenda Fong, Chief Executive of the Cyber Security Agency of Singapore (CSA) and Commissioner of Cybersecurity
• K Shanmugam, Senior Minister, Coordinating Minister for National Security, and Minister for Home Affairs of Singapore, who used the occasion to launch the Singapore Cybersecurity Strategy 2026
• Amandeep Singh Gill, UN Under-Secretary-General and Special Envoy for Digital and Emerging Technologies.

Each spoke from a different vantage point, yet their arguments converged on a shared conclusion. No one can see the full picture of cyber threats, and as AI makes attackers faster, defenders can no longer afford to wait for the pieces to fall into place on their own.

Everyone Sees Something, but No One Sees Everything

Fong, delivering her welcome remarks at her first SICW as CSA Chief Executive, began with Singapore's position in the world. As a small country whose success was built on being open and connected, Singapore depends on digital infrastructure, technology platforms, and supply chains that extend far beyond its shores. That connectivity has brought enormous opportunities, but it also exposes the country to risks that originate beyond its borders.

The difficulty is that these threats span multiple systems, organizations, and countries. Governments, infrastructure operators, cloud providers, and cybersecurity companies each have visibility of a different part of the threat landscape. As Fong put it, "Each sees something important but no one sees everything."

Sophisticated attackers exploit precisely this gap. They operate across multiple systems and networks, often over extended periods, so what looks like an isolated incident to one organization may in fact be part of a much larger campaign. If your organization spotted a minor anomaly in its systems today, how would you know whether it was a one-off event or just one corner of a much bigger picture?

Fong added that assembling the picture is only half the challenge. The other half is doing it quickly enough to act before the adversary does.

When Hiring More Analysts Cannot Keep Pace, What Do Defenders Have Left?

Speed is exactly where AI changes the equation. Singapore has long relied on technology to overcome its constraints of size and manpower, and it intends to harness AI in the same way. Because the country cannot simply keep adding analysts as threats grow in volume and sophistication, Fong said, it needs AI to help its cyber defenders "to see more, to understand faster and to act more effectively."

Attackers, however, can harness AI too. In Fong's view, the real challenge is to use AI to strengthen defenses without allowing it to tilt the advantage toward the attackers.

AI is also becoming part of the environment that must be secured. As AI agents gain access to data, applications, and tools, they create new dependencies and vulnerabilities. For years, Fong noted, cybersecurity has required an understanding of what is connected to what. In an increasingly agentic world, defenders must also understand "what can act on what, with what permissions and with what consequences."

This warning is far from theoretical. Speaking at the same ceremony, Shanmugam said that AI agents can be manipulated into carrying out unintended actions that compromise essential systems, and that agentic AI is advancing faster than safeguards can keep up. AI agents have already carried out unauthorized tasks and accessed systems they were never meant to reach. Just last month, Australia disclosed that an AI agent had gained unauthorized access to non-public data on a government portal.

Can your organization say, right now, which systems each of its AI agents is allowed to touch?

Waiting for a Breach Before Responding Is a Mindset Singapore Is Leaving Behind

For Shanmugam, AI-enabled cyber threats are "really not a matter of if, but when." Singapore cannot resist AI adoption, so it must find ways to adopt AI safely and securely. Nor are recent attacks isolated incidents. Advanced Persistent Threat (APT) groups have both the intent and the capability to target critical infrastructure persistently, for espionage as well as disruption, and every country must plan on facing such attacks with increasing frequency.

Singapore has learned this lesson firsthand. At last year's SICW opening, Shanmugam revealed that UNC3886, an APT group, was attacking the country's critical infrastructure even as he spoke, having used sophisticated tools to gain access to its telecom networks. Singapore responded with Operation Cyber Guardian, its largest cyber response to date, which brought cyber defenders from the government together with telcos and other partners.

That experience shaped the new strategy, under which Singapore will seek to "act earlier, act at national scale, and act at the speed of the threat." 

The strategy is also broader in scope than the way national cyber defense has traditionally been viewed. It covers strengthening critical infrastructure and the wider cyberspace, building capabilities in AI and quantum, deepening global partnerships, and investing in the cybersecurity ecosystem and workforce.

The first principle is to act earlier. Traditional cyber defense relies heavily on protecting systems, conducting periodic assessments, and responding after something has gone wrong. Adversaries, however, are continuously looking for vulnerabilities and trying to establish persistent access, so defense must be continuous as well. That means monitoring and hunting for threats on an ongoing basis, identifying weaknesses before adversaries do, and fixing them quickly. If attackers are scanning for vulnerabilities every day, do periodic system checks still count as protection?

Attackers Don't Treat Government and Industry as Separate. Why Should Defenders?

The second principle, acting at national scale, comes directly from the lessons of Operation Cyber Guardian. Shanmugam explained that sophisticated attackers do not see the government and telcos as separate silos. They look across all systems for the weakest point. National defense must therefore look across the whole system as well, with government and industry working closely together in any response.

To that end, Singapore has established the National Cybersecurity Command Centre (NC3) as CSA's operations hub for national cyber defense. NC3 serves three functions. First, it provides a national picture of both vulnerabilities and threats by supporting the continuous monitoring of critical infrastructure systems and by bringing together threat information from the government, Critical Information Infrastructure (CII) owners, cybersecurity companies, and international partners. Second, it helps detect APT groups earlier through proprietary threat detection systems and privileged intelligence, allowing defenders to act before attackers can cause serious harm. Third, it enables an effective national response to major cyber threats, similar to Operation Cyber Guardian, through AI-enabled coordination systems.

The government will also provide greater protection upstream by developing a National Protective Domain Name Service (PDNS). When someone tries to connect to a domain known to be malicious, PDNS can stop the connection before the threat reaches the user, reducing exposure to phishing, scams, malware, and other cyber threats.

If Attackers Use AI, Defenders Cannot Afford to Be Slower

The third principle is to act at the speed of the threat. Shanmugam's logic is straightforward: if AI allows attackers to identify vulnerabilities and launch attacks more quickly, defenders must use AI too. The government will progressively deploy AI across its national cyber defense operations, including within NC3 and the Government Cyber Security Operations Centre, and will work with industry and technology partners to speed up the adoption of AI-enabled cyber defense across critical sectors.

Some of these capabilities are already in place. CSA has developed AI tools that automate the discovery and mapping of exposed assets and vulnerabilities, and that help cybersecurity specialists test complex vulnerabilities in web applications. Meanwhile, the Government Technology Agency (GovTech) uses AI agents to accelerate vulnerability discovery and security testing.

That said, Singapore does not plan to build its own AI models for every use case. What it really needs, Shanmugam said, is the capability to evaluate the best available models and adapt them to its own needs. The government will therefore invest in AI harness engineering, which will give it the flexibility to choose between AI models and to securely integrate the best ones with the tools, data, and workflows that cyber defenders need.

Trust Is Not a Soft Concept. It Is Infrastructure

Even the fastest tools mean little, however, if no one trusts the systems in which AI operates. Gill tied this point to the conference theme. Until now, he observed, we have treated cybersecurity measures like guardrails along a road. As AI accelerates, though, the road itself and the vehicle we are traveling in are both shifting, which means the crossroads is shifting too. Our traditional ways of looking at threats and responses must therefore change radically.

At the root of the problem lies a dilemma. To unleash the potential of AI, agents must be given more autonomy to act in the physical world. That expands the attack surface available to hackers and increases the likelihood of mistakes in how tasks are executed. Both digital and physical systems must therefore become more secure as AI adoption moves forward.

Gill argued that "in this AI world, trust should be seen as hard infrastructure" rather than a soft concept. We trust a digital system when we understand what it is designed to do, when we can test what it claims to do, when responsibility is clear if it fails, and when humans retain the ability to intervene. Trust therefore cannot rest on confidence in the technology alone. It must be earned through compelling evidence across domains and across borders.

This kind of trust matters to citizens and governments alike. According to Gill, public trust is one of the biggest obstacles to AI adoption today, while governments must decide whether to deploy AI systems in critical sectors and whether they can rely on systems developed in another country. "We do not partner those we do not trust," he said. "And we cannot trust what we cannot see clearly, hold to account or govern."

The question becomes even harder when a model is developed in one jurisdiction, trained on infrastructure in another, integrated by providers elsewhere, and deployed simultaneously across many societies. When a system like that fails, who is responsible?

Diversity Is a Strength. Fragmentation Is the Risk

The answer does not lie in requiring every country to govern AI the same way. Gill noted that at the UN General Assembly, more than 110 countries, including Singapore, referenced AI in their speeches. Even within ASEAN, approaches vary widely, from Vietnam's law-based model to Singapore's approach, which rests on strong principles, concrete guidance, testing tools, and meaningful human accountability.

This diversity is not the problem. The real problem is fragmentation and a retreat into silos. Gill sees diversity as a source of strength, resilience, and experimentation during this early phase of AI development, and as a foundation for greater interoperability across jurisdictions. After all, "a vulnerability that's discovered in one place can become a threat anywhere," and a lesson learned in one place should enhance protection everywhere.

For that reason, the measures companies take on their own, whether or not governments encourage them, will not be enough. Gill called for a basic minimum layer of international cooperation built on three elements. The first is helping every country build a baseline level of safety infrastructure, whether it develops, borrows, or buys its AI models. He pointed to the Singapore AI Safety Institute, based at the Digital Trust Centre, and to the UK's approach as models, since both operate separately from regulation while working with the private sector and keeping policymakers informed.

The second element is minimum standards for testing, verification, the certification of independent auditors, baseline system behavior, and red lines, comparable to accounting standards in the financial sector. The third, and perhaps the most important in Gill's view, is information sharing, including incident reporting, transparency, and even data on near misses, which can offer valuable lessons. Because this cannot be achieved through ad hoc arrangements, he argued, the world needs a multilateral risk management framework backed by independent and credible foresight.

Compete if You Must, but Don't Wall Yourself In

Gill's proposal aligns with a reality that Shanmugam openly acknowledged: even a more proactive defense cannot prevent every attack, which makes cooperation all the more important. He also urged realism about the current environment. Strategic competition will intensify, particularly over critical technologies such as AI, and countries will act to safeguard their national interests. Singapore will do the same.

The danger arises if every country responds to that competition by building inward and acting alone, because doing so would break up the digital ecosystem that everyone depends on. Shanmugam said signs of this are already visible in advanced technology domains such as AI, semiconductors, and telecommunications. Cyber threats cross borders, and technology and infrastructure are spread across jurisdictions, so no country, however capable, can secure the digital domain on its own.

"We will not agree on everything," Shanmugam said. Even so, countries must build practical cooperation to exchange information, respond to incidents, tackle common threats, and reduce the risk of wider instability. That cooperation must also extend beyond governments, since much of the infrastructure is owned and operated by industry, and much of the technology, threat intelligence, and technical expertise sits outside the public sector.

Fong added that cooperation must go beyond agreeing on principles and translate into the ability to work together when it matters. She cited the ASEAN CERT Incident Drill, which since 2006 has brought national cyber response teams together to practice responding to cross-border incidents, building the relationships and habits of cooperation that count in a real crisis.

This year, SICW is applying the same practical approach to AI, moving beyond discussing what AI might mean for cybersecurity toward testing what it means in practice. CSA is partnering with Google on an agentic AI cyber scenario exercise for international partners, working with the AI Safety Hub on a Frontier AI Governance Workshop for officials from ASEAN and the broader Asia-Pacific region, and joining Cloudflare to deliver hands-on training in AI-enabled cyber defense for critical infrastructure operators. As Fong put it, some things "can only be learned by working through the problems together."

Resilience Does Not Mean Closing the Door

All of this leads back to the question facing a small country like Singapore: how can it protect itself without shutting out the world? Shanmugam's answer is that Singapore will build its resilience by strengthening its own capabilities and safeguarding its national interests, but "resilience does not mean retreating from the world." On the contrary, resilience is what gives Singapore the confidence to remain connected. That, he said, is ultimately what the Cybersecurity Strategy 2026 is about: protecting the trust on which the country's digital economy and society depend.

Fong closed her welcome remarks by encouraging everyone to look beyond their own vantage point and to "find the people in the room who can help us see the rest."

If no one can see the whole picture of cyber threats, the question every organization must answer is not what it can see, but who it is looking with.

Source: Opening Ceremony of Singapore International Cyber Week (SICW) 2026 (Welcome Remarks by Gwenda Fong, Opening Address by K Shanmugam, and Special Address by Amandeep Singh Gill), CERT Polska