New Strategies in Cybersecurity
In light of recent cyberattacks, Singapore has taken a significant step forward in enhancing its cybersecurity framework. The local government has introduced advanced artificial intelligence tools designed to protect around 2,000 critical government systems, reflecting a shift in strategy from passive defenses to aggressive threat detection.
Background of the Threat
The recent shift in strategy was prompted by an incident involving state-sponsored cyberespionage group UNC3886, which targeted the country's major telecommunications providers. This attack, revealed in July 2025, posed a serious threat to national security and the stability of communication networks.
In her first interview since becoming the Chief Executive Officer of the Cyber Security Agency of Singapore (CSA) in July, Gwenda Fong stressed the importance of evolving beyond traditional defense methods. She noted that advanced persistent threats (APTs) such as UNC3886 target specific infrastructures, necessitating a more proactive approach.
Proactive Threat Hunting
Fong articulated the need for a mindset shift, stating, "You must accept that the most sophisticated attackers will find a way into your systems at some point." This awareness calls for constant monitoring of internal network activities to quickly identify and respond to unusual behaviors indicative of breaches.
The CSA's new AI tools aim to facilitate this proactive stance. One key application automates penetration testing for government systems, simulating cyberattacks to pinpoint vulnerabilities. Another tool diligently scans the source code of government applications for potential security weaknesses, allowing agencies to address them before any exploitation occurs.
Implementing AI Across Critical Sectors
While specific agencies using these AI tools have not been disclosed, there are plans for their implementation across other sectors critical to national security, including healthcare, energy, and finance. The CSA and GovTech are currently evaluating operational requirements and sector-specific needs for broader adoption.
In addition, CSA has begun regular scans of internet-facing systems of critical infrastructure operators to uncover vulnerabilities such as unpatched software, which could serve as entry points for attackers. According to Fong, this process resembles checking the security of doors and windows in a home, ensuring that any potential weaknesses are identified and remedied.
Strengthening Supply Chains
Beyond immediate cybersecurity measures, CSA is set on tightening regulations around supply chains associated with critical infrastructure. Fong pointed out the vulnerability posed by third-party vendors if they are compromised, a scenario that could jeopardize sensitive data and services.
To enhance security, CSA is considering making certifications for cybersecurity—such as Cyber Essentials and Cyber Trust marks—mandatory for certain vendors and suppliers involved with critical infrastructure by as early as 2027. Currently, these certifications are voluntary, and uptake has been slower than anticipated, with only 874 Cyber Essentials and 346 Cyber Trust certifications issued as of August.
The Evolving Landscape of Cybersecurity
Fong argues that the landscape of cybersecurity is rapidly evolving from a technical focus to a strategic priority, impacting national security, public trust, and the digital economy. The surge in suspected APT activities—quadrupling from 2021 to 2024—highlights the urgency of the situation.
As reliance on digital infrastructure grows, the implications of cyber disruptions extend beyond technical failures; they can affect nearly every facet of modern life. Addressing these challenges, Fong emphasizes that the modern approach to cybersecurity must fundamentally protect trust in digital systems.
“These have fundamentally changed the nature of cybersecurity. It is a much more strategic discipline,” said Fong.
