The incident has pushed Singapore toward a more proactive approach that assumes sophisticated attackers may eventually enter protected networks. Instead of focusing only on preventing intrusions, authorities are emphasizing threat hunting and the detection of suspicious activity after attackers gain access.
In an interview, Cyber Security Agency of Singapore (CSA) chief executive and Commissioner of Cybersecurity Gwenda Fong said advanced persistent threat actors such as UNC3886 pursue specific targets, meaning perimeter protection alone is not enough.
Once inside a network, attackers still need to move toward sensitive systems and data, giving defenders opportunities to identify unusual internal activity.
Singapore is using artificial intelligence to strengthen this detection and prevention work. The Government Technology Agency of Singapore (GovTech) has developed two AI-powered tools for government systems. One performs automated penetration testing across about 2,000 government systems, including systems containing citizen data and transactions.
The second scans the source code of government applications and systems for security weaknesses so agencies can address vulnerabilities before attackers exploit them.
The authorities have not disclosed which agencies are using the tools, but their use is being evaluated for expansion across Singapore’s 11 critical information infrastructure sectors, which include healthcare, aviation, banking and finance, energy, government and information and communications.
CSA has also started regularly scanning internet-facing systems operated by critical infrastructure organizations to identify potential entry points such as unpatched software and weak configurations. The agency said these scans are external and do not involve active probing.
Other measures include proprietary threat-detection tools developed by a technical agency under Singapore’s Ministry of Defence and the sharing of classified threat intelligence with critical infrastructure operators. CSA is also examining supply-chain security because compromised vendors could potentially expose data or disrupt services.
The agency is considering requiring some vendors and suppliers working with critical infrastructure operators to obtain Cyber Essentials or Cyber Trust mark certifications, potentially as early as 2027. As of August, 874 Cyber Essentials and 346 Cyber Trust mark certifications had been issued.
The shift reflects the growing importance of cybersecurity to national security, the digital economy and public trust. CSA reported that suspected advanced persistent threat activity in Singapore quadrupled between 2021 and 2024, while authorities expect threats to increase as attackers gain access to AI tools.
For organizations connected to critical digital infrastructure, the message is clear: security cannot end at the network perimeter. Identifying weaknesses, monitoring internal activity and detecting attackers before they can reach sensitive systems are becoming essential parts of defending increasingly connected services.
