Publication date: 15 October 2026
Singapore has launched a new national cybersecurity strategy built around continuous threat hunting, shared situational awareness and faster coordination across government, critical infrastructure and industry. Its central idea is that sophisticated attackers do not respect organisational boundaries, so national defence cannot rely on each operator protecting its own network in isolation.
A command centre for a connected threat
The Cyber Security Agency of Singapore will enhance the National Cybersecurity Command Centre, or NC3, to combine threat information from government bodies, critical-infrastructure operators, security companies and international partners. The centre is intended to provide a common national picture of vulnerabilities and active threats, support continuous monitoring and coordinate responses to major incidents.
This marks a shift from periodic assessment and incident response towards earlier intervention. The strategy calls for defenders to identify exposed assets, hunt for persistent attackers and fix weaknesses before they are exploited.
That approach recognises how attacks actually spread. A compromise at a supplier, telecommunications provider or shared service can become a route into multiple sectors. Seeing each event separately may hide the campaign; combining evidence can reveal its structure.
AI on both sides of the contest
Singapore plans to deploy AI progressively in NC3 and the Government Cyber Security Operations Centre. The government is developing tools to map exposed assets, find vulnerabilities and support complex security testing. It intends to evaluate and use the best available models rather than build a single government model for every task.
The strategy is responding to the same technology being used offensively. AI can help attackers scan large numbers of systems, adapt malicious code and automate social engineering. Defenders need comparable speed, but automation introduces its own risks. A flawed model can produce false alarms, miss unfamiliar behaviour or take action without sufficient context.
Human accountability therefore remains essential. AI should help prioritise evidence and accelerate investigation, while consequential containment decisions stay traceable, reviewable and reversible.
Blocking threats before they reach users
A proposed protective domain-name service will prevent connections to known malicious domains associated with phishing, scams and malware. Domain-name filtering can reduce exposure at population scale, especially for users and small organisations that lack advanced security teams.
Its value will depend on accuracy and governance. False positives can block legitimate services, while threat lists can become outdated quickly. Singapore will need transparent correction processes, rapid updates and safeguards against the service becoming a tool for unrelated content control.
AI, quantum risk and workforce capacity
The broader strategy also covers critical infrastructure, quantum-safe migration, international cooperation and cyber skills. Quantum readiness matters because encrypted information stolen today may be retained until future computers can decrypt it. Migration requires inventories, standards and years of replacement work rather than a last-minute software update.
The workforce is another constraint. Centralised technology cannot replace skilled analysts inside utilities, banks, hospitals and public agencies. A national command centre works only if participating organisations can interpret warnings, share useful evidence and act on coordinated instructions.
A model others will study
Singapore’s compact, highly connected economy makes nationwide coordination more feasible than in many larger countries. Even so, its design offers a transferable lesson: cyber resilience depends on combining local responsibility with a shared national view.
The strategy’s success will be measured not by the number of tools deployed but by whether threats are detected earlier, vulnerabilities are repaired faster and essential services recover more effectively. It turns cybersecurity from a collection of private defences into a form of national operational coordination.