Singapore has a new national plan for defending its networks, and it reaches further into daily life than its technical language suggests. Launched at the opening of the 11th Singapore International Cyber Week, it replaces a strategy last refreshed five years ago, before frontier AI and quantum computing became everyday talking points.
In this article we will explore the threats behind the plan, its four pillars and two enablers, and what it means for households and for the country as a whole.
Third in a line of national plans
The Cyber Security Agency of Singapore (CSA) published the new strategy on 13 October 2026, and Senior Minister K Shanmugam launched it at the opening of the 11th Singapore International Cyber Week at the Sands Expo and Convention Centre. Mr Shanmugam holds three roles that matter here: Senior Minister, Coordinating Minister for National Security and Minister for Home Affairs. That combination tells you something about how the government sees the subject. Cybersecurity is treated as a national security matter first and a technology matter second.
This is the third document of its kind. The first national strategy came out in 2016 and a refreshed version followed in 2021. The new one looks ahead over the next five years, with implementation to be carried out together with stakeholders rather than by one agency acting alone. CSA has framed the overall vision as a secure, trusted and resilient cyberspace, and each of those three adjectives does a different job. Secure is about keeping attackers out. Trusted is about whether people are willing to bank, work and see a doctor online. Resilient is about what happens after something goes wrong, because something eventually will.
Prime Minister Lawrence Wong wrote the foreword, and the theme he stressed was shared responsibility. That is the line worth holding on to when you read the rest of the plan. A strategy can direct agencies and regulate operators of vital systems, but it cannot stop a tired person from approving a login prompt at midnight. Much of what follows is the government’s attempt to build protection upstream so that fewer decisions land on individuals, while accepting that some will always do.
How the earlier versions set the scene
The 2016 strategy was built when the main worry was protecting the systems that keep the country running, and when the idea of a national cyber agency was still fairly new. The 2021 refresh arrived after remote work had spread and as ransomware became a boardroom word. Neither document had to deal with chatbots that can write convincing messages in any language, or with the prospect that a future computer could break the encryption protecting today’s records. The new plan is, in effect, a response to two technology shifts that did not feature in the old ones.
Three threats behind the rewrite
The CSA release names three concerns. They are different in kind, and it helps to keep them apart, because each one calls for a different response and each reaches ordinary people by a different route.
Advanced persistent threat actors
Advanced persistent threat actors, usually shortened to APTs, are well-resourced groups that break into a target and stay there quietly for months or years. Their aim is usually access, not money: to watch, to prepare, or to be able to disrupt something at a chosen moment. The strategy describes them as targeting critical infrastructure, which means the networks behind power, water, transport, banking, health services and similar functions. For a household, the risk is rarely a direct hit. It is the knock-on effect if a system everyone depends on is interfered with, which is why the first pillar of the plan concentrates on these systems.
Frontier AI on both sides
The second concern is that frontier AI is changing both offence and defence. Attackers can use it to write more believable phishing messages, to search for weaknesses faster and to imitate voices or writing styles. Defenders can use the same technology to sift through huge volumes of alerts and spot unusual behaviour sooner. The strategy does not treat AI as only a danger. It treats it as a race in which Singapore wants to be at least as good at the defensive side as attackers are at the offensive one, and it also wants organisations that adopt AI to do so securely.
Quantum computing and today’s encryption
The third concern is quantum computing, which could in future undermine the encryption that protects today’s online banking, messaging and stored records. The practical worry is not that this happens next year, and nobody can say with confidence when such machines will arrive. It is that information scrambled today, if copied and kept by an attacker, could be opened later once machines are powerful enough. Anything that needs to stay confidential for many years, such as medical records, identity data or government files, therefore needs protection that will survive that future. Moving to what experts call quantum-safe methods takes years of preparation, and that explains why a five-year strategy gives it a pillar of its own.
The three concerns also feed on each other. A state-backed group with AI tools can probe more systems in less time, and the same group may be quietly collecting encrypted data today in the hope of opening it later. That overlap explains why the strategy talks about the threats together instead of treating each as a separate project, and why defenders are being asked to think about the next decade while still clearing this week’s alerts.
It is also worth noting what the strategy does not claim. It does not say that Singapore is under constant successful attack, and it does not promise that harm can be prevented entirely. It describes a changing environment and sets out how the country intends to keep pace with it. That restraint is sensible. Overpromising on cybersecurity tends to backfire the first time a breach makes the news.
The four pillars in plain terms
CSA organises the plan around four pillars. The table gives the short version, and the sections after it explain what each pillar means in practice.
| Pillar | Main aim | Who feels it most |
| Defend Critical Infrastructure | Central national cyber defence capabilities and stronger defences at CII owners | Operators of vital systems, indirectly everyone |
| Secure our Wider Cyberspace | Upstream protection, help for organisations, continued public education | Businesses and households |
| Strengthen Capabilities for AI and Quantum | Use AI for defence, guide secure AI adoption, speed up quantum-safe migration | Technology teams, regulators, long-term data holders |
| Enhance Resilience through Global Partnerships | Convening, rules-based cooperation, work with major technology firms | Government, industry, regional partners |
Defend Critical Infrastructure
The first pillar has two parts. One is the development of centralised national cyber defence capabilities that can anticipate, detect and respond to threats. The idea of centralising is that a single view across sectors spots patterns that no individual operator would see alone. If the same unusual probing shows up at a power operator, a port and a hospital network within a week, someone needs to be positioned to notice the link.
The other part is strengthening the defences of owners of Critical Information Infrastructure, or CII, against advanced and AI-enabled attacks. Under Singapore’s Cybersecurity Act, CII is the term for computer systems whose disruption would seriously affect essential services or national security, and the owners are designated by the authorities. The sectors covered have been broad since the law took effect, and the list may have been updated since, so check CSA for the current position. For a reader at home, this pillar is the one that is hardest to see and the one you will notice only if it fails.
Secure our Wider Cyberspace
The second pillar looks beyond the designated systems to everything else: small firms, community groups, schools and homes. It has three strands. The first is stronger upstream protection, meaning measures that stop harmful traffic, malicious sites and scam messages before they reach users. The second is helping organisations improve their cybersecurity posture. The third is continued public education.
Upstream protection matters most to ordinary people because it is the only approach that scales. Telling millions of residents to inspect every link has limits, since a convincing message will catch some of them whichever campaign they have watched. Blocking the infrastructure that sends the message, or flagging it before it lands in an inbox, removes the decision altogether. Expect this strand to show up as features you barely notice, such as warnings, filtering and tighter checks by telecom operators and platforms.
Public education continues alongside it because filters are never perfect.
Strengthen Capabilities for AI and Quantum
The third pillar bundles four commitments. The first is to use AI to strengthen cyber defence. The second is to promote AI-enabled cyber tools, which means encouraging a market for products that apply the technology to detection and response. The third is to provide practical guidance for secure AI adoption, aimed at organisations that are rushing to add AI features and may be creating new weaknesses as they do. The fourth is to accelerate national quantum-safe migration.
The guidance element is easy to overlook and probably the most useful in the short term. Many Singapore firms, large and small, are connecting AI tools to customer records, internal documents and email. Without clear rules on what data may be entered, who can see the outputs and how those tools are tested, the same convenience can leak information. The practical business toolkit that has followed from this pillar is covered in our companion article on grants, the helpline and accreditation.
Enhance Resilience through Global Partnerships
The fourth pillar acknowledges what small states know well: your networks are only as safe as the wider system you are plugged into. Singapore positions itself as a trusted convenor, and the Singapore International Cyber Week is one example of that role, bringing officials, companies and researchers into one place each year. The pillar also commits to rules-based cooperation between countries.
It adds partnerships with major technology firms on three subjects: AI-enabled cybersecurity, operational technology security and quantum-safe migration. Operational technology, or OT, refers to the equipment that runs physical processes such as pumps, switches and building systems, as opposed to the office computers around them. Much OT was designed decades ago, when it was never meant to be connected to anything, and protecting it is now a different discipline from protecting email.
Two enablers behind the pillars
The plan adds two enablers, which are less about specific threats and more about the capacity to carry out everything else. The first is a world-class cybersecurity ecosystem. In the CSA wording, this means Singapore becoming Asia’s leading cybersecurity innovation hub, moving research through to commercialisation and co-developing solutions with academia and industry. The reasoning is straightforward. A country that depends entirely on imported tools has less control over what it buys, and a local industry also keeps expertise in the country.
The second enabler is levelling up the cyber workforce, and here the strategy lists three aims: to professionalise the field, to deepen capabilities, and to broaden the talent pipeline. Anyone who has tried to hire a security specialist will know why this is on the list. Demand for skilled people far exceeds supply in most economies, and the profession has relied on a patchwork of certificates that employers find hard to compare. Professionalising means clearer standards of competence and conduct, the way engineering and accountancy have them.
There is also a cost-of-living angle that rarely gets mentioned. When local firms can build and sell security products, public bodies and small businesses have more choice and, over time, more competition on price. When there is a deep pool of qualified practitioners, fewer organisations have to go without advice because they cannot afford the few people who can give it. These are slow effects, but they are the sort that determine whether the plan helps a corner shop or a clinic and not only a large bank.
For readers who are not in the industry, the enablers explain how the plan can be delivered over five years. A strategy with no people behind it is a document. A strategy with a pipeline of trained staff and a home-grown industry is a capability. If you have a child choosing a course or you are considering a mid career switch yourself, this is the part of the plan most likely to affect you directly. A national accreditation route for practitioners has also been announced, and its details sit in the companion article rather than here.
What changes for households and everyday users
A national strategy does not send a letter to your door. Its effects arrive slowly, through the services you use, the rules firms must follow and the habits that public campaigns try to build. It is worth being honest about what is known: the text of the strategy released so far sets directions, and the detailed annex of initiatives was not available in the version used for this article. So the following describes likely effects based on the stated direction, and not promised features.
Scam and phishing protection
The wider-cyberspace pillar points towards more filtering before messages reach you. In practice that could mean further checks on who can send messages under a brand name, more aggressive takedown of fake sites and better cooperation between banks, telecom operators and platforms. For you, the habit that matters stays the same: treat any unexpected message that asks for money, passwords or one-time codes as suspicious, and contact the organisation through a number you already trust. Official apps and bank cards offer ways to freeze or limit transactions, and it is worth knowing where those switches are before you need them.
Children, older relatives and shared devices
Households are not uniform, and the weakest point is often the person with the least practice. Children use games, chat apps and school platforms, and may share a tablet or a family account without thinking about who else can see it. Older relatives are frequent targets of calls from people pretending to be officials or relatives in trouble, and many have been trained all their lives to be polite to callers. The most useful thing a younger family member can do is set up the basics on their behalf, such as automatic updates, a screen lock and two-step verification, and then agree on a simple rule that anything involving money gets a second opinion before action. Public education campaigns under the second pillar are likely to keep targeting these groups, so it is worth using whatever material the agencies produce for them.
Passwords, logins and devices
Shared responsibility means that the basics still sit with each person. Use a unique password for each important account, switch on two-step verification wherever it is offered, and prefer passkeys when a service supports them, since they cannot be typed into a fake site. Keep phones, laptops and home routers updated, and replace any device that no longer receives updates. None of this is new advice, but the strategy’s emphasis on public education suggests it will be repeated, and repetition works only if people act on it.
AI-made deception
The AI pillar matters at home in one particular respect: messages and calls are getting more convincing. A fake voice message from a relative or an email in perfect English from a supposed official is now cheap to produce. Agree a family code word for emergencies, call back on a known number whenever someone asks for money urgently, and be wary of any request that combines pressure with secrecy. Perfect grammar is no longer evidence of legitimacy.
The quantum question for ordinary users
Most households do not need to do anything about quantum computing. The migration work falls on the organisations that hold your data, and your part is mostly to keep your apps and operating systems updated so that new protections reach you when they are introduced. If you hear a sales pitch for a quantum-proof gadget aimed at consumers, treat it with scepticism and check with CSA before paying for anything.
National resilience and the limits of a strategy
At the national level the plan reads as a long-term bet on three things: protecting the most important systems well, raising the floor for everyone else, and building enough talent and industry to sustain both. Defence alone cannot be perfect, and the strategy’s emphasis on resilience concedes as much. Resilient systems assume that some attacks will get through and focus on limiting the damage, restoring service quickly and learning from each event.
Judging progress over five years
There are fair questions to ask over the five years. One is how the centralised defence capability will share information with private operators without slowing them down. Another is how smaller organisations, which lack security teams, will be reached by upstream protection and help programmes. A third is how success will be measured, since a quiet year may mean good defence or merely good luck. The strategy sets direction, and the annex of initiatives and later agency announcements will show how much weight each pillar carries in budgets and timetables. It is reasonable to read them as they appear.
Why the international pillar matters
The international pillar deserves credit for realism. Singapore cannot make the internet safe on its own, so it invests in being useful to others: hosting the conversation, working with technology firms and cooperating under agreed rules. That earns goodwill and early information, both of which a small country needs more than most. The risk is that cooperation depends on the political mood elsewhere, and rules are only as strong as the willingness to follow them.
Choices at home, in a sensible order
Start with the accounts that would hurt most if lost: your main email, your banking and payment apps, and your Singpass. Give each a unique password, switch on two-step verification and check which devices are logged in. Email comes first because it is the key to resetting everything else.
Next, update the devices you use daily and set them to update automatically. Replace or retire any router, camera or phone that no longer receives security updates. After that, set up a small family routine for scam calls: a code word, a rule that nobody transfers money after a single phone call, and a habit of showing suspicious messages to someone else before replying.
A word on money. Nothing here requires you to buy a product, and you should be sceptical of anyone who says otherwise. A password manager, if you choose to use one, is a reasonable aid, and many phones and browsers now include a basic version at no extra cost. Paid security suites vary in usefulness, and the built-in protections in current operating systems already cover a lot. Spend your effort on habits before you spend money on tools.
Finally, keep an eye on the agencies. CSA, the police and your bank publish alerts and guidance that change as scams change, and the details of this strategy will be filled in over the five years. If you run a small business or work in IT, read the companion article on the practical toolkit, because that is where grants, a helpline and accreditation are covered.
One last point on timing. Because the strategy covers five years, some of its effects will be gradual and some may never be visible to you. Judge it by whether scams reaching you become rarer, whether essential services keep running through disruption and whether help is easy to find when something goes wrong. Those are ordinary tests, and they are the right ones.
Frequently Asked Questions
1. When was Singapore’s new cybersecurity strategy launched?
CSA published it on 13 October 2026, and Senior Minister K Shanmugam launched it at the opening of the 11th Singapore International Cyber Week. It follows the first strategy in 2016 and a refreshed version in 2021.
2. How long does the new cybersecurity strategy run?
The plan is to be implemented over the next five years together with stakeholders. Initiatives may be announced in stages, so check CSA for the latest details.
3. Does the strategy change anything I have to do as an ordinary resident?
It does not set new legal duties for individuals in the text released so far. The main expectation is shared responsibility, which in practice means sound password habits, updated devices and caution with unexpected messages.
4. What are the four pillars of the cybersecurity strategy?
They are Defend Critical Infrastructure, Secure our Wider Cyberspace, Strengthen Capabilities for AI and Quantum, and Enhance Resilience through Global Partnerships. Two enablers support them: a world class cybersecurity ecosystem and a levelled-up cyber workforce.
5. Do I need to worry about quantum computers breaking my online banking?
Not today, and not as an individual action item. Banks and other organisations are responsible for migrating to quantum-safe protection, and the strategy lists accelerating that migration as a national task.
6. Where can I report a scam or get cybersecurity advice?
Contact your bank at once if money is involved, then report the incident to the police. CSA and the police both publish public guidance, and their websites are the best place to check current advice.
