Oct 17: Singapore’s digital economy is creating opportunities for businesses across financial services, e-commerce, healthcare and technology. But as companies become more dependent on digital platforms, cloud services and artificial intelligence (AI), protecting sensitive information is becoming a bigger business challenge.
The latest figures underline the scale of the issue. According to the Cyber Security Agency of Singapore’s (CSA) Singapore Cybersecurity Health Report 2025, released on 14 October 2026, almost nine in 10 businesses and non-profit organisations surveyed had experienced at least one cybersecurity incident in 2025. Ransomware was the most commonly reported incident, followed by compromised credentials and social engineering attacks, including phishing and impersonation scams.
For Singapore, an international financial and technology hub, these findings raise an important question: how can businesses continue to innovate while keeping customer data, financial transactions and digital operations secure?
The answer goes beyond buying cybersecurity software. Companies need to rethink how they manage data, use AI, work with technology providers and prepare for incidents that could disrupt their operations.
Singapore’s Cybersecurity Challenge Is Growing
Singapore’s connected digital economy supports banking, online payments, logistics, healthcare and international business operations. While this infrastructure makes services more convenient, it also creates opportunities for cybercriminals to exploit weaknesses across systems and organisations.
The CSA’s Singapore Cyber Landscape 2025/2026, published in June 2026, highlighted a threat environment shaped by the growing use of AI, interconnected supply chains and increasingly sophisticated attacks. The agency recorded 165 ransomware cases in 2025, compared with 159 in 2024, alongside a substantial increase in detected infected infrastructure.
The challenge is not limited to large banks or technology companies. SMEs may also be targeted, particularly when they rely on outdated software, poorly secured devices or limited internal IT resources.
The latest cybersecurity health report identified some of the practical difficulties businesses face. Among surveyed businesses, 56% cited a lack of cybersecurity knowledge and experience, while 37% pointed to insufficient manpower and resources. Another 46% believed they were unlikely to be targeted by cyberattacks.
That perception can leave businesses exposed. Cybercriminals do not necessarily need to target a company because it is large or well known. A weak password, an unprotected account or a vulnerable supplier can be enough to create an opening.
AI-Powered Scams Are Becoming Harder to Recognise
Artificial intelligence is changing the way cybercriminals approach businesses.
AI tools can generate convincing emails, imitate writing styles and help create fraudulent messages that look like genuine business communications. Voice cloning and manipulated videos can make impersonation attempts even more difficult to identify.
Consider a finance employee who receives a call that appears to come from a senior executive asking for an urgent transfer. The caller uses familiar language, understands the company’s operations and insists that the payment must be completed quickly.
Without an independent verification process, the request could appear legitimate.
The CSA has warned that AI is helping threat actors conduct attacks with greater speed, scale and sophistication. It has also highlighted concerns about agentic AI systems that could automate significant stages of cyberattacks.
Businesses therefore need to move beyond relying on employees to spot suspicious messages. Payment requests, changes to supplier bank details and demands for confidential information should be verified through a separate, trusted channel.
Companies adopting AI internally should also review what information their tools can access and whether automated systems are permitted to take consequential actions. AI can improve productivity, but poorly controlled access to business data may create additional security risks.
Data Protection Is Becoming a Question of Customer Trust
Customer information is central to modern business. Banks process financial records, retailers collect purchasing data, healthcare providers handle sensitive medical information, and digital platforms maintain account details.
The more information a company collects, the greater its responsibility to protect it.
Singapore’s Personal Data Protection Act (PDPA) establishes requirements for organisations handling personal data. Businesses must make reasonable security arrangements to protect personal data in their possession or under their control and comply with applicable data breach notification obligations.
Under the PDPA, when an organisation assesses a breach as notifiable, it must notify the Personal Data Protection Commission as soon as practicable and no later than three calendar days after making that assessment. Affected individuals must also be notified in applicable cases, subject to the law’s conditions and exceptions.
This makes it important for companies to know what data they hold, where it is stored and who can access it.
Practical measures include restricting access to sensitive records, encrypting appropriate data, reviewing retention policies and monitoring unusual account activity. Organisations should also have a clear process for assessing suspected breaches and deciding when notifications are required.
Data protection should not be treated as a task reserved for the compliance department. It affects technology choices, customer service, marketing, human resources and relationships with external vendors.
When customers share their information with a business, they expect it to be handled responsibly. Strong data governance helps protect that relationship.
Cloud Services and Third-Party Vendors Can Create Hidden Risks
Cloud computing allows businesses to expand their operations without maintaining every application or server themselves. Companies can use external platforms for payments, payroll, customer management, data storage and communications.
However, outsourcing a service does not automatically remove the security risk.
A business may have strong internal controls but still be affected by a supplier with weak security practices. A compromised vendor account, an exposed cloud database or a vulnerability in widely used software can potentially affect several connected organisations.
For companies operating across borders, the challenge can be more complex because data and services may involve multiple providers and jurisdictions.
Businesses should evaluate important vendors before signing contracts and review their security arrangements periodically. They should understand how providers protect information, manage access, handle incidents and communicate potential disruptions.
Keeping an inventory of critical systems and suppliers can also help companies identify dependencies and determine which services need to be restored first during an incident.
For SMEs, a risk-based approach is often the most practical. Protecting essential systems and the information that matters most is a better starting point than attempting to manage every possible threat at once.
Ransomware Can Disrupt More Than IT Systems
Ransomware remains a serious concern because it can prevent businesses from accessing essential files and applications. An incident may disrupt customer services, delay payments, interrupt orders and create significant recovery costs.
The CSA’s latest cybersecurity health report identified ransomware as the most commonly reported type of cyber incident among the organisations surveyed.
Businesses can reduce their exposure by keeping software updated, enabling multi-factor authentication and limiting administrator privileges. Connected devices should also be configured securely rather than left with default passwords.
Backups are another essential part of business continuity. Companies should maintain protected copies of important information and regularly test whether those backups can be restored. If backups are accessible through the same compromised accounts as ordinary systems, they may also be at risk.
A response plan should establish who will isolate affected systems, contact technical support, assess the incident and communicate with customers or other relevant parties.
No security programme can guarantee that an attack will never occur. But organisations that prepare in advance can often respond in a more controlled manner and reduce the disruption.
Why SMEs Need a Practical Cybersecurity Strategy
Cybersecurity can feel expensive for small and medium-sized enterprises. Many operate without dedicated security teams and must balance technology spending against hiring, marketing and other business needs.
The latest CSA findings show why practical support matters. The report found that adoption of essential cybersecurity measures varied from 71% to 80% across five categories. Software and system updates had the highest reported adoption, while asset management and protection measures had the lowest.
These gaps suggest that businesses may benefit from strengthening basic safeguards before investing in more complex tools.
Useful starting points include:
-
Enabling multi-factor authentication for business accounts.
-
Updating operating systems, applications and connected devices.
-
Removing access rights that employees no longer need.
-
Training staff to verify unusual payment requests and report suspicious activity.
-
Maintaining secure, tested backups.
-
Reviewing the security practices of important technology providers.
Singapore’s SG Cyber Safe Programme offers resources to help enterprises strengthen their cybersecurity practices. The CSA also encourages organisations to use its Cyber Essentials framework as a baseline for improving cyber protection.
The agency announced a new Cyber Incident Helpline on 14 October 2026 to provide organisations with initial incident triage, advisory support and referrals to relevant service providers.
For SMEs, knowing where to seek help can be just as important as knowing which security measures to implement.
Cybersecurity Is Becoming Part of Business Competitiveness
Cybersecurity is increasingly relevant to commercial relationships, not just internal IT management.
A company seeking a large corporate customer may be asked about its security controls, data handling practices and incident response arrangements. Businesses processing payments or managing confidential information may also need to demonstrate that they can protect systems and meet relevant contractual and regulatory requirements.
For technology providers and fintech companies, security can influence whether customers are comfortable using a service. For smaller suppliers, stronger cyber practices can help build confidence when competing for business with larger organisations.
This does not mean that every company needs the same level of investment. The right approach depends on the sensitivity of the data involved, the importance of the systems and the potential consequences of a breach.
What matters is being able to explain the risks, demonstrate appropriate safeguards and respond responsibly when an incident occurs.
Building a More Resilient Digital Economy
Singapore’s digital economy will continue to create opportunities as businesses adopt AI, expand cloud services and develop new digital products. But the latest cybersecurity findings show that the risks are already widespread, and essential security measures are not being adopted consistently.
For businesses, the priority is to make cybersecurity part of everyday operations. This means protecting sensitive data, securing accounts, reviewing external providers and preparing for incidents before they happen.
AI can support better monitoring and faster analysis, but it must be introduced with clear access controls and human oversight. Similarly, compliance with data protection requirements should be supported by practical systems and clear responsibilities across the organisation.
The most resilient businesses will not necessarily be those with the largest cybersecurity budgets. They will be those that understand their exposure, prioritise the right safeguards and respond quickly when something goes wrong.
In Singapore’s increasingly digital economy, cybersecurity is no longer simply about protecting computers. It is about protecting customer trust, business continuity and the ability to grow with confidence.
