Singapore's 2026 Cybersecurity Strategy Puts Zero Trust and AI Security at Centre
Singapore launched its Cybersecurity Strategy 2026 at Singapore International Cyber Week, with a focus on more proactive defence and reducing exposure to cyber threats. Zscaler, which says it was formally acknowledged in the document, argues that AI makes the shift to Zero Trust more urgent.
- Singapore launched its Cybersecurity Strategy 2026 at the 11th Singapore International Cyber Week, held 12-15 October.
- Senior Minister K Shanmugam called for more proactive cyber defence at national scale.
- IMDA's report says nearly one in four Singapore businesses adopted AI in 2025, and the digital economy reached S144.1 billion.
- Zscaler says it was formally acknowledged in the strategy and argues for extending Zero Trust beyond government systems.
- Singapore chairs ASEAN in 2027, which Zscaler sees as a chance to share its approach regionally.
Strategy launched at the 11th SICW
Singapore International Cyber Week (SICW) ran from 12-15 October and reached its 11th edition. According to Adam Dobell, Head of Government Affairs, APJ at Zscaler, ministers, senior officials, industry leaders and cybersecurity experts from across the globe attended. He credits the Cyber Security Agency of Singapore (CSA) with building the event into one of the world's most important cybersecurity gatherings.
The 2026 event was the first since David Koh left his post as CSA's founding Chief Executive after more than a decade of leadership. Gwenda Fong is now Chief Executive. Dobell describes the transition as seamless and says it allowed for strategic consistency. The launch of Singapore's Cybersecurity Strategy 2026 took place against that backdrop of a rapidly changing cyber landscape.
In his opening address, Senior Minister K Shanmugam said Singapore must move towards more proactive cyber defence, acting earlier, at national scale and at the speed of emerging threats.
Why AI raises the stakes for Zero Trust
Zscaler frames AI as posing two separate security challenges: protecting systems against increasingly capable AI-enabled attacks, and making sure AI systems themselves operate securely.
The post cites IMDA's Singapore Digital Economy Report 2026, released on 5 October. According to that report, nearly one in four businesses in Singapore adopted AI in 2025, and the country's digital economy reached S144.1 billion. Zscaler uses these figures to argue that secure-by-design architectures are now essential as AI adoption becomes core to economic growth.
Dobell says the strategy is right to stress upstream protection and lower exposure to cyber threats and their consequences. In his view, finding and patching vulnerabilities faster will no longer be sufficient. Organisations also need to systematically reduce the opportunities available to attackers and govern AI effectively and securely. He lists three practical steps:
- removing unnecessary internet-facing exposure
- limiting access to applications and data to only authorised users and agents
- preventing a compromise in one part of an organisation from leading to access across all segments of technology and business processes
Zscaler describes these as the fundamental principles of Zero Trust.
Government experience and the road to implementation
Zscaler points to GovTech's Government Zero Trust Architecture (GovZTA) as evidence that Singapore already practises what it recommends. According to the post, the approach challenges traditional assumptions about network trust and puts more emphasis on controlling access and limiting the consequences of a compromise. Dobell sees an opportunity to extend these principles to a greater extent into Singapore's critical infrastructure and wider economy.
Zscaler says it contributed to the strategy through its engagement and partnership with CSA before publication, and that it was formally acknowledged in the final document. The company now describes implementation as the main challenge: turning the strategy's ambitions into security architecture and capabilities that reduce exposure, contain compromise and strengthen resilience across government, critical infrastructure and the wider economy.
What it means for the region
Singapore is set to chair ASEAN in 2027. Zscaler argues that the country's Zero Trust experience and its new national strategy could offer valuable lessons to governments across Southeast Asia that want to speed up digital transformation securely.
For organisations in Singapore, the post signals that the national direction favours reducing attack surface and tightly controlled access over faster patching alone. Zscaler says it is committed to supporting the strategy's implementation, naming Zero Trust architecture, reduced exposure, containment of compromise and secure AI adoption as central to Singapore's cyber resilience. These are the views of a vendor with a commercial interest in the field, and the post does not give details of specific measures in the strategy itself.
