Only 2% of Singapore firms ready for frontier AI cyberattacks

Two in 5 say significant changes are needed to prepare for such attacks.

Only 2% of Singapore organisations are confident in their ability to withstand cyberattacks accelerated by frontier artificial intelligence (AI) models, according to Cohesity’s fifth annual Global Cyber Resilience Report.

The report found that 40% of Singapore organisations believe significant changes are needed to prepare for such attacks, compared with 32% globally.

Readiness gaps are also present in existing cyber resilience strategies. Whilst 99% of Singapore organisations have a cyber resilience strategy, 60% said their strategy still requires improvement, including 12% who said significant improvement is needed.

Amongst organisations that experienced a cyberattack in the past 12 months, 93% said their recovery plans would likely require workarounds or improvisation during an attack.

Sixty-three percent took longer to recover than their target, by around six hours on average.

The impact also extended beyond initial assessments. Seventy-two percent said more systems were affected than initially identified.

The most common gaps in response and recovery plans involved skills and knowledge, cited by 73% of respondents, followed by identity and access management tools such as Okta at 71%, and AI models, pipelines, and workflow tools at 69%.

Amongst those that experienced a material cyberattack in the past year, 68% reported moderate or significant delays because they lacked confidence that restored data and systems were clean and safe to use. Another 67% experienced identity or access issues after systems were restored.

Recovery planning also struggled to account for dependencies between systems. On average, 71% of organisations reported moderate or significant gaps in how their plans accounted for dependencies across cloud infrastructure, SaaS applications, identity services, security tooling, third-party integrations, and AI systems.

The report also examined the use of a Minimum Viable Company (MVC), defined as the smallest version of a business that can continue serving customers while wider recovery is underway.

Only 15% of Singapore organisations said they have a formally documented and tested MVC. Another 19% have a formally documented MVC that has not been tested, whilst 30% rely on an informal or partially documented MVC.

Amongst organisations with an MVC, 41% said it directly determined which operations were prioritised and restored first.

Although 99% of Singapore organisations use AI systems, applications, workflows, or machine learning models, only 44% said their cyber response and recovery plans comprehensively account for attacks targeting these systems.

More than half also reported gaps in handling AI-related incidents. Fifty-five percent said they were not well prepared to detect, contain, and recover from unintended or incorrect actions by AI agents, copilots, or workflows.

Meanwhile, 51% said they were not very confident in their ability to verify the integrity of AI models and related data following a cyberattack.