More than half (56%) of organisations In Singapore said that they have encountered AI-powered cyber threats in the past year.
These threats are scaling fast, with a 2X increase reported by 52% and a 3X increase by 42% of organisations.
Working with Fortinet, IDC surveyed 550 IT and security leaders across 11 Asia-Pacific markets between February and April 2025.
Respondents represented organisations with over 250 employees and were directly involved in cybersecurity decision-making. They were based in Australia, India, Indonesia, Malaysia, Singapore, South Korea, Thailand, the Philippines, Vietnam, Hong Kong, and New Zealand.
In Singapore, the top AI-driven threats reported include deepfake impersonation in business email compromise (BEC), automated reconnaissance of attack surfaces, polymorphic malware, adversarial AI and data poisoning, and AI-automated exploit development targeting zero-day vulnerabilities.
Despite the rise in AI-driven attacks, only 18% of organisations say they are very confident in their ability to defend against them.
Meanwhile, 32% acknowledge that AI threats are outpacing their detection capabilities, and one in twenty organisations in Singapore have no ability to track AI-powered threats at all—exposing a significant preparedness gap.
The most reported threats include software supply chain attacks (74%), ransomware (70%), phishing (64%), cloud vulnerabilities (52%), and insider threats (46%).
Topping the list of disruptive threats are unpatched and zero-day exploits, followed closely by insider threats, cloud misconfigurations, software supply chain attacks, and human error. These quieter, more complex risks are now viewed as more dangerous than well-known threats like ransomware or phishing.
Traditional threats such as phishing and malware are still growing at a rate of about 10%, but this is comparatively modest.
In contrast, the fastest-rising threats include ransomware (28%), Supply Chain attacks and cloud vulnerabilities (18% each); IoT/OT attacks (17%), and insider threats (16.0%).
The consequences are no longer limited to downtime. The top business impacts of cyberattacks include loss of customer trust (72%), regulatory penalties (66%); data theft and privacy violations (48%), and operational disruption (42%).
Financial damage is also real: 52% of respondents experienced breaches that resulted in monetary loss, with one in three costing over US$500,000.
Security teams in Singapore continue to face significant resource constraints. On average, just 7% of an organisation’s workforce is dedicated to internal IT, and only 13% of that subset is focused on cybersecurity.
The top challenges reported include overwhelming threat volume (53.6%), difficulty in retaining skilled cybersecurity talent (53.5%), and tool complexity (44.5%)—leading to burnout and fragmentation within cyber teams.
Despite increased awareness, cybersecurity investment remains disproportionately low. On average, just 15% of IT budgets are allocated to cybersecurity, representing just over 1% of total revenue—a small fraction given the scale and severity of threats.
However, Budgets are ticking up, with nearly 86% of organisations in Singapore reporting an increase. However, most of these increases remain under 10%, suggesting that investment is still cautious.
Organisations are increasingly shifting from infrastructure-heavy spending to more strategic investments. The top five priorities include identity security, network security, SASE/Zero Trust, cyber resilience, and cloud-native application protection—indicating a shift toward access-centric, risk-based security planning.
