Keynote Address by Ms Gwenda Fong, Commissioner of Cybersecurity and Chief Executive, CSA, at CyberSG Innovation Day 2026, 10 Nov 2026

MOS Rahayu,

Distinguished guests,

Friends from industry, academia and the investment community,

Colleagues,

Good afternoon, everyone.

Introduction

1.                     MOS Rahayu has just spoken about Singapore's ambition to build a vibrant cybersecurity innovation ecosystem. I would like to build on that from the perspective of CSA's mission to defend Singapore's cyberspace.

2.                     At the Singapore International Cyber Week just last month, I made the point that no one sees the whole picture of the cyber threat landscape. Governments, infrastructure operators and technology companies each see different parts of it. We only get a fuller picture when we bring those perspectives together.

3.                     I believe the same principle applies to building our cyber defences. No single organisation has all the expertise, technologies or capabilities we need. Therefore it is imperative that we bring the right people together to develop capabilities that work, that we can adapt, and that we can depend on when it matters.

Building Capabilities Singapore Can Depend On

4.                     As MOS Rahayu has highlighted, cybersecurity is fundamental to Singapore’s digital future. From CSA’s perspective, one of our most important responsibilities is ensuring that the critical systems and the services Singapore depends on remain secure and resilient, even as our cyber threats grow more sophisticated, with AI changing the speed and scale at which cyberattacks can be carried out.

5.                     What this means we cannot solely rely on deploying today's solutions. We must also have the expertise to understand how they work, to adapt them to our operational needs, and to develop new approaches when existing solutions are insufficient.

6.                     This is particularly important for capabilities that are critical to our national security. In a world of increasing geopolitical uncertainty and shifting supply chains, resilience depends not just on having access to technology, but also on having the expertise, partnerships and operational capacity to use and sustain it.

7.                     Our approach must therefore be a pragmatic one. We will continue to draw on the best technologies and expertise from around the world, while deliberately deepening the capabilities that Singapore needs to protect its most critical systems.

8.                     For us, innovation is not an end in itself. What matters is whether we can turn innovation into capabilities that we can rely on — capabilities that are effective, adaptable and available when we need them most.

Turning Shared Challenges into Operational Solutions

9.                     So the question we must ask ourselves is: How do we build such capabilities? I believe we must start with the problems we need to solve.

10.                One of CSA's responsibilities is to understand where our most significant cybersecurity challenges lie — not just within individual organisations, but across our critical sectors. This gives us an opportunity to work with infrastructure operators and industry partners to identify problems where new capabilities are needed, and bring the researchers and the companies together to tackle them.

11.                CyberCall is one way we are doing this. Rather than starting with a technology and looking for a use case, we start with an operational problem and invite innovators to develop solutions. By involving end-users from the outset, we improve the chances of developing capabilities that work in practice and can be deployed.

12.                One example is a project by ST Engineering D'Crypt under CyberCall last year, 2025. It is developing a quantum-safe encryption solution that combines quantum key distribution with post-quantum cryptography to strengthen the protection of critical information infrastructure.

13.                The significance is not simply the technology itself. It is that we are developing new approaches now, so that critical infrastructure operators can better understand the solutions available to them as they prepare for the transition to quantum-safe systems.

14.                We want to see more of such collaborations — connecting the right expertise to difficult operational challenges, and developing capabilities that users can trust and deploy. This is what our partnerships with the CyberSG R&D Programme Office and the CyberSG Talent, Innovation and Growth Centre are intended to support.

Deepening Partnerships and Capabilities in Singapore

15.                Beyond individual projects, we also want to create an environment where these partnerships and capabilities can take root and grow.

16.                We welcome international cybersecurity companies that see Singapore as more than a market or regional headquarters. We want them to build substantive capabilities here, work with our local partners, and contribute to the expertise and talent in our ecosystem.

17.                One example is VulnCheck, a US-based vulnerability intelligence company that participated in the TIG Centre's CyberBoost programme. Through the programme, it gained mentorship, industry connections and support for its growth.

18.                VulnCheck has since incorporated in Singapore and is growing its local team, including engineering talent, to support its regional operations. This is the kind of partnership we want — one that brings international expertise into Singapore, builds local capabilities and creates opportunities for collaboration.

Making Cybersecurity Solutions More Accessible

19.                Building a strong ecosystem is not just about developing new solutions. It is also about making sure that organisations can find and use the capabilities that already exist.

20.                A company may have developed an effective solution, but potential users may not know that it exists. Equally, an organisation facing a cybersecurity challenge may not know where to find the right expertise or support.

21.                This is a gap that we hope to narrow with CyberSG Atlas. I am pleased to announce that the CyberSG TIG Centre will be relaunching its cybersecurity solutions catalogue as CyberSG Atlas.

22.                With clearer categorisation based on the NIST Cybersecurity Framework and a new AI-powered chatbot, Atlas will make it easier for businesses to discover cybersecurity solutions and find relevant guidance. For example, a business that has experienced a cyber incident can use the chatbot to find information on reporting channels and potentially relevant solutions.

23.                I encourage more cybersecurity companies to join CyberSG Atlas. The more solutions that we can bring onto the platform, the easier it becomes for organisations to discover relevant capabilities, and for cybersecurity companies to connect with potential customers and partners.

Moving at the Pace of Change

24.                There is one more challenge we must address, and that is the pace at which we turn innovation into operational capabilities.

25.                Technology is advancing rapidly, and traditional development cycles may not always be fast enough. So we need to shorten the time from identifying a problem to testing a solution, and from testing to deployment — without compromising security and reliability.

26.                Take agentic AI. As AI agents gain access to data, applications and tools, we need practical ways to test, to monitor and to secure their actions. CSA's Securing Agentic AI Addendum, which we developed with industry and international partners, provided a starting point. But guidance alone is not enough. We need to translate it quickly into tools and capabilities that organisations can deploy.

27.                Other challenges require us to take a longer view. The transition to quantum-safe systems, for example, will take several years. We need to start early, build expertise, test different approaches and work closely with critical infrastructure operators to ensure solutions can be introduced safely.

28.                These are different challenges with different timescales – AI and quantum – but the lesson is the same. We need to anticipate what is coming, to bring the right partners together early, and to move with the urgency that each challenge demands.

Conclusion

29.                The challenges ahead are complex, and no single organisation has all the answers. But I believe that Singapore has an important strength, and that is our ability to bring together Government, industry, researchers and practitioners to tackle problems that matter. I was quite heartened when our emcee earlier asked each of us to raise our hands, and you see the diversity of different perspectives in the room. That is indeed the strength of a forum like this.

30.                So let me conclude with a simple invitation to everyone here.

31.                Bring us your hardest cybersecurity problems. And to our innovators, bring us your boldest ideas. And work with us to turn those ideas into capabilities that make a real difference for us.

32.                Because ultimately, the strength of our cybersecurity ecosystem will really just be measured by the capabilities that we can depend on to keep Singapore secure.

33.                Thank you, and I wish everyone a productive CyberSG Innovation Day.