Opening Address by SMS Tan Kiat How at the Singapore International Cyber Week Workforce Development Panel on 13 October 2026

Distinguished Speakers

Ladies and gentlemen

1. Good afternoon. I am very happy to join all of you here today in person, speaking on a very interesting topic today on workforce development with distinguished speakers from around the world, sharing different perspectives with us.

2. If you have worked in cybersecurity for some time, you will know that this job has never stood still. The technologies change. The threats change. And each time, our cyber professionals have had to learn, adapt and stay ahead.

People at the Heart of Cyber Defence

3. Recent industry research provides part of the answer. CSA’s workforce study found that eight in ten respondents said their organisations were using AI-enabled cyber defence tools. Seven in ten rated human judgement and problem-solving skills as essential to using AI effectively in cybersecurity.

4. This points to an important shift. AI does not make our people less important. It changes the capabilities we need from them. As AI takes on more tasks, cyber professionals will increasingly need to direct these tools, interpret their outputs, validate their conclusions, understand the operational context, and exercise judgement over the decisions that follow.

5. AI fluency will become an important part of cybersecurity competence. But AI fluency is not the same as cybersecurity expertise. AI can generate an answer quickly. Knowing whether it is the right answer still requires deep professional knowledge.

6. We should therefore be careful about how we think about automation. As AI takes on more routine work, we should also preserve the opportunities through which people build experience and judgement.

7. In other words, we should automate the task, not the learning. We often optimise the workflow for efficiency, and that is a benefit for using technology to remove friction in our work.

8. When I speak to my colleagues in the professional specialisation in medicine in the health ministry, we often try to differentiate two things: is it meaningless friction or meaningful friction? For example, meaningless friction is administrative work, where we can optimise the workflow. But there are also meaningful frictions, where a person learns through the task. Hence, we have to think more about automating the task, not the learning.

9. That is all the more important for professionals in the cybersecurity field, where they have to build expertise, the knowledge, and the instincts to make the right call, especially when a call is consequential. This means that the call has a real-life impact on the organisation and on the people they serve. The ability to make those calls correctly requires experience, expertise and judgement.

10. Some of that experience comes from hard knocks, making mistakes, learning from mistakes, and making sure we don’t repeat them. So, if you automate the task and learning, how do junior professionals make those mistakes in a safe environment and learn from them? This is an important way of thinking as workforce development, skills and competencies move forward.

11. Certainly, we should use AI, automate, but at the same time, be thoughtful about it and how we make sure that professionals continue to have the right competencies, skills sets, and most importantly, ethics.

Building a Strong and Credible Profession

12. If the work is changing, the profession must evolve with it. Our people need greater clarity about the capabilities they should develop. Employers need a clearer understanding of what good looks like. And training providers need to know what industry will need next.

13. That is why CSA is working with IMDA and the Skills and Workforce Development Agency to develop a National Competency Framework for Cybersecurity. The framework will define competency standards for cybersecurity roles, including the use of AI, and bring together existing competency frameworks for ICT and operational technology systems.

14. But defining standards is only the first step. As cybersecurity becomes increasingly important to our economy and national security, employers need confidence that the professionals entrusted with protecting important systems have demonstrated the necessary knowledge, skills, experience and ethics.

15. This is also important for our professionals. A clear and credible framework can help people understand how to enter the profession, deepen their expertise and progress over time.

16. Last year, I spoke in the same forum at SICW, and shared that CSA concluded a study on whether Singapore was ready for a national accreditation framework for cybersecurity professionals. About two-thirds of stakeholders agreed that Singapore was ready to move in this direction.

17. [Announcement] Today, I am pleased to announce that Singapore will establish a Cybersecurity Professional Accreditation Framework.

18. The framework will provide a structured way to validate and recognise the knowledge, skills and experience of our cyber professionals. It will establish a common basis for demonstrating professional capability, while supporting clearer career pathways and continual development.

19. We will take a measured approach. The Cybersecurity Professional Office, established in collaboration with the Association of Information Security Professionals, will work with the cybersecurity community to develop and implement the framework. We will take the coming months to work through the details and aim to launch a pilot in the second quarter of 2027.

20. The pilot will begin with voluntary accreditation in selected specialisations and participating organisations. This will allow us to learn from practitioners and employers, refine the framework, and progressively expand it.

21. We are not trying to create another layer of certificates. We want to build a framework that gives employers greater confidence, gives professionals greater recognition, and gives the profession a stronger common standard.

Helping our People Grow

22. Professionalisation cannot only be about what we expect from our people. It must also be about what we invest in them.

23. We want a profession where people can keep learning and progressing throughout their careers. That means building pathways at every stage — from entering the profession, to developing deeper technical expertise, to taking on leadership responsibilities.

24. For young people entering the field, we need opportunities to apply what they have learnt and develop practical skills. Earlier today, CSA and Trend Micro signed a Memorandum of Collaboration to organise the Singapore Cyber Conquest, our national Capture-the-Flag competition, at SICW for the next three years.

25. For those already in the profession, there are continuing education and training opportunities supported through national initiatives such as SkillsFuture. CSA works with industry and training partners to develop technical and leadership programmes for practitioners, CISOs and leaders.

26. And for senior leaders, the challenge is increasingly to understand not just the technical aspects of cybersecurity, but how technology, AI and organisational risk interact. Strong cyber leadership requires the ability to make informed trade-offs, build resilient organisations and lead through uncertainty.

27. Some professionals shared with me that senior cybersecurity professionals need to have a different kind of fluency apart from AI and cybersecurity technical fluencies. They need the fluency to be able to speak to management boards and important stakeholders like policymakers and regulators. This is important as cybersecurity is no longer just a backbone function, but it impacts organisations, businesses, governments, essential services, society and economies. So, senior leaders in cybersecurity roles need to be able to traverse the entire spectrum, being able to speak technical jargon with their colleagues, but also to the board, management and leadership teams in different organisations. We want to create an environment in which we can nurture and grow such leaders in the cybersecurity profession.

28. These are the pathways we want to build in Singapore: where young people can enter the profession with confidence, knowing that there are pathways we are building for them, and that they are able to have exciting roles, opportunities, build up their skill sets, practical knowledge, experience, and confidence that they can do well in this profession.

29. Experienced professionals should be able to continue deepening their expertise as this field is not static. They should have different pathways to build good careers in this field, continue developing their skill sets, and grow into leaders who can develop the judgement needed to guide their organisations.

30. We want to build these pathways in Singapore for those entering the workforce in cybersecurity, for those experienced professionals, and for those who want to take on greater leadership and senior roles.

Conclusion

31. The cybersecurity profession will continue to change, and I believe it is an exciting one. It is an important one. It is important for society, the country, and the global community. Increasingly, it is no longer just a backbone function, but is the front and centre of many organisations. The answer is not to hold it still. Our job is to make sure that as the technology changes, our people continue to learn, adapt and grow with it.

32. AI will transform many cybersecurity tasks. It will also raise the premium on expertise, judgement and responsibility.

33. That is why our focus must be broader than training people to use the latest tools. We must build professionals who understand technology, know its limits, and can exercise sound judgement over how it is used.

34. If we do that, we will not only strengthen Singapore’s cyber defences. We will build a cybersecurity profession that is trusted, resilient and ready for the next generation of threats.

35. And that is ultimately what professionalisation is about: giving our people the skills, pathways and recognition to keep Singapore secure as technology evolves. We hope to work with like-minded partners on this very important role of professionalising our cybersecurity community.

36. Thank you very much.