Opening Remarks by Senior Minister of State Tan Kiat How at ISC2 Cyber Secure Singapore 2026 on 15 October 2026

Building Digital Trust Together in an Era of Uncertainty

1. Mr Eric Wong, President of ISC2 Singapore Chapter, distinguished guests, ladies and gentlemen.

2. Good morning. It is a pleasure to join you at Cyber Secure Singapore 2026. For the past 14 years, the ISC2 Singapore Chapter has brought our cyber professionals together, supported their development, and helped uphold professional standards. Thank you for that continued commitment. The Singapore Chapter has grown from strength to strength and upheld the professionalism of this very important industry.

Cybersecurity is becoming a more consequential profession

3. Cybersecurity has always been a profession of continuous change. The technology changes. The threats change. And our professionals have had to adapt and evolve in the way they do things.

4. Not forgetting that AI is a very important technological trend and its advancement has been changing and disrupting many of the ways we do things. AI is now accelerating the change that cybersecurity professionals are facing. It is changing not only the systems we secure, but also how cybersecurity is done. AI is changing the nature of the economics of cyber threats arrayed against us. The speed, scale and sophistication of cybersecurity threats. With AI, all the more so in the future, autonomous agents are changing the work of cyber security professionals.

5. This makes the work of cyber professionals more consequential, not less. Your decisions can affect whether organisations continue to operate, whether essential services remain available, and whether people can trust the digital systems they rely on.

Expertise matters when there is no playbook

6. Just recently, a single operator used AI agents to automate more than 100 attack projects in a few days, compromising dozens of organisations and stealing more than 600,000 payment-card records in the wider campaign. The underlying techniques were familiar. What AI changed was the speed, scale and cost at which they could be applied.

7. Increasingly, there may be no ready-made playbook for everyone. A new attack may combine familiar techniques in unfamiliar ways. An AI system may behave in ways its developers did not anticipate. A vulnerability may be discovered and exploited faster than conventional processes were designed to handle.

8. In situations like these, what distinguishes a strong, competent, cyber professional is not simply what they know, but how they apply it: assessing risk, distinguishing signal from noise, communicating clearly, especially to internal stakeholders, and making sound decisions when the facts are incomplete.

9. AI can accelerate analysis. It cannot remove the need for professional judgement. Expertise is not just knowing the playbook. It is knowing what to do when the playbook no longer applies.

Cyber professionals must enable innovation securely

10. As the landscape becomes more uncertain, our response should not be to stand still. Cybersecurity should enable innovation, not stand in its way.

11. Our job is not simply to secure yesterday's technology. It is to help organisations adopt tomorrow's technology safely.

12. I spoke about AI and what Agentic AI can do – it can plan and act with greater autonomy. AI Coding Assistants can help developers work more efficiently, but they can also have deep access to source code, development environments, repositories and credentials. That creates new attack surfaces that cyber professionals need to understand and manage.

13. It is not just the external threats arrayed against organisations, where bad actors use AI and agents to try find vulnerabilities across our systems to gain access. Increasingly, our organisations are also deploying agents internally. These agents act autonomously and access privileged information, privileged credentials, source code, development environments, real data and workflows.

14. So we have to secure that as well, and it is the job of cybersecurity professionals to advise leadership and management and to do so responsibly.

15. CSA has been studying these risks through security assessments of AI Coding Assistants. Today, I am pleased to share that CSA is releasing a Handbook on the Secure Use of AI Coding Assistants. It translates our findings into practical guidance for practitioners and developers on how attacks could occur and what safeguards organisations can put in place.

Greater responsibility requires stronger professional standards

16. As the responsibilities of cyber professionals grow, so too must the standards of our profession.

17. A strong profession rests on three things: competence — applying knowledge effectively in practice; currency — continually updating our skills as technology and threats evolve; and professionalism — exercising sound judgement and taking responsibility for the decisions we make; there is an ethical dimension to it as well.

18. Employers need confidence that the professionals they rely on have the capabilities and experience to perform their roles well. Professionals also need a credible way to demonstrate what they can do, beyond qualifications and certifications alone.

19. Earlier this week at SICW, I announced that Singapore will introduce a Cybersecurity Professional Accreditation Framework. It will provide a structured way to validate and recognise the knowledge, skills and experience of our cyber professionals, with a focus on what practitioners can do in practice.

20. In this profession, your competency is measured not by how long one’s resume is or how many qualifications one has. Rather, by whether you can do the job. It is hard to tell whether one can do the job until one actually faces a situation and exercises judgement. We have to find a way of having this confidence and trust between the employers, organisations, and the larger society.

21. It is something that has to be done, especially with the rapidly changing environment that we are faced with, and it has to be done as swiftly as possible. We expect to pilot the framework from the second quarter of 2027.

22. We will build the framework with professional bodies like ISC2, employers and practitioners, test it through a pilot, learn from experience, refine it, and progressively expand it. We welcome the participation of ISC2 and other cybersecurity professionals. Please share your inputs and views. The framework is meant to benefit you as well.

23. We are not creating another certificate for people to collect. We want a framework that gives employers greater confidence, gives professionals a practical way of signalling skills and competence.

24. With that, over time, we want to bring the profession to the next level, with higher standards and recognition, giving professionals a sense of pride and an understanding that their work is important, one with consequence, and that their work is recognised by society at large.

Building a profession that keeps learning

25. Professionalisation is not only about accreditation. It is about creating the conditions for people to keep learning throughout their careers.

26. For those entering the profession, we need opportunities to gain practical experience and test their skills. For those already in the profession, we need pathways to deepen their expertise and keep their knowledge current. For senior professionals and leaders, we need the judgement to understand how cybersecurity, technology, AI and organisational risk come together.

27. Essentially, we want to create an environment and pathways for all cybersecurity professionals, regardless of which stage of career one is in – from fresh graduates or people entering the profession in their mid-career. There are pathways for you to pick up skills, experience, knowledge and expertise.

28. For those of you who are already seasoned professionals, continue to learn and upgrade your skills because the world, technology and the threats you deal with are changing rapidly. How do you continue to upgrade your skills, pick up new knowledge, become better cybersecurity professionals and mentor the younger ones?

29. For those in leadership or senior positions, whether in organisations hiring or using cybersecurity professionals, how can you take on leadership responsibilities and guide the younger ones in the profession as well? This is the ecosystem we are going to build here in Singapore: practical experiences, mentoring, professional communities and real-world experience to keep everyone current.

30. As AI automates more routine tasks, we should not remove the experiences through which people develop judgement. This is very important for professions like yours which relies on experienced judgement and instincts to know that something is not right and that you cannot always trust AI outputs in decision making.

31. So how do we automate the task and not the learning?

32. Today, we are looking at our own workflows, whether in operations centres, cybersecurity, threat hunting or forensics, and how we can use AI to automate them and make them more seamless and efficient.

33. But as we optimise our processes, we must understand what I call “meaningful friction”. We learn through experience, mistakes and guidance from seniors and mentors. While administrative overheads and bureaucratic processes should be automated away, meaningful friction should be retained, even if it makes processes slightly less efficient, because it allows young professionals to develop their skills, experience and judgement.

34. Otherwise, we risk losing an entire generation of young cybersecurity professionals who never learn to trust their judgement and instincts, or how to mentor the next generation.

35. Professional bodies therefore play an important role, not just in bringing cybersecurity professionals together to network, but also in maintaining high standards and fostering a culture of mentorship, especially among seasoned professionals.

The cyber professional of the future

36. The cybersecurity profession will continue to change. Our answer is not to hold it still. It is to make sure our people can keep learning, adapting, growing with the technology and be relevant and useful to organisations and society at large.

37. AI will transform many cybersecurity tasks. But it will also raise the premium on expertise, judgement and responsibility.

38. The cyber professional of the future will not be defined simply by how much they know, but by how they apply that knowledge — how they adapt, exercise judgement, enable innovation, and earn the trust placed in them.

39. That trust is at the heart of our profession.

40. If we can build a profession with these qualities, I am very confident that we will be better placed to navigate uncertainty — whatever technology or threat comes next.

41. We will not only strengthen Singapore's cyber defences. We will build a cybersecurity profession that is trusted, resilient and ready for future and continue to create exciting opportunities for people who want to join this sector.

42. Thank you, and I wish everyone a fruitful Cyber Secure Singapore 2026.