AI cyberattacks mean we can't defend ourselves the same way as before: Singapore's founding cybersecurity chief

Artificial intelligence is fundamentally altering the landscape of cybersecurity, making defense more challenging than ever before, according to David Koh, Singapore's founding chief executive of the Cyber Security Agency (CSA).

Koh, who recently retired after 11 years leading the CSA, described the shift in an exclusive interview. He noted that most cyberattacks currently stem from human error, carelessness, or social engineering, rather than advanced technical sophistication. However, he cautioned that Singapore has not yet faced an AI-enabled cyberattack, but the potential impact requires serious consideration.

“

With artificial intelligence, it fundamentally changes the parameters of this “cat-and-mouse game”.

Traditionally, cyberattacks require significant human ingenuity, imagination, and technical skill to exploit vulnerabilities. The limited availability of these skillsets naturally constrained the scale of damage. AI, however, can automate the process of identifying and linking together weaknesses in systems, a capability that could reduce attack construction time from weeks or days to mere hours or minutes.

This automation amplifies the speed and scale of potential attacks. Furthermore, AI could erode the effectiveness of "security by obscurity," a tactic that relies on keeping system details secret to deter attackers. By streamlining the creation of cyber threats, AI may lower the barrier to entry for malicious actors, posing a significant new challenge to national security and economic stability.

“

All of this is held together by a handful of people with the skillsets to do this. Skillsets are rare, hard to come by. So consequently, the amount of damage that these people can do is limited by how hard they work.