Will the step forward in frontier AI mean a step backward in cybersecurity?

ON APR 15, Singapore’s Cyber Security Agency (CSA) issued an advisory warning that frontier artificial intelligence models can reduce the time required to identify vulnerabilities and engineer exploits – from months to hours.

The emergence of these models is a cause for concern for all organisations. The potential to identify vulnerabilities in code will result in increased volume and speed of attacks on IT infrastructure.

According to a recent VulnCheck study, 28.73 per cent of zero-day exploits – vulnerabilities unknown to developers and defenders – happen within 24 hours. Frontier AI models could potentially worsen the situation for defenders.

For the security team, a new threat vector is business as usual. But as cybersecurity impacts the wider organisation via customer and user trust, reputation and finances, it is now a strategic, board-level priority.

Regulatory bodies, such as the Monetary Authority of Singapore (MAS) in the financial sector, have developed guidelines for AI risk management for the responsible use of the technology, and organisations will need to comply.

But compliance is a floor, not a ceiling. This moment calls for a more fundamental shift in how boards think about cybersecurity – from a recovery mindset to “antifragility”, a concept where systems improve and thrive despite disruption.

Where security operations once prioritised recovery, a complete 180-degree pivot to a proactive approach is now needed. This can be done across three phases.

The first horizon: stemming the tide

In the immediate term, the operational basics need to be treated as genuine priorities. This means reviewing the organisation’s IT infrastructure and approach to risks.

Each development environment should be evaluated on whether they need to be Internet-facing or should be disconnected. For those that remain Internet-facing, review security configurations, ensure access controls are in place, and patch any critical vulnerabilities.

Organisations will also need to start managing risks proactively.

An example is balancing downtime and security. Security configuration typically involves some downtime, or disruption of certain services to users in order to roll out patches and reconfigure parameters. Today, organisations should set aside an hour of downtime rather than risk a security breach and its repercussions.

The second horizon: security by design

The next phase, in terms of weeks, involves adopting a security-by-design approach.

Innovation comes with increased risks, with new programmes and applications connecting to an organisation’s data. Security by design helps prevent the risks that arise as IT infrastructure grows.

Apart from employees, business tools such as large language models and human resource management platforms require connections to proprietary organisational data to deliver results.

Concepts like least privilege (which ensures that only the bare minimum permissions are granted to complete a task) or zero trust (which requires strict authentication to access resources) will limit the impact of any incursion through compromised employee accounts or applications.

Multi-factor authentication prompts and frequent account logouts may be required, so the board should ensure that every employee understands the importance of these extra steps.

Organisations can also use “canaries” – unused credentials with limited access that are made public to attract bad actors. These act as tripwires: once accessed externally, a security team can monitor the behaviour of bad actors in a controlled environment to pre-empt actual threats.

The third horizon: future-proofing with AI

Looking ahead in terms of months and years, the final horizon involves how organisations fundamentally change their approach to risk, going beyond tools.

As a chief information security officer, I have seen how cybersecurity tabletop exercises develop over time.

Years ago, security teams would plan scenarios where they would react to prevent a breach. More recently, the scenario would assume that a breach has happened.

Today, the team would assume that a breach has happened and data is already exfiltrated.

Frontier AI models can help organisations with security. Today, most digitally mature organisations use AI agents to parse data and run playbooks, filtering security alerts to identify those that matter.

New developments in AI can help analyse and predict emerging attack surfaces alongside innovation, and better secure vulnerable points where data transitions from one silo to another.

The increased capabilities of frontier models also mean that organisations can get a bird's-eye view of their security posture.

By providing such applications with data from logs, assets and configuration from different parts of the organisation, a security team can identify the weak spots of an organisation’s defences as their IT infrastructure develops in real time.

With the growing speed at which security events unfold, organisations will need to get used to automation doing the bulk of time-sensitive incident response and management, while human security specialists assume roles that manage architecture, upkeep and the impact of defence systems.

Act with urgency, not panic

Singapore is a lucrative target. As a regional business hub, a world-class financial centre and one of Asia’s leading data centre capitals, Singapore’s digital infrastructure concentrates enormous economic and strategic value in a small geography.

According to Check Point Research in March 2026, cyberattacks on organisations in Singapore rose 22 per cent year on year.

The recent CSA advisory and Singapore’s launch of the world’s first Model AI Governance Framework for Agentic AI demonstrate that government agencies are tracking these developments in real time and adapting.

But cybersecurity is now a space that can change overnight with ongoing technological developments. Organisations must leverage all available resources, from people to data, to strengthen their security posture.

AI is evolving – for better and worse. Tools to respond exist. Regulatory guidance is in place. The business impact is clear. The question is whether Singapore’s boardrooms will treat this as a strategic priority before an incident forces their hand.

The writer is chief information security officer at Elastic