Cyber Security

Singapore is using AI to pen test 2,000 government systems. Should you?

Published
Read time3 min read
Cyber Security

Singapore has deployed in-house AI tooling to strengthen the security of around 2,000 government systems, including a tool from the Government Technology Agency that automates aspects of penetration testing by simulating attacker behaviour. The shift follows the UNC3886 campaign against Singaporean telecommunications operators, and it is an unusually clear-eyed response to a problem every large organisation has: expert testing does not scale to the size of the estate.

The problem being solved

In February 2026 the Cyber Security Agency and the Infocomm Media Development Authority disclosed that telecommunications companies in Singapore had been attacked by UNC3886, a suspected Chinese cyberespionage group first described by Mandiant in 2023 and characterised by the use of living-off-the-land techniques and zero-day exploits.

Singapore's response has included more frequent security testing and threat hunting. GovTech has described its initiative as using multi-agent architectures to scale penetration testing — addressing, in its words, the difficulty of applying conventional expert-led testing across thousands of government systems.

Key points
Scale
Around 2,000 government systems.
Approach
AI tooling that automates aspects of penetration testing, alongside expanded threat hunting.
Trigger
A persistent, capable adversary using zero-days and living-off-the-land techniques.

What automation genuinely fixes

The honest case for this is coverage. Most organisations test a small fraction of what they run, usually the systems that a framework requires or that someone recently worried about. Everything else is tested by whoever finds it first. Automation changes the economics of the long tail: the internal tool nobody has looked at since 2022 can now be examined without a scoping call and a purchase order.

It also changes frequency. A control that is tested annually is a control you know something about for one day a year. Continuous or frequent testing turns security posture into something closer to a live signal, which is the same argument that drives continuous compliance monitoring.

What it does not fix

Two things, and being clear about them is what separates a serious programme from a marketing claim.

Business logic. Automated testing is good at classes of flaw with recognisable shapes — injection, misconfiguration, weak authentication, known CVEs. It is poor at understanding that a particular user should not be able to approve their own refund, or that an identifier in a URL exposes another customer's record. Those depend on knowing what the application is for.

Chained, creative attack paths. Real intrusions are usually a sequence of individually unremarkable weaknesses. A skilled tester notices that a low-severity information leak makes a medium-severity flaw exploitable. Automation tends to report both findings separately, at their individual severities, and miss the path.

UNC3886's own tradecraft makes the point: living-off-the-land techniques are, by design, indistinguishable from legitimate administration to a tool looking for signatures of badness.

The sensible shape for most organisations

Not a choice between the two, but a division of labour:

  • Automate breadth. Continuous discovery of exposed assets, known vulnerabilities and misconfiguration across the whole estate, so nothing goes unexamined for years.
  • Reserve people for depth. Expert testing focused on the applications that carry the money, the sensitive data and the regulatory exposure, with time to chase business logic and chain findings.
  • Feed one into the other. Automated coverage should tell you where the human effort is best spent, rather than being an alternative to it.
  • Test that you would notice. Singapore paired testing with threat hunting for a reason. Against an adversary using legitimate tools, detection matters more than vulnerability counts.

There is also a compliance dividend. Frameworks including PCI DSS, ISO 27001 and SOC 2 increasingly expect evidence of ongoing testing rather than an annual certificate. An estate under continuous automated examination, with expert testing where it counts, produces that evidence as a by-product instead of as a scramble before an audit.

Combine continuous coverage with expert testing where it actually matters.

Explore penetration testing

Common questions

Not currently, and not for the work that matters most. Automation is effective at breadth: finding known vulnerabilities, misconfiguration and exposed assets across a large estate. It is weak at business logic flaws and at chaining minor findings into a real attack path, which is where experienced testers earn their fee.

A suspected Chinese cyberespionage operation, first described by Mandiant in 2023, which Singapore's authorities disclosed in February 2026 had attacked telecommunications companies in the country. It is characterised by living-off-the-land techniques and zero-day exploits, which makes it hard to detect with signature-based tooling.

Frequency should follow the framework you report against and the rate at which your environment changes. PCI DSS, for example, is explicit about annual internal and external testing plus six-monthly segmentation testing for service providers. Continuous automated coverage between expert tests closes the gap that an annual snapshot leaves open.

Sources

  1. Singapore shifts cyber strategy over cyber espionage group UNC3886 strikes on its telecommunication sector — Digital Watch Observatory, 24 September 2026
  2. Singapore Mounts Largest-Ever Coordinated Cyber Defense — BankInfoSecurity, 24 September 2026