Only 3 in 10 Singapore Organisations Prepared for AI-Driven Cyberattacks: Mimecast

Nearly seven in 10 organisations in Singapore admit they are not fully prepared to defend against AI-powered cyber threats that target human weaknesses, according to Mimecast's State of Human Risk 2026 study. The findings, based on a survey of 500 IT security professionals and business decision-makers across Singapore and Australia, reveal a worrying gap between concern and readiness — 79% of Singapore respondents said they worried about AI being used to attack their organisation, yet 69% acknowledged they were not adequately prepared.

That gap is wider than the Asia-Pacific average, where 60% said they were not fully prepared. The disconnect suggests that while awareness of AI-driven threats is high, actual investment in defences has not kept pace. More than 61% of Singapore respondents said they believed their organisation would face an AI-enabled cyberattack within the next 12 months — a forecast that makes the preparedness gap even more concerning.

The study also highlighted the human dimension of the risk. Over two-thirds of Singapore respondents (68%) said it was very likely that an employee in their organisation could be deceived by a cybercriminal using AI as part of a social engineering attack. Yet only 38% said their organisation provides training that teaches employees how to use AI safely while avoiding exploitation. Just 42% said they regularly conduct simulated phishing exercises involving AI-generated attacks — meaning more than half of organisations are not stress-testing their human defences against the most likely threat vector.

Nicky Choo, Mimecast's vice president and general manager for Asia-Pacific, said the findings point to a fundamental mismatch. "The problem is not simply that AI allows cybercriminals to create fraudulent messages more easily. It allows them to make those messages sound familiar, credible and urgent," he said, adding that employees should not be expected to identify increasingly convincing scams without institutional support and training.

Why it matters for Singapore: Singapore's Smart Nation ambitions and rapid AI adoption across financial services, healthcare, and government create a paradox — the more AI is embedded into critical infrastructure, the more attractive a target the country becomes. The Mimecast data suggests that organisations are still treating cybersecurity as a technology problem rather than a human-risk problem, when the evidence points in the opposite direction. For Singapore's regulators and industry bodies, the findings reinforce the case for mandatory cybersecurity training standards and simulation exercises, especially as AI-generated attacks become harder to distinguish from legitimate communications.