8 World News, 企业用AI“先上车后补票” 网络安全措施落实不到四成

(Summarised translation)

Local businesses are accelerating their adoption of artificial intelligence (AI), but cybersecurity safeguards have not kept pace. A survey by the Cyber Security Agency of Singapore (CSA) found that more than half of the organisations surveyed were already using AI in their operations, but had implemented, on average, fewer than 40% of basic AI-related cybersecurity measures.

Experts described the approach taken by many small and medium-sized enterprises (SMEs) as “acting first and putting safeguards in place later”. Employees have already begun using AI to process customer information and carry out daily tasks before their companies have established clear usage guidelines, increasing the risks of data leaks and other cybersecurity threats.

According to CSA’s Singapore Cybersecurity Health Report 2025, 55% of the 2,005 organisations surveyed had adopted AI in their business operations. However, they had implemented an average of just 39% of the relevant basic cybersecurity measures, including updating software and backing up important data.

The survey also found that nearly 90% of respondents had experienced at least one cybersecurity incident in the previous year. However, not all these incidents were AI-related.

Associate Professor of Practice Victor Keong from the Information Systems Technology and Design (ISTD) pillar of the Singapore University of Technology and Design (SUTD), pointed out that AI adoption among many SMEs has outpaced their cybersecurity preparedness.

He described many businesses as “getting on board first and sorting out the safeguards later”. Employees are already using AI to draft content, organise information and even write code, while their companies lack clear usage policies and oversight mechanisms.

This phenomenon, where employees use AI tools without their company’s knowledge or approval, is known as “Shadow AI”.

Associate Prof Keong gave the example of an employee uploading an entire customer list to a free AI tool to generate personalised emails, without realising that the information could be stored and potentially used for model training, depending on the tool’s terms of use and settings.

He warned: “AI has made work faster, but it has also made mistakes happen faster.”

As businesses increasingly adopt AI agents capable of automatically sending emails, processing payments and modifying data, the risks are growing further.

Associate Prof Keong explained that if AI agents are granted excessive system permissions without adequate human oversight, the consequences could escalate from “saying the wrong thing” to “doing the wrong thing”.

He also cautioned that SMEs form part of the supply chains of larger enterprises. If they become an entry point for cyberattacks, the risks could spread to other businesses.

Associate Prof Keong emphasised that businesses do not necessarily need to invest large sums of money to improve their cybersecurity protection.

Apart from establishing AI usage guidelines, businesses can also make better use of existing features in their office software, such as multi-factor authentication and activity logs, to reduce cybersecurity risks.