More than half of Singapore organisations surveyed by Yubico say they have suffered a successful AI-driven phishing attack in the past year, even though most enforce multi-factor authentication (MFA) across their applications.
The figures come from Yubico’s 2026 Global State of Authentication Survey, run with Okta. It polled nearly 2,000 cybersecurity and IT professionals at larger companies in nine countries, including Singapore, Australia, India and Japan.
AI phishing is getting through despite MFA
In Singapore, 81 per cent of respondents said their organisations enforce MFA across all applications and services. Yet 58 per cent reported at least one successful AI-driven phishing attack in the past 12 months, the highest of any market surveyed and well above the 44 per cent global figure. Another 78 per cent said attacks on their company had increased.
Singapore respondents were also the best at spotting an AI-generated phishing email, with 59 per cent identifying it correctly against 53 per cent globally. Better spotting did not translate into fewer successful attacks.
Passwords still sit alongside stronger methods
Newer authentication methods are being added rather than replacing the old ones. About 72 per cent of Singapore respondents said their organisation uses different forms of authentication across different applications.
Mobile authenticator apps are the most common way to log in to work accounts (49 per cent), but usernames and passwords are still used by 41 per cent. SMS codes (35 per cent), device-bound passkeys on mobile (33 per cent), hardware security keys (26 per cent) and synced passkeys (26 per cent) followed. Some 58 per cent were issued a traditional username and password when they joined their organisation.
AI agents add a new identity to secure
Singapore respondents are more willing than most to let AI agents act for them. About 51 per cent are comfortable with agents making low-risk operational decisions, compared with 40 per cent globally, and 60 per cent are comfortable with agents communicating with colleagues or clients on their behalf.
They still want controls. Almost all (98 per cent) said verifying an AI agent’s identity and authenticity is important, and 95 per cent want to review and approve actions before an agent carries them out. With Singapore stepping up AI adoption under Smart Nation 2.0 and its National AI Strategy, firms will have to decide how agents are authenticated, what they can do alone and when a human has to sign off.
“Businesses should adopt a human-in-the-loop approach that preserves human oversight and intervention for higher-risk AI actions,” said Geoff Schomburgk, Regional Vice President for Asia Pacific and Japan at Yubico.
He said that oversight, backed by strong authentication such as a security key touch or biometric check, helps confirm that the person approving an action is who they claim to be.
Yubico and Okta said they are working together to make it easier for enterprise identity systems to issue and manage hardware-backed credentials, with the aim of helping IT teams cut password dependence without adding friction for staff.
