Singapore’s push to get ahead of AI-driven cyber risk is both timely and necessary, according to Sophos‘s chief information security officer, as the region grapples with a sharp rise in AI-enabled attacks.

The Infocomm Media Development Authority (IMDA) this week announced a new toolkit to help companies test AI agents for safety and reliability, alongside a new Frontier AI Resilience and Security Taskforce aimed at strengthening Singapore’s collective response to AI-accelerated threats. The move comes as Japan’s ransomware cases surged 67 per cent even as global case numbers declined, with incidents hitting banks, retail chains and other sectors across the region.

A ‘triple bind’ for security teams

Ross McKerchar, CISO at Sophos, said security leaders are increasingly caught in what he calls a “triple bind”, where AI is simultaneously accelerating vulnerability discovery, expanding the population of AI agents that need to be secured, and enabling more code to be written and reviewed than teams have historically been staffed to manage.

“Each of these trends increases workload on its own, but together they fundamentally reshape how security teams prioritise their work,” McKerchar said.

McKerchar added that today’s security leaders are expected not only to manage threats, but also to communicate risk to boards, navigate regulatory requirements and guide business decisions while maintaining a secure environment — all while organisations compete for a limited pool of senior security talent.

“The organisations that will be most resilient are those that treat cybersecurity as a shared business responsibility and ensure security leaders have the support, visibility, and resources they need to succeed,” he said.

His comments add to a growing chorus of security leaders urging organisations in Singapore and the region to treat AI governance as a board-level priority rather than a purely technical one, as regulators move to formalise testing and oversight requirements for AI agents.