Business judgement, AI proficiency key as cyber defender roles evolve; new professional standards being developed

[SINGAPORE] Cybersecurity professionals need to do more than fix technical flaws; they must also understand organisational risks and weigh business trade-offs against priorities when making decisions.

This is the highest-rated capability for cyber security professionals across all levels over the next three years according to the findings of a new study on how artificial intelligence (AI) is shaping cybersecurity jobs.

Commissioned by the Cyber Security Agency of Singapore (CSA), the survey of 1,000 organisations also found that cybersecurity professionals need to have a strong grasp of technical knowledge in their field to effectively evaluate threats, assess vulnerabilities and guide sound security decisions.

Notably, the third most highly-rated skill involves AI, so cybersecurity professionals can better detect and respond to AI-enabled cyber threats.

The study also said while AI reduces the operational load of cybersecurity work by augmenting tasks, humans are still needed to determine if the alerts are credible and the threats are genuine.

The latest findings mirror an April 30 survey by the Singapore Ministry of Manpower, which found that AI was primarily transforming tasks rather than replacing roles.

The Building Singapore’s Cybersecurity Workforce for the Age of AI report was released at Singapore International Cyber Week on Oct 13.

The study found that AI is reshaping cybersecurity so quickly that professionals will encounter a meaningful AI-enabled cyber threat within the next 12 months, requiring them to acquire new skills. Such threats include AI-enabled phishing, deepfakes and malware-development.

These findings will help shape new professional standards for CSA’s upcoming accreditation framework to reflect AI fluency as an important part of cybersecurity competence. Specifically, cyber defenders need a new skillset: the ability to spot when an AI makes a mistake or gets manipulated, and knowing how to fix the problem safely.

CSA will set common professional standards across roles and proficiency levels, followed by a voluntary two-year accreditation pilot from the second quarter of 2027.

The Cybersecurity Professional Accreditation Framework, announced by Senior Minister of State for Digital Development and Information Tan Kiat How on Oct 13, is a key plank of Singapore’s refreshed cybersecurity strategy.

“If the work is changing, the profession must evolve with it. Our people need greater clarity about the capabilities they should develop. Employers need a clearer understanding of what good looks like. And training providers need to know what industry will need next,” said Tan.

The new framework is needed to formalise and recognise competencies in the AI age because the wide range of cybersecurity certifications has made it hard for employers to assess practitioners’ capabilities.

“We are not trying to create another layer of certificates. We want to build a framework that gives employers greater confidence, gives professionals greater recognition, and gives the profession a stronger common standard,” said Tan.

The survey used to inform the new framework was conducted by Blackbox Research between August and September 2026. It covered 1,000 respondents from government agencies, critical information infrastructure owners, cybersecurity services companies and the private sector who are using AI tools in their work.

The survey found that demand for mid-level and senior cybersecurity professionals is expected to grow over the next three years, while junior roles are expected to be redesigned to include more complex work supported by AI. Such work requires technical depth to spot missing evidence and assess whether AI recommendations are credible and appropriate.

Roles substantially redesigned by AI include analysts in security operations, vulnerability assessment and penetration testing.

In security operations, for instance, AI can now automatically analyse system logs, flag suspicious activity, and draft detection rules or reports. So human analysts need to shift their focus toward investigating findings, judging severity and orchestrating responses. 

Consequently, the ability to recognise AI-enabled attacks, write effective prompts, configure AI safeguards and verify the reliability of automated detections has also become essential.

For vulnerability assessment and penetration testing, new skills include testing AI systems for attempts to manipulate human instructions to bypass safeguards.

At the leadership level, chief information security officers still have to set the tone for an organisation’s cybersecurity vision and make key decisions. But going forward, leaders will need to understand AI-specific risks, and lead teams that combine human expertise with AI.

The accreditation framework aims to give employers a clearer way to judge whether the growing pool of cybersecurity professionals have these capabilities. The workforce has more than doubled from 4,000 in 2016 to over 10,000 in 2025.

A separate study commissioned by CSA and conducted by Ernst & Young in 2024 and 2025 found that professionals also struggled to identify and keep up with the skills needed for their roles and career progression. Existing certifications, while useful, did not offer a comprehensive assessment of technical knowledge, practical experience and professional ethics.

CSA will establish three bodies by the end of 2026 to oversee accreditation.

A Cyber Security Professional Office, set up with the Association of Information Security Professionals, will handle assessments, appeals and renewals, and maintain a public register of accredited practitioners. A panel of senior representatives from government, industry and academia will oversee professional standards and approve the award of titles. Committees of technical experts will review assessment criteria, examine candidates’ portfolios and conduct interviews.

CSA said accreditation would complement existing qualifications and certifications, giving professionals formal recognition of their expertise and employers greater confidence in their capabilities.

The initial pilot will involve professionals from selected government agencies and cybersecurity service providers, focusing on areas such as security operations and vulnerability assessment and penetration testing. Application fees will be waived during the pilot.

Details on eligibility, assessments and applications will be available from March 2027. The standards will be updated regularly to reflect changing industry needs and emerging areas such as AI security.

Tan said that if Singapore can build professionals who can exercise sound judgement over how AI is used, it will strengthen Singapore’s cyber defences.

“We will build a cybersecurity profession that is trusted, resilient and ready for the next generation of threats,” he said. THE STRAITS TIMES