Gin Wong

IntroSecurity ASEAN Warns Enterprises of Emerging Cybersecurity Risks from ChatGPT-5 The release of ChatGPT-5 has generated excitement, but also new cybersecurity risks that organisations cannot afford to overlook. Independent research has already revealed weaknesses in jailbreak resistance, model routing, and zero-click exfiltration attacks, alongside wider ecosystem threats such as malware disguised as ChatGPT apps. At IntroSecurity ASEAN, we believe it is critical for business leaders and CISOs across Southeast Asia to understand these risks now - before adversaries exploit them at scale. We’ve published a press release outlining the key concerns and our recommendations for how enterprises can defend against these emerging threats. Read more here https://lnkd.in/dKzfZrNR

6

The Cyber Security Agency of Singapore (CSA) released its Singapore Cyber Landscape 2024/2025 report on September 3, 2025, revealing alarming increases in cyber threats. Key findings: - Phishing attempts surged 49%, with over 6,100 reported cases; 12% contained #AI generated content. - Ransomware attacks increased 21%, with manufacturing MNCs and SMEs in professional services as prime targets. - Infected infrastructure jumped 67% to approximately 117,300 systems, highlighting widespread use of outdated software. - Advanced Persistent Threat (#APT) attacks have quadrupled since 2021. - Singapore ranked as the seventh most attacked country globally for #DDoS in Q4 2024 and was the third-largest source of #DDoS traffic. Check out the report below : https://lnkd.in/d9iSZP8b

3

🔐 Cybersecurity Governance: A Wake Up Call from Singapore’s Paradox 🌐 Singapore's top rated companies had A grade cybersecurity scores yet every one of them was breached. A recent analysis by Privasec shared via CSO Online revealed a surprising disconnect. While risk scores appear strong on paper, real world resilience tells a different story. The issue lies in gaps in security governance, overreliance on compliance metrics, and a lack of proactive threat management. 💡 Key takeaway: Cybersecurity is not just about meeting benchmarks. It is about operational readiness, continuous testing, and adaptive governance. ✅ Governance must go beyond checklists ✅ Risk posture does not equal real world defense ✅ Penetration testing, incident response drills, and board level cyber accountability are essential It is time to shift from compliance confidence to resilience reality. #CyberSecurity #Governance #RiskManagement #CISO #CyberResilience #SecurityLeadership #SingaporeCybersecurity #CyberAwareness https://lnkd.in/gfbT4Gt6

8

2 Comments

https://lnkd.in/gJXCzhSq When your security camera password is “Louvre,” the issue isn’t technology — it’s governance. According to recent audits and media reports, the museum’s systems relied on weak credentials and outdated configurations — an all-too-familiar gap between physical and cyber oversight. You can’t protect what you don’t inventory. Know your physical security assets. Govern your CMDB. Resilience starts with visibility and accountability. Be safe out there. #CyberPhysicalSecurity #Governance #Resilience #Leadership #CMDB #AssetManagement

3

2 Comments

“Why identity security maturity matters more than ever”, my column for The Sunday business & IT , The Manila Times . SailPoint’s 2024–2025 Horizons of Identity Security report shows that identity security maturity has evolved from a technical concern into a strategic priority tied to business performance, risk reduction, and workforce productivity. https://lnkd.in/ghEDhSnz

1

Happy to share my view on the role of AI in Singapore Cybersecurity Landscape on Channel 8 last night. This is done with reference to Cyber Security Agency of Singapore (CSA) 's release of their report onf Singapore Cybersecurity Landscape yesterday. https://lnkd.in/ghSvEQYk As usual, in news, what was discussed will be trimed according to fit the limited timeslot. Here is the full interview script: “Cybersecurity is an endless battle between offense and defense. For attackers, the cost is often very low—finding just one vulnerability can yield huge rewards. Defenders, however, must remain constantly vigilant, using limited resources to protect vast and complex systems. More importantly, defense itself is a ‘cost center’: it requires heavy investment, yet success is invisible, while failure is immediately magnified. So, even though we have continuously strengthened our capabilities, the challenges have also grown more complex. Over the past year, phishing, ransomware, and botnet infections have all risen significantly. Without our preparations, these numbers could easily have doubled. In other words, we are indeed more capable of responding to attacks, but the scale and complexity of threats are also increasing. Ultimately, cybersecurity is ‘easy to attack, hard to defend.’ We must continue to invest so that risks remain manageable and society can stay confident.” “Looking ahead, Singapore has several key priorities in cybersecurity. First, prevention: we need to reduce the attack surface exposed to the outside world, such as mobile devices, servers, and cloud systems. Security must be strengthened, and unverified software should not be used casually. Second, resilience: if a system is breached, internal consultation and authentication processes must be both simple and secure, so that affected parts can be quickly isolated and losses minimized. Third, proactive defense: it is not enough to remain passive—we must actively search for suspicious devices, share intelligence, and enable agencies like CSA to pool resources and swiftly isolate risks. Fourth, AI security: we must ensure that chatbots and AI applications themselves do not become new attack tools, while also defending against AI-driven attacks. Finally, AI for protection: we should use AI to ‘attack’ our own systems to uncover vulnerabilities, and employ lightweight AI tools to quickly detect abnormal behavior. In short, the future priorities are prevention, resilience, proactive defense, AI security, and AI protection—only with these can we stay secure and maintain trust in an increasingly complex cyber environment.” Full report: https://lnkd.in/gxPKd_Ag

61

🚨 PDPC & CSA Issue Joint Advisory and Clarificatory Guidelines on the use of NRIC: Singapore’s PDPC has released new clarificatory guidelines, jointly with the Cyber Security Agency, warning against the use of NRIC numbers for authentication. Key takeaways: NRICs are for identification — not authentication. Using them as login credentials poses serious risks of impersonation and data misuse. Organisations are strongly encouraged to: • Stop using NRICs (full or partial) for authentication • Adopt multi-factor authentication (MFA) or alternatives like biometrics or tokens • Audit and update existing authentication practices This move underscores a clear message: build trust through better authentication. 🔗 Full advisory here: https://lnkd.in/druTqAxt #dataprivacy #PDPC #cybersecurity #governance #digitaltrust #compliance #Singapore #MFA

16

New Research on Cyber Risk Management Outcomes reveals that 40% of orgs saw improvement in cyber & business alignment.     Full Report =  https://lnkd.in/gWy4ZkEA     Bravo to all at FAIR Institute including Mohamed Abdul Rahim & Eugene Teo SMSCS MSID-AD for their great work on #CyberSecurity

4

Here is the recording of the presentation I gave to the Ecosystem & Governance Working Group of Trust Over IP on the C2PA Governance Framework and Conformance Program. https://lnkd.in/gnqdGvG4 The focus was on how the Trust Over IP Governance Toolkit was used to define the C2PA ecosystem and a plan to hold participating applicants accountable to the C2PA Content Credential Specification and additional requirements included in the program.

28

Today, we completed our formal submission of the VeritasChain Protocol (VCP) v1.0 to the Monetary Authority of Singapore (MAS) as part of the Consultation Paper on Guidelines on Artificial Intelligence Risk Management. Our submission includes: • MAS Cover Letter (VSO-LETTER-SG-001) • Annex SG-001 mapping VCP to MAS AI Guidelines, FEAT, TRM and PDPA • VCP Specification v1.0 (open standard) VCP provides: • Cryptographically verifiable AI and algorithmic decision logs • Immutable, tamper-evident audit trails compliant with TRM and PDPA • Built-in explainability (VCP-GOV) • Risk-state snapshots supporting incident reconstruction (VCP-RISK) • Open, regulator-neutral infrastructure for SupTech and AI governance This submission follows our earlier engagement with the U.S. CFTC and marks another step toward establishing VCP as a global standard for transparent AI-driven financial systems. We welcome continued dialogue with MAS, the Veritas Initiative Secretariat, and financial institutions exploring AI auditability. — Tokachi Kamimura Founder, VeritasChain Standards Organization (VSO) https://veritaschain.org

3

AI in OT Cybersecurity — Opportunity or Threat? At OTCEP 2025, Poh Chang CHEW delivered a thought-provoking session on how AI is rapidly entering the OT space — not just as a tool for defenders, but also as a potential weapon for attackers. He explored real-world use cases where AI enhances anomaly detection, predictive maintenance, and threat intelligence — while also warning of emerging risks like AI-generated payloads, faster lateral movement, and automation of targeted attacks. A timely reminder: In OT environments where safety and reliability are critical, we must adopt AI with both ambition and caution. #OTCEP2025 #OTCybersecurity #AIinOT #OperationalTechnology #ThreatDetection #Resilience #SmartSecurity #ArtificialIntelligence

53

4 Comments

Companies should stop using NRIC numbers to authenticate individuals or as passwords due to the risks of impersonation and data breaches, according to a formal advisory by PDPC and CSA. CNA Personal Data Protection Commission (PDPC) Ministry of Digital Development and Information #cybersecurity #datasecurity #databreach #singapore

5

2 Comments

🚨 Palo Alto Networks warns of rising GenAI threats across Asia-Pacific, calls for stronger cyber governance. The State of GenAI 2025 report highlights an 890% surge in GenAI traffic, revealing risks tied to unsanctioned use, shadow AI, and agentic models—especially in highly digital markets like India 🌐. ⚡ 10% of GenAI tools used by companies are classified as high-risk 🧠 Top tools in India: Grammarly (32.56%), Microsoft Power Apps (19.98%), Microsoft Copilot (16.37%) 📈 DeepSeek-R1 triggered an 1,800% traffic spike in just 2 months 💬 Tom S., Director & Principal Architect at Palo Alto Networks, stressed the need for “adaptive security controls” and Zero Trust architectures to safeguard national interests and operational integrity. 🛡️ The report also shines a light on data leakage, jailbreak threats, and security gaps affecting proprietary IP—particularly in technology and manufacturing sectors, which now lead 39% of global GenAI coding transactions. 💰 Parallel to this, India’s 2025 Union Budget earmarked ₹500 crore for AI education through a new Centre of Excellence—a signal of intent that must align with equally robust cybersecurity preparedness. 📊 Key recommendations: Implement usage visibility & control Enforce conditional access policies Use real-time content inspection Centralise data governance across platforms 🗣️ Swapna Bapat, VP & MD, India & SAARC, noted: “India is one of GenAI’s biggest adopters… but adoption has outpaced governance.” The message is clear: tapping GenAI’s power demands intentional oversight to protect public trust, national security, and enterprise resilience 🔍💻. #GenAI #CyberGovernance #AIThreats #ZeroTrustSecurity #AsiaPacificCybersecurity #PaloAltoNetworks #DigitalRisks #AIResilience #EnterpriseSecurity #IndiaTech #TechPolicy #AIAdoption #DataProtection 

4

TB-CERT Cybersecurity Annual Conference 2025 – A Strong Close with Practical Fraud Defense 🇹🇭 Day 2 of the TB-CERT Cybersecurity Annual Conference 2025 concluded with a well-attended and oversubscribed workshop delivered by SoftScheck APAC’s Director of Enterprise Security, Tyler Tang: “Designing Cyber Resilience: Addressing Fraud through Threat Modeling.” In this interactive session, participants examined real-world fraud cases where millions were lost and regulations tightened, before diving into how threat modeling can be applied to identify vulnerabilities, outthink fraud tactics, and design resilient controls that strengthen enterprise defences. This workshop equipped attendees with not only the tools to reassess their current fraud-prevention strategies, but also practical frameworks that can be embedded into their day-to-day security operations. The close of Day 2 highlighted the conference’s central theme: cyber resilience as the cornerstone of trust in the digital economy. By combining innovation, collaboration, and practical strategies, organisations can better prepare for evolving threats and secure long-term growth. SoftScheck is proud to have played a role in these important conversations, and we look forward to continuing our mission of building stronger, more resilient organisations across the Asia-Pacific region. #softScheckAPAC #Cybersecurity #CyberResilience #ThreatModeling #FraudPrevention #EnterpriseSecurity #FinancialServicesSecurity #TBcert2025 #AI #SGCybersecurity

30

📌 Workshop Recap | JCAATs AI Information Security Auditing Lab 📅 February 4 | Taipei & Online   On February 4, we hosted our hands-on workshop, “Applying AI to Information Security Management.”   Participants explored how AI-driven auditing is transforming information security practices — aligned with the IIA 2035 Vision that urges audit functions to embrace technology.   During the session, attendees practiced: 🔹 JOIN & formula fields 🔹 High-risk keyword detection 🔹 Word cloud analysis 🔹 Intelligent audit case simulations   Using JCAATs, a Python-based AI Auditing Software, participants experienced how machine learning and text mining enhance audit efficiency and risk insight. Thank you to everyone who joined us onsite and online. AI-powered auditing is no longer the future — it’s the present.   #JCAATs #Jacksoft #AIAuditing #InformationSecurity #ComputerAuditing #InternalAudit #GRC #AuditInnovation

10

3 Comments

ICAEA is pleased to see continued advancement in AI-driven information security auditing. Practical, technology-enabled training such as this plays an essential role in preparing auditors for the evolving expectations of the profession and the IIA 2035 Vision.

1