Singapore SMEs face three main cyber threats in 2026: ransomware, phishing and business email compromise (BEC), and attacks that arrive through suppliers. The Cyber Security Agency of Singapore (CSA) reports that SMEs were the group most affected by ransomware in 2025. The practical answer is a baseline of controls, and CSA's Cyber Essentials mark defines exactly what that baseline is.
The 2026 threat landscape for SMEs
The threats that matter most to a Singapore SME today are ransomware, phishing that leads to payment fraud, and compromise through a trusted vendor. CSA's Singapore Cyber Landscape 2025/2026, published on 30 June 2026, describes a year in which ransomware cases rose marginally, with SMEs "most affected, consistent with their generally lower levels of cybersecurity maturity and more limited resources". The same report notes a marked increase in supply chain attacks globally, where attackers reach well-defended businesses indirectly through third-party vendors with weaker hygiene.
| Indicator (Singapore) | 2024 | 2025 | Source |
|---|---|---|---|
| Ransomware cases reported to CSA | 159 | 165 | CSA SCL 2025/2026 |
| Phishing attempts reported to CSA | about 6,100 | about 4,800 | CSA SCL 2025/2026 |
| Infected systems observed | about 117,300 | 284,300 | CSA SCL 2025/2026 |
| Website defacements observed | 67 | 62 | CSA SCL 2025/2026 |
| Business email compromise losses | $88.5 million | $35.3 million (377 cases) | SPF Brief 2025 |
Two cautions apply when reading these numbers. First, CSA points out that phishing statistics likely under-represent the true scale, because many attempts go unreported, so the fall from 6,100 to 4,800 is not evidence that phishing is fading. Second, most defaced websites in 2025 belonged to SMEs, which CSA attributes to poor cyber hygiene such as neglected pages and leftover setup or configuration files.
Ransomware
Ransomware remains the most disruptive threat for a small business because it stops operations and threatens data exposure at the same time. CSA's Singapore Cyber Landscape 2024/2025 found that professional services firms, including architecture, engineering, consultancy, accounting, legal and advertising, experienced 28 ransomware attacks in 2024, "with majority of the attacks targeting SMEs". The 2025/2026 edition names Akira, Qilin and LockBit as the top ransomware groups that impacted Singapore enterprises in 2025.
Phishing and business email compromise
Business email compromise is a payment-fraud problem, not only an IT problem. The Singapore Police Force describes the most common variant: victims receive emails purportedly from a known supplier, vendor or client announcing a change of bank account details, and pay into the "updated" account. In 2025, BEC was among the top five scam types by amount lost, at $35.3 million or 3.9% of the $913.1 million lost to all scams. Losses fell 60.1% year on year, but cases rose 2.4% to 377, so attempts have not stopped.
AI-enabled social engineering
Attackers now use AI to make lures more convincing. CSA reports threat actors adopting AI voice cloning and video deepfakes, and toolkits that bypass multi-factor authentication through adversary-in-the-middle phishing and QR-code ("quishing") campaigns. Globally, IBM's Cost of a Data Breach Report 2025 found that 16% of the breaches it studied involved attackers using AI tools, most often for phishing or deepfake impersonation.
Why SMEs are disproportionately targeted
SMEs are targeted because they hold valuable data and payment flows but usually lack dedicated security staff. CSA ties SME ransomware exposure directly to lower cybersecurity maturity and more limited resources. A 50-person company without a security team, with shared admin passwords and unpatched laptops, gives an attacker the same payoff as a larger firm for far less effort. SMEs are also links in larger supply chains, so a compromised SME can be the route into its bigger customers, which is one reason CSA highlights supply chain attacks.
The cost side is hard to pin down for SMEs specifically. The most widely cited benchmark, IBM's 2025 report, puts the global average cost of a data breach at USD 4.44 million, but it is based on 600 organisations worldwide and is not an SME figure, so treat it as an upper reference point rather than a forecast for a small business. For an SME, the more relevant costs are downtime, a misdirected supplier payment, and the effort of notifying affected customers and, where required, the PDPC when personal data is involved.
The baseline controls CSA expects
The baseline for a Singapore SME is the set of measures in CSA's Cyber Essentials mark, which CSA describes as focusing "on baseline controls to protect organisations against the most common cyberattacks". The Cyber Essentials standard (second edition, March 2025) groups its measures into five categories. The table below maps each category to what it requires and a practical starting point.
| Cyber Essentials category | What CSA asks for | Practical first step (Namtech recommendation) |
|---|---|---|
| Assets | Equip employees to be the first line of defence; know your hardware, software and data | Keep one inventory of devices, SaaS accounts and where business-critical data lives |
| Secure/Protect | Virus and malware protection, access control and secure configuration; MFA for administrative access to important systems | Turn on MFA for email, banking, cloud admin and accounting first; remove shared admin accounts |
| Update | Prioritise critical or important security patches as soon as feasible | Enable automatic updates on laptops and phones; review server and plugin updates weekly |
| Backup | Back up essential data regularly and store it separately and securely, not connected to the operational network | Keep at least one offline or immutable copy and test a restore on a schedule |
| Respond | Be ready to detect, respond to and recover from incidents, with a documented response plan | Write a one-page plan kept on paper: who to call, how to isolate a device, how to report to SingCERT |
A few details in the standard are worth knowing. It requires cybersecurity awareness and data protection training for all employees, and recommends refreshing it at least annually. It requires the incident response plan to be kept on paper or on an offline system that cannot be compromised during an incident. Since April 2025 the scheme also covers cloud, operational technology and AI security, which matters for any SME using AI tools or SaaS platforms.
CSA's controls address the threats in the first section directly. MFA and access control blunt credential phishing. Patching addresses the months-old or years-old vulnerabilities that CSA found behind many infected systems in 2024. Separate backups limit ransomware damage. For BEC, the SPF's advice is procedural: be mindful of sudden fund transfer instructions or changes in payment bank account details, and always verify the authenticity of the person giving them. In practice that means a call-back rule on a known phone number before any bank detail change is accepted.
AI-powered threats and AI-powered defence
AI raises the quality of attacks, and it also improves defence when it is governed. IBM's 2025 report found that organisations using AI and automation extensively in security operations saved an average of USD 1.9 million in breach costs and shortened the breach lifecycle by an average of 80 days. The same report found that one in five organisations reported a breach due to shadow AI, meaning staff using unapproved AI tools, and that high levels of shadow AI were associated with USD 670,000 in higher breach costs.
For an SME, the actionable lesson is to bring AI use into the asset inventory: list the AI tools staff use, what data goes into them, and who approved them. This is also what CSA's enhanced Cyber Essentials now expects under AI security, and it overlaps with the AI inventory we recommend in our article on Singapore's AI governance framework.
Building a cybersecurity programme on a budget
The most cost-effective path for a Singapore SME is to work towards the Cyber Essentials mark with government co-funding. CSA states that Cyber Essentials is "designed for businesses of all sizes" and provides "a practical and affordable way to strengthen cybersecurity without extensive resources". As of early 2026, more than 800 organisations had achieved at least Cyber Essentials certification, according to CSA's 2025/2026 report.
- Self-assess. The standard requires a guided self-assessment before engaging a certification body. Use it as your gap analysis.
- Get help with people and process. Through CSA's CISO as-a-Service programme, a CSA-onboarded consultant performs a cyber health check, builds a cybersecurity health plan and prepares you for at least Cyber Essentials. Eligible SMEs can receive up to 70% co-funding, and sign up through IMDA's SMEs Go Digital platform.
- Fund the technology. CSA points SMEs to pre-approved cybersecurity solutions under IMDA's SMEs Go Digital, which carry funding support for eligible organisations.
- Certify and maintain. A Cyber Essentials certificate is valid for two years, after which you re-apply or move up to the risk-based Cyber Trust mark.
Security also has to be built into the systems you commission. When Namtech Pte Ltd, a Singapore AI transformation consultancy, builds a web application or rolls out AI tools, access control, update paths and backups are part of the scope rather than an afterthought. If you want an independent view of where AI and automation create new exposure in your business, our AI Opportunity Audit includes a review of the data and tools involved.
For most SMEs, the gap is not exotic threats but missing basics: MFA, patching, separate backups and a call-back rule on payment changes close most of it.