Cybersecurity professionals must now combine technical expertise with business acumen and AI proficiency to effectively address evolving threats, according to a recent study commissioned by Singapore’s Cyber Sequence Agency (CSA). The research highlights that beyond fixing technical issues, professionals need to understand organizational risks and balance competing business priorities when making decisions—a capability identified as the top skill required across all cybersecurity roles over the next three years.

The study, released on October 13 at the Singapore International Cyber Week, surveyed 1,000 organizations spanning government agencies, critical infrastructure owners, cybersecurity firms, and private sector companies deploying AI tools in their operations. It found that although strong technical knowledge remains essential for evaluating threats and vulnerabilities, proficiency in detecting and responding to AI-enabled cyberthreats ranks as the third most important competency.

While artificial intelligence is automating routine cybersecurity tasks and reducing operational burdens, the human role remains critical. Cyber defenders must verify the credibility of AI-generated alerts and assess the legitimacy of threats. The research echoes findings from a Ministry of Manpower survey, which noted AI’s transformative effect on specific tasks rather than on entire job roles.

The report forecasts that cybersecurity professionals will face significant AI-driven threats—including AI-based phishing, deepfakes, and malware—within the next 12 months, necessitating new skills to recognize and counter these attacks. In response, CSA announced plans for a Cybersecurity Professional Accreditation Framework, which aims to standardize professional competencies around AI fluency and cybersecurity expertise. The framework will establish common standards across roles and proficiency levels, with a voluntary pilot set to commence in the second quarter of 2027.

Senior Minister of State for Digital Development and Information Tan Kiat How stressed the importance of evolving the cybersecurity profession in line with technological change. “Our people need greater clarity about the capabilities they should develop. Employers need a clearer understanding of what good looks like. And training providers need to know what industry will need next,” he said at the framework’s unveiling.

Currently, a wide array of cybersecurity certifications complicates employer assessments of practitioner skills. The new accreditation system seeks to offer clearer benchmarks without generating additional certification layers. It will incorporate assessments of candidates’ technical knowledge, practical experience, and professional ethics.

As AI reshapes cybersecurity roles, junior positions are expected to handle more complex tasks with AI support, requiring a deeper technical understanding to evaluate AI output critically. Functions such as security operations, vulnerability assessment, and penetration testing are undergoing significant redesigns. For example, AI can now automatically analyze logs and draft detection rules, shifting the human analyst’s focus to investigation, severity assessment, and response coordination. Competencies like recognizing AI-generated attacks, writing effective prompts, configuring AI safeguards, and verifying automated findings have become essential.

Leadership roles also face change, with chief information security officers needing to grasp AI-specific risks and guide teams integrating human expertise with AI capabilities.

To support the framework’s implementation, CSA will set up three governing bodies by the end of 2026: a Cyber Security Professional Office to manage assessments and maintain an accredited practitioners registry; a panel representing government, industry, and academia to oversee standards; and committees comprised of technical experts to evaluate candidates.

A separate study by Ernst & Young, conducted in 2024 and 2025, found that many cybersecurity professionals struggle to stay abreast of skills needed for career growth. Existing qualifications were deemed useful but insufficient for comprehensive competency assessment.

The accreditation pilot will initially include professionals from selected government agencies and cybersecurity service providers, focusing on security operations and vulnerability testing, with application fees waived. Details on eligibility and assessments are expected to be published in March 2027, and standards will be regularly updated to keep pace with emerging threats.

Tan underscored the importance of developing professionals capable of exercising sound judgment in AI’s application. “We will build a cybersecurity profession that is trusted, resilient and ready for the next generation of threats,” he said, emphasizing the role this initiative plays in strengthening Singapore’s cyber defenses.