Singapore has chosen a decisive path: block known malware and phishing sites at a national scale and move from reactive firefighting to proactive national defence. This is not tentative tinkering. It is a clear pivot — protective domain name service (PDNS) will be rolled out under the Online Criminal Harms Act, operated by the Cyber Security Agency of Singapore’s National Cybersecurity Command Centre, and expected to come online in 2027.
Why this matters right now
The numbers refuse to be polite. Malware-infected systems detected jumped from 117,300 in 2024 to 284,300 in 2025. Threat actors are faster, smarter, and weaponising artificial intelligence to scale attacks. Meanwhile, advances in quantum computing threaten the foundations of current encryption. When the threat evolves this quickly, patchwork responses fail. The decision to implement upstream blocking at DNS level is an admission that prevention at scale can no longer be optional.
How PDNS will work — and where safeguards fit in
PDNS functions like a national traffic controller for the web. Known malicious domains are prevented from resolving for users inside the jurisdiction. That stops victims from landing on phishing pages or downloading malware before any device-level defence needs to respond. Sounds blunt? It is intentionally blunt, because certain threats demand blunt instruments.
Yet bluntness does not mean careless. The Online Criminal Harms Act includes mechanisms for removal and blocking, and the agency has promised a robust assessment and validation process to reduce false positives. Affected parties will have recourse via reconsideration and appeal processes. These procedural checks are essential; national blocking without accountability would be reckless and quickly erode trust.
Lessons from recent incidents
Recall the 2025 telco incident: state-sponsored attackers from UNC3886 infiltrated networks of major operators. The intrusions came close enough to threaten disruption of telecommunications and internet services. If PDNS had been operational as an upstream shield, at least some infection vectors would have been interrupted earlier. That single example shows how national-scale measures reduce blast radius and buy response teams precious time.
On a more granular level, during a regional incident response exercise, our team watched a simulated phishing campaign bloom inside an otherwise well-defended organisation. Endpoint defences caught some payloads, but lateral movement already started. If domain-level blocks were in place upstream, the phishing sites would have been unreachable and the cascade stopped before the first click. That memory fuels the conviction that upstream defence matters.
AI and quantum: double-edged swords
AI is being used to craft phishing content faster and to tailor social-engineering at scale. Attackers leverage generative models to write messages that bypass basic filters and trick users with high-fidelity impersonation. The response must be equally dynamic. Singapore’s strategy includes AI-driven detection and coordination systems inside the National Cybersecurity Command Centre to track incidents and speed operational response.
Quantum computing is no longer hypothetical. The threat to existing cryptographic algorithms forces a migration to quantum-safe systems. The refreshed strategy recognises this and allocates resources to strengthen capabilities in AI and quantum — not as optional upgrades, but as core national priorities.
Wider ecosystem changes that must follow
- Critical infrastructure protection cannot be an afterthought. Systems running power grids, telecommunications and water cannot depend solely on perimeter measures. They need layered defence, better threat intelligence sharing and faster patching cycles.
- Operational coordination is essential. The new National Cybersecurity Command Centre is designed to amalgamate threat intelligence and coordinate responses nationally. That capability must be matched by clear playbooks and empowered operators who can act decisively.
- Legal and social safeguards matter. Blocking at national scale affects speech, commerce, and the flow of information. Transparent processes, independent oversight where feasible, and accessible appeal routes must be non-negotiable.
Practical steps for organisations and individuals
Do not wait for the national service to make the first move. Organisations should adopt multi-layered defences now: implement DNS filtering, enforce strong email hygiene, run phishing simulations, and prioritise patch management. Explore cyber insurance pilots to transfer residual risk, while recognising that insurance is not a substitute for hardened controls. Individuals must remain sceptical of unsolicited links and enable multi-factor authentication on all critical accounts.
A final, uncompromising truth
National-scale PDNS and command-centre coordination are powerful additions to the defensive arsenal, but they are not a panacea. Attackers adapt, and defensive advantage is fleeting. The refreshed strategy is bold, necessary, and pragmatic — a recognition that defending at speed and scale is the only responsible course. There will be friction: legitimate sites may be caught, appeals will be needed, and policy debates will flare. That is healthy. The alternative, doing nothing while infection counts balloon, is unacceptable.
Stand ready, stay sceptical, and demand accountability from those who operate national defences. When upstream measures are implemented responsibly, they turn countless potential breaches into non-events. That outcome is worth hard decisions and rigorous oversight.
Singapore’s shift sends a clear message: the era of waiting for attacks to hit before acting is over. The nation chooses to move earlier, at national scale, and at the speed of the threat. The rest of the ecosystem must catch up — quickly.