AnswersPublished14 sources
Singapore’s AI phishing paradox: strong detection, high exposure
Singapore respondents reported the survey’s highest rate of successful AI driven phishing: 58%, compared with 44% globally—even though 59% correctly identified AI generated phishing emails. MFA coverage was widely reported, but respondents also described a mix of authentication methods, including passwords and app b...
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- Singapore respondents reported the survey’s highest rate of successful AI driven phishing: 58%, compared with 44% globally—even though 59% correctly identified AI generated phishing emails.
- MFA coverage was widely reported, but respondents also described a mix of authentication methods, including passwords and app based codes.[2][3]
- Respondents valued identity checks and human review for AI agents, while many were also comfortable delegating tasks to them—making clear permissions and approval boundaries important.[2]
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What does Yubico’s annual Global State of Authentication Survey reveal about Singapore organisations’ exposure to AI-driven phishing and the. Article summary: Yubico’s 2026 Global State of Authentication Survey highlights a gap between security awareness and protection: Singapore led the surveyed markets in identifying AI-generated phishing, yet also reported the highest incid. Topic tags: general, general web. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clic
Singapore respondents to Yubico’s 2026 Global State of Authentication Survey reported both high ability to identify AI-generated phishing and the highest incidence of successful AI-driven phishing among the markets surveyed. The contrast is the central finding: recognising a threat does not, by itself, prevent an attack from succeeding.2
3
The survey also points to a second challenge: organisations are combining broad multi-factor authentication (MFA) coverage with a patchwork of login methods, while considering how to secure AI agents that act for employees. These are survey responses from professionals, not audited security measurements of every organisation in Singapore.2
High phishing awareness does not mean low exposure
Some 58% of Singapore respondents said their organisation had experienced at least one successful AI-driven phishing attack in the previous 12 months, compared with 44% globally. Singapore also had the highest reported rate among the markets surveyed. At the same time, 59% correctly identified AI-generated phishing emails, above the global figure of 53%. In addition, 78% reported an increase in phishing attempts.2
3
These figures measure different things: reported ability to recognise phishing, the volume of attempts respondents say they are seeing, and whether an attack succeeded. They show why detection awareness alone is not a complete security measure. They do not establish why attacks succeeded or indicate the risk level of every Singapore organisation.
MFA coverage and login methods are not the same thing
A reported 81% said their organisations enforced MFA across all applications and services. But broad MFA coverage does not tell us whether every authentication method is equally resistant to phishing, or whether employees encounter a consistent login experience.2
3
The survey figures also describe varied methods in use. Respondents reported mobile time-based one-time-password (TOTP) or push authenticator apps at 49%, and usernames and passwords at 41%. The mix also included SMS authentication, device-bound passkeys, hardware security keys and synced passkeys. Meanwhile, 72% said their organisation used different authentication methods across applications.2
That variation matters operationally: employees may face different sign-in steps from one service to another. Yubico’s broader survey findings describe a gap between security knowledge and everyday practice, while Okta’s coverage highlights authentication friction as part of the adoption challenge.1
6
The figures also point to onboarding as a place to examine. A reported 58% said new employees were issued traditional usernames and passwords. That suggests password-based access can remain part of the initial setup even as organisations adopt other authentication methods; it does not, on its own, show how widely those credentials are used later.2
AI agents make identity and approval controls more urgent
The survey highlights concern about AI agents acting on employees’ behalf. Respondents placed importance on verifying an agent’s identity and authenticity (98%) and on review and approval before an agent acts (95%). At the same time, 51% were comfortable delegating low-risk operational decisions to agents, and 60% were comfortable allowing them to communicate with colleagues or clients on their behalf.2
These percentages describe views and comfort levels, not proof that organisations have deployed verification or approval controls. But they frame a practical governance question: if an agent can take action or communicate as part of someone’s work, teams need to know which identity it is using, what it is allowed to do, and when a person must approve the next step. Yubico’s discussion of AI as a growing digital workforce similarly underscores the need to consider machine identities alongside human ones.1
What organisations can take from the findings
The survey’s clearest implication is to treat authentication as a protection design problem, not just a matter of adding more login options or training people to spot suspicious messages. Organisations can review whether phishable methods are being replaced or simply coexist with newer ones, and whether onboarding defaults reinforce the intended standard.1
2
For AI agents, the same principle applies: define the agent’s identity and permissions, and set approval requirements appropriate to the actions it can take. The survey signals that respondents see verification and review as important; the reported comfort with delegation makes it especially useful to distinguish stated safeguards from controls actually in place.2
In short, Singapore’s survey results show a notable mismatch: respondents report strong phishing recognition and widespread MFA, yet successful AI-driven attacks remain common. The figures are a warning to examine how authentication and agent controls work in practice—not a definitive scorecard for every organisation.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "Singapore’s AI phishing paradox: strong detection, high exposure"?
Singapore respondents reported the survey’s highest rate of successful AI driven phishing: 58%, compared with 44% globally—even though 59% correctly identified AI generated phishing emails.
What are the key points to validate first?
Singapore respondents reported the survey’s highest rate of successful AI driven phishing: 58%, compared with 44% globally—even though 59% correctly identified AI generated phishing emails. MFA coverage was widely reported, but respondents also described a mix of authentication methods, including passwords and app based codes.[2][3]
What should I do next in practice?
Respondents valued identity checks and human review for AI agents, while many were also comfortable delegating tasks to them—making clear permissions and approval boundaries important.[2]