Paul Wilcox, VP, APJ, Infoblox:

UNC3886 is a good example of how today’s threat actors are playing the long game — embedding themselves in critical infrastructure to quietly disrupt essential services, supply chains and everyday life.

With Singapore now requiring all CII owners to report their APT incidents, there’s a growing recognition that these threats are already happening. But, detection after the fact is too late. Enterprises need to stay one step ahead with preemptive tools that surface threats before damage is done.

APT groups often slip past traditional tools, which is why broader visibility is needed. DNS, as the layer that underpins every internet connection, is often an overlooked but invaluable tool in pre-emptively stopping attacks. With the right defences, 82% of domain-based threats can be stopped before they reach the network.

DNS is often a blind spot, but it doesn’t have to be. Early detection gives security teams a head start, before attackers gain ground.

Ian Farquhar, Security CTO, Gigamon:

The recent UNC3886 infiltration into Singapore’s critical infrastructure is a stark reminder that even the most secure nations are targets for today’s sophisticated threat actors.

These adversaries don’t smash through the front door; they operate with stealth, moving laterally within networks and hiding their activity in encrypted traffic that most security tools cannot inspect.

This is precisely why deep observability is no longer optional. Organizations must illuminate every corner of their digital environment, especially encrypted and lateral traffic where attackers often hide. Without it, defenders are effectively flying blind.

Ultimately, achieving pervasive visibility into all data in motion is the only way to counter these elusive threats. In an age where APTs evolve faster than perimeter defenses, it’s not just about building taller walls; it’s about shedding light on the entire battlefield. Only then can we meaningfully accelerate detection and outpace the adversary.

David Ng, Managing Director, Singapore, Philippines & Indonesia, Trend Micro:

The rise of APTs like UNC3886 and Earth Kurma highlights a critical reality for Southeast Asia: passive, “wait-for-a-breach” security no longer works. Singapore’s recent regulations also emphasize the need for a more proactive approach to cybersecurity.

Enterprises need to empower their security teams to identify vulnerabilities, prioritize threats by business impact, and implement mitigation strategies before attacks occur. Cyber Risk Exposure Management (CREM) enables this shift by going beyond simply visualizing risk.

When combined with a unified cybersecurity platform designed for real-time risk visualization, management, and automation, organizations gain enhanced visibility while streamlining response efforts to more effectively safeguard digital assets in today’s dynamic threat landscape.

For stealthy APTs, which often lurk undetected and move laterally through networks, CREM acts as an early warning system and risk-reduction engine. With a continuous and dynamic view of cyber exposure, it helps organizations stay ahead and ultimately build a more resilient cybersecurity posture.

Sanjay Yadave, Vice President & Managing Director, Greater Asia, Zscaler:

State-linked threat actors are stealthy and persistent, often bypassing traditional defenses and remaining undetected for long periods. Zscaler’s ThreatLabz recently uncovered two China-nexus campaigns that used legitimate websites and multi-stage infection chains to target vulnerable communities, illustrating how difficult it can be to identify and respond to such threats once they’ve taken hold.

Singapore’s new regulations are a necessary step toward improving national cyber readiness—given how advanced persistent threats operate, regulation and security must work hand in hand.

Timely reporting helps surface threats, but it only works if organizations have the tools to detect, contain, and neutralize them early. That means inspecting encrypted traffic at scale, identifying zero-day threats in real time, and limiting lateral movement through zero trust controls.

With threats evolving faster than ever, true resilience requires close collaboration between the public and private sectors — ensuring that policy, technology, and threat intelligence evolve together to stay ahead of increasingly sophisticated attacks.