No survey can give your firm's odds, but incidents are common: almost 9 in 10 Singapore organisations surveyed reported one in 2025. The Cyber Security Agency (CSA) surveyed 2,005 businesses and non-profits. Your first five controls: offline backups, a second login step, staff payment checks, automatic updates and a response plan. General information, not legal advice.
At a glance: incidents are common, and many businesses think they are not a target
How likely is a cyber incident for a business like mine?
Likely enough to plan for, but no public figure gives your own firm's odds, and this page will not invent one.
Odds check
What the survey can and cannot tell you
The odds check never prints a probability for your firm, because no source supports one.
| Assumption | Our reading of the data |
|---|---|
| Nine in 10 had one, so my chance is 90% | Not your odds; a share of survey respondents |
| We are too small to be a target | Not safe to assume; 46% of businesses thought so |
| We had no incident last year | Not proven; your quiet year is one data point |
| Our IT vendor handles security | Partly; ask your vendor to show you the controls working |
| Give me a percentage for my firm | No; nobody can from this survey |
CSA's figure is a share of the businesses and non-profits that answered a survey in late 2025, and it cannot see your controls. Read it as a sign that incidents are common, and that you should plan for one. An incident is also wider than a breach: the survey's list includes phishing.
Which five controls come first?
Start with your offline backups, then your second login step, staff payment checks, automatic updates and a one-page response plan: one control in each Cyber Essentials area.
The first five, one per Cyber Essentials area
| Control, in our order | Area | What it limits |
|---|---|---|
| 1. Offline, tested backups | Backup | Your lost files after ransomware |
| 2. Second login step on email, bank, admin | Secure/Protect | Logins with your stolen password |
| 3. Call back before any payee change | Assets (people) | Your payments to a fake account |
| 4. Automatic updates; retire unsupported kit | Update | Attacks on known flaws in your software |
| 5. One-page plan with the helpline number | Respond | Your delay and confusion on day one |
The order is our judgement: recover first, then block the commonest ways in. Controls 1 to 3 answer CSA's top three incident types in 2025: ransomware, compromised credentials and social engineering such as phishing. Put the Cyber Incident Helpline number, 6890 9555, on your plan.
... backups are only as valuable as their protection from threat actors.
Personal Data Protection Commission, Guide to Data Protection Practices for ICT Systems, Case Study 8, revised 20 July 2026.
How does an attack get past a missing control?
Through one gap at a time: a phishing email, stolen password or unpatched device lets an attacker in, and your backups and response decide the damage.
How an attack gets past a missing control
Each step of an attack on you, then the control that cuts it there (green).
Both chains are PDPC cases: a weak password on a web console let an attacker take personal data, and an unsupported firewall plus an admin account led to deleted backups. Not every attack needs a login; a web form can steer your AI agents, as prompt injection in sales agents shows.
Why do businesses put security off?
The most-cited reason is know-how: 56% of businesses in CSA's survey named a lack of knowledge and experience, and 46% saw themselves as unlikely targets.
Interactive chart
Know-how is the barrier businesses cite most
Share of businesses citing each barrier, CSA survey, October to November 2025.
Lack of knowledge and experience: 56%. See themselves as unlikely targets: 46%. Insufficient manpower and resources: 37%.
| Barrier | Businesses |
|---|---|
| Lack of knowledge and experience | 56 |
| See themselves as unlikely targets | 46 |
| Insufficient manpower and resources | 37 |
Business email compromise is a scam aimed at firms like yours: SPF recorded 262 such scams from January to June 2026, up from 156 a year earlier.
Illustrative: your bookkeeper gets an email from a regular supplier with new bank details; under control 3 she phones the supplier on the number you already hold before you pay. Our payment approval rule sets out that step.
Which basics are most often missing?
Asset management and protection, at 71% adoption each in CSA's survey, against 80% for software updates. If your updates are good but you have no offline backup, ransomware can still take your files.
Interactive chart
Updates lead; asset management and protection trail
Organisations surveyed by CSA. All five Cyber Essentials areas ranged from 71% to 80%.
Software and system updates: 80%. Asset management: 71%. Protection: 71%. Backup and Respond fell within the same 71% to 80% range.
| Area | Adoption |
|---|---|
| Software and system updates | 80 |
| Asset management | 71 |
| Protection | 71 |
Where Origin Pi stands
In our view, fix these five before you connect an AI agent to your email, CRM or payments. An agent that logs in with your accounts has your staff's gaps. Tick only what is true for you today.
Scorecard
Your first five controls: 10 checks
Your result is a gap list, not your odds of a breach. Nothing leaves your browser.
- 0 to 49%: Exposed. Several core controls are missing; start with your backup.
- 50 to 89%: Partly in place. Close your missing 3-point controls first.
- 90% and above: Core controls in place. Close any open supporting check; not a low-risk rating.
Illustrative weights: each core control counts 3 points and its supporting check 2 (total 25), so missing any core control keeps you below green. Not legal advice or a certification.
Our AI governance work gives your agents their own logins, limited access and an audit trail; business automation builds your workflows on top. The Bee Cheng Hiang case details one Singapore breach; our incident response guide covers who you tell. For a second reader on your five, talk to us.
Take the data with you
Cite this post if you reuse the data.
