Businesses are embracing emerging technologies, but information security focus remains shaped by compliance requirements: KPMG�s 2022 Cyber Trust Insights

• 76 percent of Singapore business leaders admit that information security at their organisation is still shaped by compliance requirements rather than long-term business ambitions

• Top factor affecting trust for Singapore business leaders is recent data breaches or other cyber incidents (42 percent), while global business leaders are more concerned over how data is protected (36 percent).

• 8 in 10 Singapore businesses cite increasing trust across the stakeholder spectrum as the leading consideration for their cyber-risk programme, as they believe increased trust will deliver improved profitability (46 percent), growth in market share (36 percent), and enhanced business reputation (34 percent).

SINGAPORE – Media OutReach – 13 October 2022 – Majority of business leaders globally (65 percent) and in Singapore (76 percent) are planning and implementing their information security based on compliance requirements rather than considering long-term business ambitions. These findings were unveiled in KPMG’s 2022 Cyber Trust Insights report which surveyed 1,881 executives (largely C-Suite and Board members) from over 30 countries.

This comes despite the fact that organisations are placing advanced data and sophisticated analytics at the heart of their operations and reshaping customer experiences with innovative digital services (see Table 1), all of which are likely to introduce new cybersecurity challenges. For instance, majority of business leaders (Global: 78 percent; Singapore: 86 percent) surveyed in KPMG’s 2022 Cyber Trust Insights indicate that artificial learning (AI) and machine learning (ML), that synergises with technologies such as IoT and 5G, raise unique cybersecurity challenges that require special attention.

Wong Loke Yeow, Partner of Cyber Advisory at KPMG in Singapore said, “Majority of businesses are expected to embrace disruptive new platforms (including Web3 and the Metaverse) within two years and, over the next three years, increasingly ramp up their investment in areas such as internet of things (IoT), edge computing and 5G. Against this backdrop, building and protecting trust will be integral to how businesses operate and interact with stakeholders. Weaving cybersecurity into the fabric of the organisation, positioning the role of the Chief Information Security Officer (CISO) as a key executive, securing the support of leadership, and collaborating with other partners in the corporate ecosystem will be key to providing the assurance consumers desire and securing corporate reputation.”

Table 1: Digital Experiences that Global and Singapore business leaders expect to invest in over the next three years

Digital Experiences	Global	Singapore
Multi-channel integration to improve customer experience/business partners	36%	50%
Use of experience data to customise digital interactions in real time with customers/business partners	37%	46%
Open APIs providing direct access to services for customers / business partners	28%	32%
Chatbots and other AI customer interaction technologies	28%	32%
IOT devices directly interacting with customers/business partners	29%	28%
Hyper-personalised/tailored services or products	26%	26%
Greater use of self-serve channels for customers/business partners	33%	26%
Digital twins modelling and simulating aspects of the business	24%	24%
New digital channels to market	30%	22%
Use of virtual or augmented reality as interaction mode	29%	14%

Source: KPMG’s 2022 Cyber Trust Insights survey

Top factor undermining stakeholder trust is data breaches and cyber incidents

Close to half of Singapore’s business leaders (46 percent) and over one-third of business leaders globally (37 percent) also note that trust in their organisations affects profitability, can deliver growth in market share (Global: 29 percent; Singapore: 36 percent), and is critical for reputation (Global: 30 percent; Singapore: 34 percent).

Data security continues to be a key determinant of stakeholder trust in Singapore. Local business leaders said the top factor affecting trust in their organisation’s ability to protect and use data is recent data breaches or other cyber incidents (42 percent), while global business leaders cited concerns over how data is protected (36 percent). Table 2 details these factors.

Hence, many companies have made it their priority to build stakeholder trust. 8 in 10 Singapore businesses cite increasing trust across the stakeholder spectrum as the leading consideration for their cyber-risk programme. This high value placed on providing assurance to consumers may stem in part from the accelerating growth of cybersecurity and privacy regulations globally and the repercussions of failing to meet them. Currently, 33 percent of Singapore executives worry about corporate reporting disclosures related to cybersecurity, while 47 percent worry about their ability to meet existing or new cybersecurity regulations when activities are outsourced to digital service providers. This is compared to 34 and 36 percent of global executives respectively.

Table 2: Factors leaders say are undermining stakeholder trust in their firm’s ability to protect and use their data

Factors undermining stakeholder trust	Global	Singapore
Recent data breaches or other cyber incidents	30%	42%
A lack of clarity over why data is required for a particular service and the benefits of sharing or providing data	32%	38%
Concerns over how their data is protected	36%	34%
Broader public concerns over privacy and data protection	34%	34%
Concerns over a lack of transparency around data use	31%	30%
Concerns over how their data is used or shared	35%	30%
A lack of initiatives to build trust with stakeholders	26%	26%
A lack of confidence in the governance mechanisms in place	28%	26%
Adverse publicity surrounding your organisation	23%	24%
A failure to fully compensate someone for the use of their data	24%	16%

Source: KPMG’s 2022 Cyber Trust Insights survey

Akhilesh Tuteja, KPMG’s Cyber Security Practice Leader, commented “Each new data activity that an organization embarks on exposes them to potential vulnerabilities and risks that should be guarded against to maintain trust. Executives are starting to acknowledge these risks – many of our respondents (78 percent) agree that new technologies [such as AI and machine learning] come with unique, and often ill-understood, cybersecurity and trust challenges. If these challenges aren’t adequately addressed, the risk to an organization can be extreme.”

The increasing emphasis placed on environmental, social and governance (ESG) goals in recent years also means that stakeholder demands for greater transparency and oversight now extend to organisations’ cybersecurity posture. About 3 in 10 Singapore companies (28 percent) see their Chief Information Security Officer (CISO) or information security team as an integral part of their ESG team that drives a wide variety of ESG-related activities compared to 17 percent globally. As organisations recognise the growing social imperative around this topic, that proportion is expected to grow.

Nonetheless, in a separate survey of CEOs by KPMG, nearly three-quarters of organisations (72 percent) in Singapore are confident in their preparedness against a cyber-attack, higher than the 69 percent in Asia Pacific and 56 percent globally¹. The Cyber Trust Insights report lends some credence to this, with companies saying that they have implemented risk modelling to quantify their cyber risk and visually report risk to the board (Global: 73 percent; Singapore: 84 percent), and that their risk modelling is based on comprehensive data on threats and vulnerabilities (Global: 67 percent; Singapore: 86 percent).

Businesses can be more proactive on cybersecurity collaborations

An area which businesses see room for improvement is being active members of a broader partnership in the ecosystems they operate in. Businesses know they do not operate in a vacuum, especially as they continue their digitalisation journey.

58 percent of Singapore companies admitted their organisation is not proactive enough in its cybersecurity collaborations, such as with professional bodies and the government, comparable to 53 percent of global companies which had the same sentiment. Companies believe that the biggest advantage of collaborating on cyber security is the reduction in time it takes to identify data breaches (Global: 38 percent; Singapore: 44 percent) and that it allows them to better anticipate cyber-attacks (Global: 44 percent; Singapore: 36 percent).

At the same time, businesses cite understandable concerns such as revealing internal details about their security posture (Global: 36 percent; Singapore: 46 percent) and unnecessarily revealing their security weaknesses or failures (Global: 35 percent; Singapore: 36 percent) as barriers to participating in such external collaborations.

^[1]KPMG 2022 CEO Outlook

Hashtag: #KPMG

The issuer is solely responsible for the content of this announcement.

About KPMG?

KPMG in Singapore is part of a global organisation of independent professional services firms providing Audit, Tax and Advisory services. We operate in 144 countries and territories with more than 236,000 partners and employees working in member firms around the world. Each KPMG firm is a legally distinct and separate entity and describes itself as such. KPMG International Limited is a private English company limited by guarantee. KPMG International Limited and its related entities do not provide services to clients.

For more information, visit kpmg.com.sg.
LinkedIn: linkedin.com/company/kpmg-singapore