The global race to develop more advanced artificial intelligence has largely been framed as a contest of capability — defined by who can build the smartest model, deploy the most capable agents and reach the next frontier first. But cybersecurity is showing why capability is only part of the equation, writes Richard Ireland, CEO of GovWare, in a commentary for BusinessWorld.

AI is increasing the speed at which vulnerabilities can be identified, attacks launched and defensive actions taken, and significant investment does not eliminate exposure. Recent research found that while 83% of cybersecurity leaders are increasing spending, nearly nine in 10 organizations experienced cyberattacks in the past year.

The challenge increasingly extends beyond the defenses of any one organization to the connections between them. A company can invest heavily in its own defenses, a government can strengthen national safeguards, and a technology provider can introduce stronger controls. Yet modern digital systems depend on interconnected infrastructure, suppliers, cloud platforms and services that rarely sit within one organization or jurisdiction. As cyber activity accelerates and becomes more autonomous, the ability to coordinate across those boundaries may become as important as the ability to defend within them.

When Machine Speed Meets Organizational Boundaries

Agentic systems raise the stakes because they can move from signal to decision to action with less human intervention. The challenge is not only how much authority organizations give AI agents, but what happens when their actions extend beyond organizational boundaries into systems, data and infrastructure controlled by others.

AI agents are also part of a growing universe of non-human identities, from applications and automated services to machine accounts that interact across digital environments. As their autonomy increases, organizations need clearer boundaries around what they can access, what actions they can take and where human intervention remains necessary.

Accountability becomes harder when activity crosses organizational boundaries. Different organizations may operate under different controls, regulations and risk thresholds even when their systems depend on one another. At machine speed, detecting a problem is only one part of the response. How quickly information can be shared, responsibility established and coordinated action taken becomes just as important.

The AI race itself offers a useful lesson. Anthropic has signaled openness to a coordinated global pause in advanced AI development if competitors do the same. Similarly, OpenAI's top scientist has warned that AI is advancing so rapidly that it is becoming increasingly difficult for humans to understand and control, and expects leading AI labs to voluntarily slow development for safety reasons. Taken together, these signals point to a challenge that extends beyond any one company: in a competitive environment, exercising greater caution becomes harder if others continue moving ahead.

Cybersecurity faces a version of the same challenge. Individual organizations can strengthen their own posture, but shared risks require shared readiness.

Cyber Risk Does Not Stop at Organizational Boundaries

Cybersecurity has evolved from a specialist technology concern into a whole-of-economy issue connecting business continuity, critical infrastructure, supply chains, financial systems and public trust, and agentic AI is accelerating that evolution. Strong organizational defenses remain essential, but they cannot fully address risks that propagate through shared infrastructure, third parties or cross-border technology ecosystems. A compromised supplier, shared cloud service or critical technology provider can affect organizations with little direct control over the source of an incident. As these dependencies deepen, resilience increasingly depends on how quickly organizations can exchange information and coordinate a response.

The same applies at the national level. Singapore's Minister for Digital Development and Information, Josephine Teo, noted earlier this year that the most advanced AI models are developed in only a handful of countries, while cooperation on AI safety remains limited. Yet the technologies and their potential risks cross borders.

For Asia, the coordination challenge is particularly important. The region spans economies with different regulatory environments, levels of digital maturity, infrastructure and cyber readiness. There is no single operating environment, yet an incident originating in one market or part of a supply chain can have consequences elsewhere.

Building Readiness Before a Crisis

Singapore has an important role to play in facilitating these exchanges. Its ability to bring together governments, global technology companies, businesses and practitioners allows perspectives that do not always sit at the same table to be heard. The Singapore International Cyber Week and GovWare provide opportunities for such conversations, as AI security, accountability and cross-border risk increasingly require both public- and private-sector perspectives.

Convening matters not because any one forum has all the answers, but because collective readiness must be built before a crisis demands it. Governments, businesses and technology providers will need greater alignment on how risks are shared, when information should move across organizational boundaries and where cooperation should take precedence over competition. That same agenda offers a concrete set of markers to watch: whether information moves across organizational boundaries more readily when incidents strike, whether common expectations for what AI agents can access, what actions they can take and where human oversight remains necessary take shape across industries and jurisdictions, and whether leading AI labs' stated willingness to slow development together evolves from statement into practice.

Competition remains an important driver of AI innovation, but progress in capability needs to be matched by progress in the safeguards, relationships and mechanisms for cooperation needed to deploy those capabilities responsibly. As cyber activity moves at agentic velocity, coordination cannot begin only after something goes wrong.

The next AI race will not simply test who can build the most systems. It will also test whether the institutions and relationships around them can move quickly enough to keep pace.

Richard Ireland is the CEO of GovWare. This commentary was first published by BusinessWorld.