Singapore National Resilience Assessment 2026

The Five Key Findings

First: Physical supply exposure is the dominant driver. Singapore imported 149 million tonnes of oil equivalent of energy in 2024, up 2.9 percent year-on-year, with petroleum products comprising 59 percent of total energy imports [#28]. More than 90 percent of food supply crosses a border before reaching a shelf [#50]. Trade-route exposure scores 7.5, the highest component in the Resources domain. Energy supply chain scores 7.1, food and water security 6.75, critical materials 6.5. These are not policy failures: Singapore's food resilience strategy was updated in November 2025 [#51], and the LTMS-PIP regional power integration project doubled electricity trading capacity in September 2024 [#29]. The exposure is geographic and economic. The city occupies 734 square kilometres [#546] beside the Phillips Channel, where the Strait narrows to roughly 2.7–3 kilometres [#103], with no hinterland. No reserve accumulation neutralises that geometry.

Second: The government digital core is the highest-risk single component at 7.7 and sits at the centre of the most dangerous cascade path. Singpass is classified by the Ministry of Digital Development and Information as foundational digital infrastructure and a Smart Nation strategic national project [#515], integrating multi-factor authentication and biometric face verification cross-referenced against Immigration and Checkpoint Authority records [#516]. That concentration of identity, verification, and government service access in a single platform is the sharpest single-point exposure in the assessment. A successful intrusion does not merely disrupt a service — it undermines the state's capacity to deliver, and delivery is the primary basis on which performance legitimacy (3.25, currently the Identity domain's strongest support) rests. Operation CYBER GUARDIAN, the multi-agency operation defending Singapore's telecommunications sector against UNC3886, ran from summer 2025 into early 2026 [#326]. The threat is not theoretical.

Third: Financial and institutional buffers are deep enough to absorb shocks that would destabilise most comparably sized states. Official reserve assets stood at US$376.7 billion in December 2024, with foreign currency reserves of US$362.8 billion [#177]. FY2025 closed with a fiscal surplus of SGD 15.1 billion, equivalent to 1.9 percent of GDP [#202]. The IMF's 2026 Article IV found the banking system carrying a capital adequacy ratio of 18.5 percent and a non-performing loan ratio of 1.1 percent [#148]. Capital-market access scores 2.5, fiscal structure 2.5, currency and reserves 2.95, three of the four lowest component scores in the assessment. These buffers transform what would be existential shocks for most small economies into price events or managed disruptions. They do not, however, protect against simultaneous degradation of the physical corridors through which the city feeds, fuels, and funds itself.

Fourth: Cyber exposure sits in the Preservation and Intelligence domains and is the primary vector by which physical vulnerability propagates inward. National cyber defence scores 6.4; critical infrastructure protection (OT/ICS) 6.3; government digital core 7.7; supply-chain security 6.0. The Cyber Security Agency has mandated Cyber Trust Mark certification for all critical information infrastructure operators by end-2027 [#283], and 219 alerts and advisories were issued in 2024 alone [#284]. At the OTCEP Forum 2026, the responsible minister stated that AI enables threat actors to exploit weak OT hygiene within hours and identify hundreds or thousands of vulnerabilities [#327]. The gap between Singapore's cyber governance ambition and the exposure of the systems it governs is the mechanism by which an external physical disruption — a route closure, a fuel supply interruption — can combine with a concurrent cyber campaign to produce compounded effects that neither threat generates alone. DBS Bank suffered five major service disruptions within eight months in 2023, prompting MAS to impose a six-month pause on non-essential activities [#117]. That record in a single institution illustrates the broader OT and digital-core gap.

Fifth: The Identity layer's mid-range score (5.00) conceals a legitimacy base that is delivery-dependent and generationally untested. Performance legitimacy scores 3.25 — currently intact, but sustained by ongoing delivery, not by ideological attachment independent of outcomes. Singapore's first official wealth Gini coefficient, published by the Ministry of Finance in February 2026, stood at 0.55, significantly above the post-tax income Gini of 0.38 [#754]. Median public hospital wait times rose in 2024, attributed to COVID-19-related infrastructure delays and rising demand from an ageing population [#792]. The resident labour force participation rate fell for the third consecutive year in 2024, to 68.2 percent [#227]. The Internal Security Department has stated that race and religion remain the most visceral and dangerous fault lines in society [#735]. Singapore has not experienced large-scale communal unrest since the 1960s [#735], and national purpose and founding-narrative coherence (S1) scores 5.5, but that stability has been maintained under conditions of continuous delivery. How cohesion behaves when delivery visibly falters is the question this assessment cannot fully resolve.

---

The Most Dangerous Cascade Path

Trade-route exposure (E5, 7.5) and fuel and power dependence (E2, 7.1) are the entry points. A sustained closure or degradation of the Singapore Strait, or material disruption to the two or three dominant fuel supply routes, loads the physical substrate immediately. That stress reaches critical infrastructure protection (P4, 6.3), where OT systems governing power, water, transport, and finance carry documented hygiene weaknesses and are susceptible to exploitation within hours once a threat actor achieves access [#327]. From P4, the path moves to the government digital core (I3, 7.7). Singpass and the registries it underpins concentrate identity verification across virtually all government service delivery [#515]. A sustained outage or integrity failure at that layer interrupts the operational proof that the government delivers — and that is where the cascade reaches the Identity domain. Performance legitimacy (S6, 3.25) is the terminal node: currently strong, but resting on delivery. A state whose founding narrative emphasises performance and competence absorbs service-delivery failure differently from one whose legitimacy is grounded in ideology or tradition. The digital core has the least redundancy of any node on that path.

Secondary cascade paths amplify this. Information integrity (I7, 6.1) and the public media ecosystem (I9, 6.8) are the channels through which foreign disinformation can insert narrative into a disruption. A French Military School Strategy Research Institute report cited by the Ministry of Home Affairs in 2021 characterised Singapore as particularly vulnerable to foreign influence operations because of its size, hyperconnectivity, and social composition [#419] — a multi-ethnic, multi-religious society that the Internal Security Department identifies as carrying race and religion as its most visceral fault lines [#735]. A physical disruption that concurrently triggers digital-core failures and is framed by a coordinated disinformation campaign along ethnic or religious lines would move through all five domains simultaneously: Resources → Preservation → Intelligence → Identity → Game. Singapore's financial sector contributes approximately 14 percent of GDP [#946]; its status as a financial centre depends on the perception of stability that such a cascade, at scale, would erode.

---

Strategic Bottom Line for Decision-Makers

Three priorities, sequenced by position on the cascade path.

First — harden the government digital core. I3 at 7.7 is the convergence point where physical and cyber threats reach the legitimacy base. The Cyber Trust Mark mandate covers critical information infrastructure operators by end-2027 [#283]; enforcement rigour and the pace of assurance testing for Singpass and the civil registries specifically determine whether the cascade path through I3 is broken before the next major intrusion. The 2026 FATF Mutual Evaluation found that MAS enforcement actions remain relatively low and sanctions are not proportionate to the scale of institutions and the seriousness of breaches [#364]. A compromised financial institution and a compromised identity registry occurring simultaneously produce a compounded public confidence effect that reserve assets cannot immediately offset.

Second — harden OT/ICS across the energy and water sectors. The cascade's entry point is physical; the mechanism carrying it inward is OT vulnerability. The OT Cybersecurity Masterplan launched on 20 August 2024 [#333] and the CII Supply Chain Programme [#437] are the right frame. The Defence Cyber Command, established in 2025 [#254], adds military-grade capability to the whole-of-government posture. The operative question is whether the pace of OT vendor assurance matches the AI-accelerated threat timeline stated publicly by the minister [#327].

Third — watch generational cohesion as the leading indicator. Generational cohesion (S5) scores 5.2 — not acute. The wealth Gini at 0.55 [#754], the healthcare-access trajectory [#792], and the declining labour participation rate [#227] are the variables that determine whether that score moves. Decision-makers who want a single early signal should watch whether public hospital wait times and housing transaction volumes diverge from the trend lines in Singapore Public Sector Outcomes Review 2024: those are the earliest observable signals that performance legitimacy is being tested below the threshold at which the government's own statistical sensing typically generates a policy response.

Singapore's resilience architecture is sophisticated, well-funded, and demonstrably functional under the shocks it has faced. The 5.4 reading is a warning about stress combinations, not individual events. Reserves absorb single shocks. The legitimacy base absorbs short disruptions. What neither absorbs well is simultaneous degradation of physical corridors, digital infrastructure, and information integrity — the three layers the most dangerous cascade path traverses in sequence. Every recommendation in this assessment aims at thickening the walls between those layers.