Asian organisations are patching their systems far too slowly for an era in which AI can find vulnerabilities faster than any human team, warned Daniel Aw, vice-president and general manager for Asia-Pacific at Red Hat.
Globally, enterprises patch on average once every 90 days, he said. Some organisations in Asia patch only once every six to nine months.
That cadence was tolerable when flaws surfaced slowly. It no longer works when frontier AI models can scan an entire corporate IT system and surface weaknesses humans missed.
Compounding the problem is the widespread use of open source software. Many chief information security officers do not know how much of it is running in their organisations, Aw said.
“In the past, securing it was never a thought in their minds,” he said. “To me, that is the biggest challenge: making sure you have enterprise-grade infrastructure.”
Free community versions of open source software, while valuable, are less secure than many companies assume, particularly now with AI, he cautioned.
Businesses also need to automate patching and upgrades adding that “if you do not automate them, you cannot operate at the speed of AI”, he added.
Underpinning all of this is a strong foundational platform on which applications can run securely.
These concerns are among key reasons Red Hat has set up its AI Centre of Excellence in Singapore where it will bring its engineering capability to Asia-Pacific and shorten the feedback loop back to headquarters.
Customers in the region need often rank features differently from elsewhere, and a local team is better placed to respond, said Aw.
Set up with the support of the Economic Development Board, the new Red Hat centre will start 18 staff including forward-deployed engineers, solution architects and project managers. It was unveiled at the sidelines of Red Hat’s annual summit in Singapore on October 22.
For Singapore’s Defence Science and Technology Agency (DSTA), visibility is a precondition for deploying AI at all.
Akash Philip, DSTA’s deputy director for AI development, pointed to a principle from the AI security community known as the lethal trifecta: an AI agent that has access to sensitive data, is exposed to untrusted content, and can send information out of the network.
Agents often need all three to be useful, he noted, adding that together they are a recipe for disaster.
At DSTA, the first factor is a given: its agents handle sensitive data all the time, he said at the Red Hat event.
DSTA’s approach is to build those risks into its AI platform from the start rather than bolting on controls later, he noted.
Its AI experiments are “controlled and not like free fall”, he said, with machine learning operations (MLOps) used to decide upfront what each agent can reach and what permissions it holds.
Models are not pulled off the shelf and pushed into production. Teams must choose the right model, test it against the problem at hand and account for security before it goes live.
Every model passes through that process before it reaches DSTA’s on-premise and closed networks, leaving development teams free to focus on operational use cases, Philip explained.
DSTA has signed an agreement with Red Hat to co-engineer AI solutions at the new centre, pairing its knowledge of defence and on-premise requirements with Red Hat’s expertise in open source to scale solutions faster.
Among Red Hat’s other partners at the event, Singtel may offer the clearest lesson in restraint for AI agents. It has deliberately stopped short of letting AI agents make changes to the network, said Geet Bhanawat, Singtel’s chief AI and data analytics officer.
AI is non-deterministic and in critical infrastructure the operator has to be certain, he stressed. Network incidents are also rare, leaving little data to train on.
Nonetheless the telco is working towards an autonomous network with a target it calls 1-5-60. That is, detect a fault within one minute, find the root cause within five, restore service within 60.
This system is still being built and it would need to work closely with telecom equipment providers like Ericsson and Nokia to get to a 100 per cent autonomous network. No telecom operator in the world has achieved this yet.
Where the stakes are lower, Singtel has gone further. Its customer service agent handles around 70 per cent of calls without human involvement, with customer satisfaction above 85 per cent, said Bhanawat.
That has freed staff to handle more complex customer solutions, he added.
