Should cybersecurity be nationalised?

The debate at a recent industry discussion focused on the question of whether cybersecurity should be nationalized. While no plans have been proposed to put cybersecurity under state ownership, the argument presented suggests that cybersecurity is increasingly becoming a public good. This means that the benefits of improved cybersecurity extend beyond the individual companies that pay for it, as the security of one company helps protect others connected to it.

Historically, cybersecurity has been treated as a private good, with companies purchasing protection from their own budgets. However, the argument made at the event posited that this premise is becoming outdated. Cybersecurity is now increasingly a public good, as the benefits of improved security are shared among all companies and individuals connected to each other.

The comparison drawn to street lighting highlighted how the city funds and maintains street lights for the benefit of all residents, rather than each individual shopkeeper paying for it. Similarly, the argument suggests that cybersecurity should be paid for collectively by the government, with private firms handling the implementation and maintenance, because the benefits are shared across society.

Today, companies are expected to defend themselves against threats that are beyond their individual capabilities, particularly from nation-state attackers. However, the argument points out that asking individual companies to do this is unrealistic, especially as quantum computing advances and poses even greater risks. The people most in need of protection often cannot afford enterprise-grade cybersecurity, making them vulnerable entry points for attackers.

Two key questions arose from this discussion: who should pay for cybersecurity, and who should be held accountable when preventable failures occur? While Singapore has taken some steps in this direction, such as requiring baseline certification in sensitive sectors and providing funding schemes to help smaller firms, these measures do not constitute nationalization.

The realization is that cybersecurity is becoming a matter of shared responsibility, and the shift will likely lead to more sector requirements, security conditions in contracts, and a greater emphasis on proving compliance before providing services. Organizations will need to adapt by treating cybersecurity as an integral part of their reputation and trustworthiness, rather than just a cost item.

While nationalization may not be imminent, the direction is clear: cybersecurity is becoming a shared public good that requires collective effort and shared responsibility.