Red Hat to staff Singapore AI hub with 18 as patching lags

By Tom Whitfield

Red Hat unveiled its Singapore AI Centre of Excellence on October 22. The centre will start with 18 staff as some Asian organizations patch systems only every six to nine months.

A patching gap measured in months

Red Hat vice-president and general manager for Asia-Pacific Daniel Aw said global enterprises patch on average every 90 days. Some Asian organizations take six to nine months, a delay he called untenable as AI finds vulnerabilities faster than human teams.

Frontier models can now scan a whole corporate IT system and expose weaknesses that people missed, Aw said. The old cadence worked when flaws surfaced slowly; it no longer does against AI-assisted discovery, making manual remediation a poor race strategy.

Open-source software adds another blind spot because many chief information security officers cannot say how much runs inside their organizations. Aw said: “In the past, securing it was never a thought in their minds.” He called the larger challenge ensuring enterprises run enterprise-grade infrastructure; free community versions can be less secure than companies assume, particularly with AI.

His warning extended to operations. Businesses must automate patching and upgrades, because without automation they cannot operate at the speed of AI. Secure applications still need a strong foundational platform.

Singapore gets an 18-person engineering team

Red Hat established the AI Centre of Excellence with support from Singapore's Economic Development Board. The centre brings engineering capability into Asia-Pacific and shortens the feedback loop to Red Hat headquarters.

Its first 18 employees will include forward-deployed engineers, solution architects and project managers. Red Hat unveiled it beside its annual summit in Singapore on October 22. Aw said customers in the region often rank features differently from other markets, so a local team can respond more effectively.

The centre will also host joint engineering with defence and telecom users. Their requirements range from defence systems restricted to on-premise networks to telecom infrastructure where operators must maintain certainty.

DSTA builds controls before deployment

For Singapore's Defence Science and Technology Agency, visibility is a precondition for deploying AI at all. Deputy director for AI development Akash Philip described the security community's “lethal trifecta”: an agent can access sensitive data, encounter untrusted content and send information outside the network.

Agents often need all three capabilities to be useful, Philip said, but together they create a recipe for disaster. DSTA agents already handle sensitive data, so the agency builds those risks into its AI platform from the outset rather than adding controls after deployment. Philip described the experiments as “controlled and not like free fall.”

The agency uses machine-learning operations, or MLOps, to define each agent's reachable systems and permissions before release. Teams select a model, test it against the specific problem and address security before production; no off-the-shelf model goes directly into service.

Every model passes that process before entering DSTA's on-premise and closed networks. The controls leave development teams free to concentrate on operational use cases. DSTA also signed an agreement with Red Hat to co-engineer AI solutions at the centre, combining defence and on-premise requirements with Red Hat's open-source expertise to scale solutions faster.

Singtel draws a line in the network

Singtel has deliberately withheld permission for AI agents to change its network. Chief AI and data analytics officer Geet Bhanawat said the company must maintain certainty in critical infrastructure because AI is non-deterministic.

Network incidents also remain rare, leaving Singtel with little data on which to train. Despite that constraint, the operator is building toward an autonomous network under its 1-5-60 target: detect a fault within one minute, identify the root cause within five, and restore service within 60 minutes.

The system remains unfinished. Singtel must work with equipment suppliers such as Ericsson and Nokia to reach a fully autonomous network, and no telecom operator has achieved 100 per cent autonomy, Bhanawat said.

At a less critical customer-facing layer, Singtel permits more autonomy. Its customer-service agent handles around 70 per cent of calls without human involvement and scores customer satisfaction above 85 per cent. That performance has released employees to manage more complex customer solutions.

What does this change for Asian security teams?

It changes the order of work. Asian organizations need an inventory of open-source components, automated patching and upgrade pipelines, and enforceable foundations for agent access before adding more AI. Red Hat's Singapore centre supplies local engineering, while DSTA and Singtel offer two practical models: embed controls from the start for sensitive workloads, and limit autonomy where certainty still matters.

The priority is simple: remove months between exposure and repair. AI has shortened the discovery window; enterprise patching calendars have not caught up. The centre offers local engineering and faster feedback. Whether customers compress patching from months to 90 days will be the useful metric.