On 21 May, the Infocomm Media Development Authority (IMDA) announced two programmes to get 12,000 small and medium enterprises ready for AI and for the cyber risk that comes with it. I have spent years building software for businesses this size. The plan gets one important thing right, and runs straight at one problem no programme has ever really solved.
What was announced
Two partners, two tracks. Grab will run an AI programme for 10,000 food-and-beverage, e-commerce and retail SMEs — free online training, masterclasses, and a two-day course built with the Singapore University of Technology and Design (SUTD). Separately, RSM Stone Forest IT will run a Cyber2SME programme for 2,000 SMEs, offering free phishing-simulation exercises and workshops so owners can find their weak points before an attacker does.
The Cyber2SME mechanics are more specific than the announcement headline suggested. Each phishing simulation covers up to 30 employees at a participating business. Once it has run, the SME receives a performance report and a one-to-one advisory session with RSM cybersecurity specialists, rather than a certificate and a place on a mailing list.
These two partnerships are part of the larger Digital Enterprise Blueprint, which has supported more than 26,000 SMEs since May 2024 and aims for 50,000 by 2029.
The cyber half is the right instinct
The phishing drills are the part I would not change. When a small business gets breached, it is almost never a clever exploit. It is an email, a fake invoice, a call that sounds like the bank. The whole industry spent a decade selling shops firewalls and antivirus while the actual losses came through the front desk. Teaching an owner and their staff to recognise a phishing attempt does more for a ten-person company than any appliance. RSM running simulations, not lectures, is the difference between knowing about a threat and having felt one.
Where programmes like this usually fall short
The gap is not awareness. It is time. The owner of a hawker stall or a small retailer is already doing six jobs. A free two-day course is generous, and it still costs two days they do not have. Adoption schemes tend to count sign-ups and certificates, then quietly lose people at the step where the new skill has to survive a busy week. The measure that matters is not how many SMEs attend. It is how many still use what they learned three months later.
Three months on, the number that would settle it is not public
The programmes were announced on 21 May. As of late August, no uptake, completion or retention figures for either track have appeared in public reporting.
That is not unusual this early in a multi-year scheme, but it means nobody outside the programme can yet answer the central question. Sign-up counts would at least establish reach. The one figure that would show whether the design works is retention: how many of these businesses are still applying the training a quarter later. So far, no one involved has committed to publishing that number.
One detail does suggest the programme might do better on retention than most. A scheduled one-to-one session, booked against a named business and its own simulation results, is a harder appointment to let slide than an open invitation to a course.
What I would want for a small shop
Training helps, but defaults help more. The most useful thing we can give a small business is tools that are secure and sensible out of the box, so the safe choice is also the easy one — multi-factor authentication switched on by default, scam-aware payment flows, software that does not need a consultant to lock down. A shop owner should not have to become a security analyst to avoid losing their savings to a vishing call. Singapore is right to invest here. The version that works is the one that keeps showing up for these businesses after the launch event, and that lowers the bar to being safe rather than raising the bar to being trained.
Sources & cross-checks
Primary
IMDA — Partners with Grab and RSM Stone Forest IT to uplift 12,000 SMEs
Corroborated
RSM Singapore — Cyber2SME programme launch
Verified
The 21 May announcement, the 12,000-SME figure, the Grab and RSM programme splits and the SUTD course confirmed against IMDA's release, 2 June 2026. Programme mechanics — the 30-employee simulation cap, the performance report and the one-to-one advisory session — and the Digital Enterprise Blueprint totals were added on 23 August 2026 from IMDA's factsheet and RSM Singapore's programme release. No uptake, completion or retention figures had been published as of that date. Views are the author's own.
