Why Cyber Defenders Hack Their Own Systems on Purpose

If a system was built securely in the first place, why would its own defenders keep trying to break into it? 

That’s because even the most carefully secured systems can have hidden weaknesses. A software update, a new feature or a simple change in permissions can create an opening that attackers might exploit. 

To understand how these weaknesses can be uncovered, a GovTech security incident response officer set up a simulated attack in a cloud environment, then attacked it from inside, as though an attacker had already slipped past its defences. 

What happened next revealed how tiny security gaps, when combined, can create much bigger risks. 

Here's how cybersecurity teams like Red and Blue Teams work together, why defenders assume attackers are already inside, and what that mindset means for the digital services you use every day. 

Playing on both sides 

In cybersecurity simulations, defenders often take on two complementary roles: one that simulates attacks, and another that detects and responds to these attacks. 

Red Team: A group that deliberately behaves like an attacker. With permission, it tries to break into an organisation's systems, then reports exactly how it got in so the weaknesses can be fixed before a real attacker finds them. 

Blue Team: The group that defends those systems. It monitors suspicious activity, identifies vulnerabilities, and strengthens security over time. 

Think of it as the difference between hiring someone to test whether your locks can be picked and hiring someone to watch the doors. Both matter, and neither is enough on its own. A tested lock that nobody watches can still be picked without anyone noticing. A watched door with a weak lock also gets breached eventually. 

The two roles also sharpen each other. It is hard to defend against something you do not understand. Knowing which techniques an attacker would try, and which shortcuts they would look for, tells a defender where to look out first. 

Assuming the break-in has happened 

The exercise started from an uncomfortable premise: instead of asking whether an attacker could get in, the team assumed one already had done so. 

No firewall, password policy or access control can fully stop every attempt of breaking in. Once you accept that someone will eventually get past the perimeter, the question shifts from "can someone get in?" to "what could they do once inside?" 

The team began with the access of a single low-privilege user (an account with limited rights), the kind of foothold an attacker might gain from one stolen login. The task was to see how far that foothold could stretch. 

It stretched a long way. Resources in the environment followed a predictable naming pattern, so the team could guess the names of other accounts and find one they were not meant to reach. That account was misconfigured, with far broader rights than it needed. By exploiting the account's excessive permissions, the team was able to elevate its access and reach data that should have been restricted. 

On its own, a predictable naming pattern might seem harmless. So might an account with more permissions than it needs. But when chained together, a seemingly small gap can become a much larger security breach. 

Real break-ins work the same way. They rarely come down to one unlocked door. More often, a window left ajar, a spare key in a predictable spot and a side gate that does not quite latch add up to a path nobody designed on purpose. 

This is not hypothetical. In 2025, Singapore's four major telcos detected intrusions by UNC3886, an advanced persistent threat actor, and alerted the Cyber Security Agency of Singapore (CSA) and the Infocomm Media Development Authority (IMDA) (opens in new tab). The response that followed, Operation Cyber Guardian (opens in new tab), ran for more than 11 months and involved over 100 cyber defenders from six agencies, including GovTech. Much of the work went into limiting how far the attackers could move once inside the networks. 

Three lessons to close weak spots 

Finding a weak spot is only half the work. These three habits help defenders fix what they find and catch what comes next. 

1. Limit unnecessary access and review permissions regularly. Access rights tend to pile up over time. Someone is given temporary access for a project, and it is never revoked once the project ends. Periodic reviews catch permissions nobody meant to leave open. 

2. Monitor for unusual activity. Many attack techniques leave a distinctive pattern as an attacker probes for what they can reach. Systems that watch for these patterns can catch an intrusion in progress, not just after the damage is done. 

3. Test and improve configurations. Complex systems are built by people, and people make mistakes. The goal is not perfection. It is early detection and a fast, practised response when something does slip through. 

Building security into everyday services 

As the public sector lead for cybersecurity, GovTech oversees key government technology infrastructure and sets security standards for public sector systems. It works alongside CSA, which sets national cybersecurity policy and coordinates the response to major incidents. 

Most of this work happens out of sight, but it shows up in the products people use every day. In July 2026, Singpass began rolling out passkeys, a password-free login method (opens in new tab)that uses your device's biometrics or PIN to verify your identity. Because they only work on the genuine Singpass site, they are far harder for attackers to steal or fake than a traditional password.. And that same login protects access to services such as HealthHub and CPF. 

Keeping systems secure is a shared responsibility. Officers do their part by testing and monitoring systems behind the scenes, and citizens do theirs by turning on multi-factor authentication. 

Staying one step ahead 

So why do cyber defenders keep trying to hack their own systems? Because the alternative, waiting for a real attacker to find the gaps first is far costlier. Every simulated breach is a threat that never reaches you. 

Security has no finish line. Every weak spot found is one less way in for attackers. 

By thinking like attackers, cyber defenders can uncover vulnerabilities that might otherwise go unnoticed, strengthen their defences, and prepare for threats that manage to slip through. 

Want to explore the full technical article? Read Offensive Defensive — the art of cybersecurity (opens in new tab) on GovTech's Medium publication.