David Koh, 61, will retire as Chief Executive of the Cyber Security Agency of Singapore (CSA) and as Commissioner of Cybersecurity on July 1, 2026, ending a 42-year career in public service [1, 2]. Koh was appointed the founding chief executive of CSA in April 2015 and became Commissioner of Cybersecurity in 2018 [1, 2].
Under his leadership, CSA celebrated its 10th anniversary in April 2025, marking a decade of growth in Singapore’s cybersecurity capabilities [1]. Koh led the development and refresh of Singapore’s Cybersecurity Strategy in 2016 and again in 2021 [1, 2]. He also oversaw the establishment of the Cybersecurity Act in 2018 and its amendment in 2024, which expanded coverage to key digital services and third-party providers [1, 2].
Koh managed several major cybersecurity incidents, including the 2018 SingHealth data breach and the UNC3886 campaign targeting Singapore’s critical infrastructure [1]. He also held concurrent appointments at the Ministry of Defence and Defence Science and Technology Agency (MDDI), serving as Chief of Digital Security and Technology from January 2022 to May 2026 and Chief Quantum Adviser from August 2025 to May 2026 [1, 2].
To build Singapore’s cybersecurity ecosystem, Koh led initiatives such as the CyberSG Talent program, the Innovation and Growth Collaboration Centre, and the CyberSG R&D Programme Office [1, 2]. Permanent Secretary Chng Kai Fong praised Koh, saying, "David has built CSA from the ground up and set Singapore on a strong footing in cybersecurity – from establishing our national frameworks and legislative foundations, to positioning Singapore as a trusted and respected voice in international cyber diplomacy" [2]. Chng added, "His dedication and visionary leadership have created a strong foundation for CSA’s continued success in the many years to come" [2].
Koh will be succeeded by Gwenda Fong, 48, a public sector veteran with over 20 years of experience spanning technology, security, and social policy. Fong served as deputy secretary for digital society and development at MDDI from January 2023 to March 2026 [1, 2]. She will assume the roles of CSA Chief Executive and Commissioner of Cybersecurity on July 1, 2026 [1, 2].
