People See One Brand. The Internet May Show Them Hundreds More.

The gap between what organisations control and what people trust may be larger than many realise.

SINGAPORE, Sept. 7, 2026 /PRNewswire/ -- Every day, consumers decide whether to trust a website, email, link or digital service. What they rarely see is where an organisation's official digital presence ends and similar-looking identities begin.

For most people, trust is not determined by ownership records or technical boundaries. It is shaped by what appears familiar, legitimate and connected to the organisation they believe they are engaging with. As digital interactions continue to grow, the gap between what organisations control and what people trust may become increasingly important.

The inaugural ONESECURE's The State of Digital Trust in Singapore 2026 found that each reference organisation domain was associated with a median of 151 similar-looking domains across the public internet. The study analysed 120,702 distinct lookalike domains associated with 448 reference organisation domains and found that 82% had observable internet or email infrastructure, or both. While this does not indicate malicious activity, it demonstrates how external identities can possess the technical characteristics needed to establish an online presence that people may encounter and interact with.

While organisations typically have visibility over the websites, systems and accounts they own, customers, employees and members of the public make trust decisions based on what they encounter online. Similar-looking identities can exist beyond those organisational boundaries, creating a broader challenge around how trust is recognised, monitored and governed.

"People don't experience organisations through asset inventories or security diagrams. They experience them through names, emails, websites and links," said Edmund How, Managing Director of ONESECURE Asia. "The findings suggest organisations may need to think differently about trust. The challenge is no longer just securing what belongs to you. It's understanding what exists around you, recognising when an external identity becomes relevant, and having a consistent way to determine when action is needed."

The report found external identity exposure across multiple sectors, including financial services, healthcare, education, public services, transportation and information services, suggesting the issue is not confined to any single industry.

While the findings are drawn from a Singapore-focused dataset, the underlying question is relevant wherever people rely on digital identities to access services, conduct transactions and engage with organisations online regardless of geography.

Understanding and monitoring that broader identity landscape may become an important part of how organisations safeguard trust, protect reputation and fulfil their responsibilities to the people they serve.

If Singapore's benchmark is 151 distinct lookalike domains per organisation, what could yours be? The question is not simply what your organisation owns, but whether you understand the wider identity landscape that exists around it.

Download the full ONESECURE's The State of Digital Trust in Singapore 2026 report.

About ONESECURE Asia

ONESECURE Asia, headquartered in Singapore, is a managed security services provider helping organisations strengthen security and resilience as digital risks evolve. Its capabilities span managed security operations and Webyith, a digital trust platform designed to protect the integrity and authenticity of digital environments. Bringing together technology, intelligence and human expertise, we serve as a trusted and accountable partner in addressing critical security gaps across Asia.

Visit www.onesecureasia.com

About This Report

The State of Digital Trust in Singapore 2026 examines observable external digital identity exposure across 448 Singapore-focused reference organisation domains as of August 2026.

The analysis covers 144,134 observed domain records, representing 120,702 distinct lookalike domains after exact self-domain records were excluded. It assesses domain registration, DNS resolution, mail-routing configuration and supporting infrastructure patterns.

The research distinguishes exposure from investigative or operational relevance. A lookalike domain is not automatically malicious, and observable infrastructure or registration characteristics do not by themselves indicate phishing, abuse or malicious intent. They provide context for understanding which external identities may warrant closer examination.

The findings represent a Singapore-focused, point-in-time baseline, not a population-wide survey or measure of confirmed malicious activity. Lookalike volumes may be influenced by reference-domain characteristics and study methodology; comparisons should not be interpreted as rankings of malicious activity or security performance.

The study provides a basis for organisations to better understand, prioritise and govern external digital identity exposure beyond environments they directly control.