The world's most efficient port has one flaw it can never fix.
Singapore broke its own throughput record again in 2025. By every operational measure it is the best-run port on the planet. Map it node by node for structural fragility rather than performance, and the binding constraint sits in water it was never going to be allowed to own.
- Throughput (2025)
- 44.66M TEU
- Vessel arrivals
- 3.22B GT
- Maritime employment
- ~170,000
- Tuas target capacity
- 65M TEU
A hardened interior meeting an ungovernable perimeter.
Like Jebel Ali, the Port of Singapore is a hardened, professionally governed, state-backed logistics hub whose commercial premise depends on a strait it does not sovereignly control. JAFZA sits at the edge of Hormuz; Singapore sits at the narrow end of Malacca. Ratings here are qualitative — Low, Medium, High, Critical — against four stated criteria: exposure, redundancy, direct governance control, and recent incident history. No composite score, no hidden weighting.
Nine of the fourteen rated nodes, across the six sovereign layers.
Terminal consolidation (Tuas Mega Port)
MPA and PSA plans confirm phased consolidation of Tanjong Pagar, Keppel, Pulau Brani and eventually Pasir Panjang into one automated mega-site. Concentration rises even as capacity rises — a trade-off that warrants reassessment as each phase completes.
Energy supply
Around 94% of the national energy mix runs on imported LNG with no domestic production, and the import route shares physical geography with the strait dependency — so a Malacca disruption and an LNG shock are not independent events.
Water supply
Desalination and NEWater have materially reduced import reliance, but the diversified supply mix still carries cross-border and energy-intensity exposure.
Food import dependency
The Singapore Food Agency confirms more than 90% of food is imported from 187 countries. The aggregate '30 by 30' target was replaced on 4 November 2025 with category-specific 2035 targets after 2024 local production reached only 8% of fibre and 26% of protein consumption.
Port automation / OT-ICS attack surface
Networked crane, gate and yard-management systems present the structural attack surface common to any modern automated terminal. No confirmed cyber incident against Singapore's own port infrastructure was found; the CSA board-accountability mandate makes the regulatory posture more assertive than a voluntary standard.
Operator & regulator structure
PSA International is wholly owned by Temasek Holdings, with the Maritime and Port Authority of Singapore regulating under the Ministry of Transport. Clear statutory lines, deep institutional continuity.
Sovereign capital backstop
Temasek's net portfolio value of approximately USD 300 billion provides a financial-layer hedge structurally stronger than most comparable hubs.
Strait of Malacca dependency
The port's entire commercial premise depends on a strait it does not sovereignly control — jointly governed by Indonesia, Malaysia and Singapore under UNCLOS. There is no named fallback terminal: disruption means rerouting via Lombok or Sunda, adding days of transit rather than substituting a defined volume.
Piracy & armed robbery in the straits
Incidents reached a 19-year high of 108 in 2025, up 74% on 2024, then fell sharply following arrests by Indonesian authorities — a chronic and currently moderating risk shape, rather than an episodic severe one.
Singapore moves more cargo, with a harder redundancy problem.
JAFZA · Jebel Ali
- Throughput
- 19.3M TEU
- Named fallback
- Khorfakkan, ~5M TEU (~26% of primary)
- Chokepoint governance
- Effectively one state
- Risk shape
- Episodic and severe
Singapore · PSA
- Throughput
- 44.66M TEU
- Named fallback
- None — rerouting via Lombok or Sunda
- Chokepoint governance
- Three states, jointly, under UNCLOS
- Risk shape
- Chronic, currently moderating
Two hubs, ten thousand kilometres apart, under different governments, legal systems and oceans — and the fragility lands in almost exactly the same place. The same type of node wins every time: the external one, the one nobody was ever going to be allowed to own.
Where does your own resilience budget actually go?
Most institutions harden what they can see and control: the org chart, the tech stack, the balance sheet. That work is necessary. It is also close to beside the point if the system's binding constraint sits somewhere the institution was never going to be able to touch. If you scored your own organisation the same way, would the number land on the parts you've spent three years improving — or somewhere you haven't been allowed to look, because it was never officially your problem?