Building Security Resilience for Malaysia’s AI Ambitions Needs More Than Awareness

Every October, Cybersecurity Awareness Month serves as a reminder to update passwords, watch out for phishing emails, and back up critical files. These tips are sensible, but for many Malaysian enterprises, they no longer match the size of the risk.

The Malaysia Cyber Security Strategy (MCSS) 2025–2030 expects the digital economy to contribute 25.5% of GDP by 2025. Police figures cited in the same strategy show online scam losses rising from RM 851 million in 2022 to RM 2.46 billion by October 2025. With so much of the economy running on digital systems, a serious cyber incident can stop a business from operating.

Organisations are responding by spending more on security. IDC forecasts that Asia Pacific security services, excluding Japan and China, will grow from USD 10.8 billion in 2024 to USD 16.6 billion by 2029. Yet spending more does not guarantee better preparation, and Malaysia’s own data suggests why.

A national survey by the National Cyber Security Agency (NCSA) found that awareness “does not translate into action”. Only 59.5% of respondents said they regularly practise good cyber hygiene. Another round of annual training will not close that gap. Security must become part of how the business operates every day, with controls that work regardless of whether employees remember their training.

Regulators and Attackers Are Raising the Stakes

The National AI Action Plan 2026–2030 aims for up to 1.2 percentage points of additional GDP growth a year, as many as 500,000 AI-related jobs, and a top-10 global ranking for AI readiness by 2030. As that plan takes shape, regulators will expect more from businesses, and attackers will have more targets to aim at.

Regulators are already moving. The MCSS commits to reviewing the Cyber Security Act 2024, introducing a Cybercrimes Bill, and extending cyber hygiene programmes beyond critical infrastructure to businesses of every size, from large corporations to micro-, small-, and medium-sized enterprises (MSMEs). The strategy explains why: attackers increasingly use less-protected MSMEs “as entry points to penetrate supply chains”. A large enterprise can secure its own systems well and still be breached through a supplier.

The incident numbers bear this out. Malaysia recorded 5,837 cybersecurity incidents in 2025, involving 2,390 national critical information infrastructure entities. Government agencies, trade and industry, and healthcare were among the most affected.

Attackers are also getting quicker, with the MCSS warning that agentic AI now enables “automated, adaptive attacks with minimal human oversight”. Against attacks like these, waiting for a person to review every alert is too slow. Executive teams should invest in automated threat intelligence and AI-driven security controls.

ManagingShadow AI Exposure

AI is also spreading inside organisations without their IT teams’ knowledge.

Gartner® found that 57% of employees use personal GenAI accounts for work, and 33% admit to entering sensitive information into unapproved tools. Gartner also predicts that by 2030, more than 40% of enterprises will experience security or compliance incidents linked to unauthorised shadow AI.

Employees usually mean well, but customer records, pricing models, or source code can end up in a public tool the enterprise cannot govern. NACSA’s AI Systems Cyber Security Framework gives Malaysian organisations a life cycle-based approach to securing AI data, models, and applications. In practice, leaders can start by:

1. Enforcing unified observability: Continuously monitor corporate networks to find shadow AI applications and unsanctioned automated scripts.

2. Establishing data guardrails: Apply policy-driven controls that stop sensitive data and proprietary code from being fed into public AI models.

3. Automating risk enforcement: Use UEM and SIEM tools to enforce compliance in real time and automatically revoke access to unapproved applications.

Evolving Identity Security for Human and Machine Workloads

AI agents, API connections, and scheduled tasks now query databases on their own, often with broad permissions. Most identity frameworks assume an employee is logging in and struggle to manage software that acts independently.

Gartner predicts that by 2028, 70% of CISOs will use identity visibility tools to shrink their identity attack surface. It also warns that 40% of enterprises will demote or decommission autonomous AI agents by 2027 because of governance failures. A Zero Trust approach helps because policies can vary with an agent’s autonomy and access scope. With least-privilege access and context-aware policies, IT teams can check every non-human identity, integration, and API request before granting access.

Zero Trust also needs strong authentication behind it. Phishing-resistant MFA and granular privileged access management mean that if a credential is stolen, the attacker cannot easily move from one critical system to the next.

Building Lasting Enterprise Resilience

Cybersecurity Awareness Month is a good reminder to check in on security posture, but what counts is what organisations do for the rest of the year.

PwC’s 2027 Global Digital Trust Insights found that only 39% of organisations have fully formalised operational continuity plans that address cyberthreats, and that attacks on AI systems are the threat they feel least prepared for.

For Malaysia, a country that’s set its sights on being one of the region’s leading AI-driven economies, that gap is worth taking seriously.

Customers, regulators, and partners will increasingly choose to work with organisations they trust to protect their data. Building that trust takes ongoing effort: workforce awareness, automated security controls, sound AI governance, and modern identity security that’s maintained long after October.