Malaysia must strengthen cybersecurity, data protection and local AI capabilities as cyber threats, scams and data breaches pose risks to national security
KUALA LUMPUR: Cybersecurity can no longer be viewed merely as an information technology (IT) concern but must instead be treated as a national security priority, given the threats posed by data breaches, online scams and system intrusions that could undermine strategic interests and public trust in government institutions.
The rapid advancement of digital technology, including artificial intelligence (AI), has also transformed the threat landscape, giving cybercriminals more opportunities to deceive users, steal information and exploit vulnerabilities in communication systems.
As government administration, financial transactions, public services and everyday communication increasingly rely on the Internet, weaknesses in data protection can result not only in financial losses for individuals and organisations but also expose the country to broader national security threats.
Rising awareness must be matched by protection
Malaysia Cyber Consumer Association president Siraj Jalil said growing public concern over scams and hacking indicates greater awareness of cyber threats, but this has not necessarily been matched by adequate system protection.
Citing the GSMA ASEAN Consumer Scam Report, he said 96 percent of consumers were worried about falling victim to scams or hacking, while 66 percent had changed their daily behaviour to protect themselves against such threats.
“The figures show that users are becoming more aware of digital risks and taking precautions, but the responsibility for protecting them should not rest entirely on individuals.
“Simply blaming victims for falling for scams is inadequate as cyber threats are becoming increasingly complex and involve various vulnerabilities, including weaknesses in data protection systems and transaction verification mechanisms,” he told Bernama.
Siraj said persistent concerns over cyber threats could also undermine public confidence in digital communication.
The same report, he added, found that 41 percent of consumers ignored calls from unknown numbers, while 56 percent avoided incoming calls altogether.
“This illustrates how cyber threats can extend beyond financial losses to disrupt everyday activities, including official communications between the public and government agencies, as well as financial institutions.
“When people find it increasingly difficult to trust the calls or messages they receive, legitimate communication channels can also be affected, making it harder to deliver important information to the public,” he said.
Cyber threats, generative AI
Siraj said the common perception that cybersecurity matters involve only engineers and IT specialists needs to change as human vulnerabilities could also provide an entry point for attacks that threaten national security.
He said modern cyberattacks do not necessarily require criminals to possess advanced programming skills – they could exploit users’ vulnerabilities through impersonation, psychological manipulation and scams designed to appear convincing.
He added that advances in generative AI enable criminals to produce highly personalised phishing messages, clone voices and create deepfake videos that mimic real individuals, making fraudulent communications increasingly convincing.
“This makes it more difficult for the public to distinguish genuine information from manipulated content, increasing the risk of identity theft, financial fraud and system intrusions,” he said.
He added that vulnerabilities such as easily guessed passwords and connections to unsecured networks could also allow malicious parties to access personal and organisational information.
Stressing the need for a comprehensive approach to tackling such threats, Siraj said exposed information could be exploited to disrupt public services, undermine strategic interests or manipulate society.
He therefore called on the government, industry players and digital platform operators to play their respective roles in building a safer digital ecosystem. This includes strengthening data protection, curbing scam advertisements, and enhancing capabilities to detect and block suspicious transactions.
“At the same time, the public must be equipped with practical knowledge to recognise the warning signs of scams and verify the authenticity of information before taking action, particularly when requests for money or confidential information are involved,” he said.
Data breaches erode public trust
Meanwhile, Universiti Utara Malaysia (UUM) School of Multimedia Technology and Communication dean and Advanced Communication Research Unit researcher Associate Prof Dr Mohd Khairie Ahmad said cybersecurity is closely linked to national sovereignty as data and information have become vital resources underpinning economic activities and daily life.
He said cyber threats are no longer limited to protecting computer hardware or an organisation’s internal systems but also encompass the security of communication channels used daily for work, business transactions and interaction.
He added that society’s reliance on the Internet means that disruptions to digital communication systems could have a ripple effect across various activities, including service delivery and economic operations.
“Today, information and data are commodities, much like natural resources, and serve as raw materials for generating other forms of economic value.
“When sensitive data is leaked or government information is compromised, it can erode public trust in national institutions, particularly when information that should have been protected is exposed to irresponsible parties,” he said.
Mohd Khairie said the impact extends beyond the relationship between the government and the public, potentially influencing how investors and external parties perceive the country’s ability to safeguard information and ensure the operational security of organisations.
He said weaknesses in an institution’s data protection measures could also raise concerns that other organisations might face similar risks.
As such, he said, a country’s ability to protect its data and digital systems is increasingly becoming an important measure of national resilience in the face of modern threats, alongside its conventional defence capabilities.
Misuse complicates threats
Mohd Khairie said cybersecurity strategies must also take communication into account, particularly during data breaches or the spread of false information. Delays in providing explanations during a crisis, he said, could create an information vacuum that might be filled with rumours, speculation and unfounded claims.
He added that in a social media environment where content could spread rapidly, such a situation could exacerbate a crisis and damage the reputation of the organisations involved.
“Government agencies and corporate organisations must provide accurate, clear and timely information when dealing with cyber incidents, without compromising the need to protect sensitive information that is still under investigation.
“Transparent communication helps the public understand the actual situation and make rational decisions, thereby reducing the scope for false information to influence public perception,” he said.
He said the irresponsible use of AI and social media could further complicate cyber threats, as false content could be easily generated and disseminated. This can also lead to information fatigue, leaving people increasingly unable to assess the truth or think rationally, and simply accepting whatever information is presented to them.
He added that efforts to strengthen cybersecurity also required digital platform providers to share responsibility for user safety.
“Besides improving public education and awareness, the legal framework must also be reviewed continuously to ensure it remains relevant to technological developments.
“This includes the Cyber Security Act 2024 (Act 854), which provides an important foundation. However, the legal approach must continue to evolve in tandem with changes in technology and digital threats,” he said.
Strengthening local capabilities
Sharing his views, director of cybersecurity practice at Aras Integrasi Sdn Bhd Faurani Jaafar said the leakage of sensitive government information is among cybersecurity threats that could have implications extending far beyond technology.
He said the exposure of strategic information, for example, details of military asset procurement, could give foreign parties insights into the country’s plans and the assets it intends to acquire within a specific period.
“Although we view this from a cybersecurity perspective, the ability to prevent such incidents actually contributes to national security.
“For example, if information relating to military asset procurement is compromised, other countries could potentially learn about the assets we intend to acquire. Therefore, protecting such information through cybersecurity initiatives helps safeguard national interests and strengthen the country’s security,” he said.
Meanwhile, Aras Integrasi chief technology officer Farul Mohd Ghazali said Malaysia needs to develop sufficient in-house capabilities to investigate cyber incidents without relying entirely on foreign technology providers.
He said developing local technology is not merely a matter of ownership but also involves having the expertise to operate, maintain and continuously improve critical technologies using local talent.
“Ultimately, our goal is to secure the best talent in Malaysia and ensure they can help develop better products.
“With the talent we have today and our capabilities in AI, the technology we possess is actually on a par with that of other countries,” he said.
As part of efforts to strengthen local technological capabilities, Aras Integrasi has developed three cybersecurity platforms – VoronCitadel, GovSec and chainSENTRY – to address various aspects of cyber risk and digital forensics.
All three platforms were developed using local talent and technology, with GovSec developed in collaboration with CyberSecurity Malaysia.
On Oct 5, Deputy Digital Minister Datuk Wilson Ugak Kumbong said Malaysia needs to develop its own technological capabilities, strengthen data sovereignty and embed security into the systems it builds to realise its ambition of becoming an AI Nation by 2030. He said this at the opening of the ‘Cyber Digital Services, Defence & Security Asia 2026’ exhibition and conference, here.