Cybersecurity – many agencies but how secure are we?

PRIME MINISTER Datuk Seri Anwar Ibrahim’s warning that Malaysia could become a target of cyberattacks amid growing geopolitical tensions should prompts this question – how prepared are we, despite having multiple government agencies responsible for cybersecurity?

The National Cyber Security Agency (Nacsa), under the National Security Council, leads national cybersecurity policy and coordination.

CyberSecurity Malaysia, under the Digital Ministry, provides technical expertise, incident response and cybersecurity services through MyCert.

Then, there is the National Cyber Coordination and Command Centre (NC4), responsible for monitoring threats and coordinating national cyber crises, while the Malaysian Communications and Multimedia Commission (MCMC) oversees security-related matters within the communications sector.

These agencies have produced tangible results, including incident-response capabilities, cybersecurity training, threat advisories and the Cyber Security Act 2024, which establishes obligations for critical infrastructure operators.

But are these efforts translating into measurable improvements in national cyber resilience?

Are there overlapping responsibilities, particularly in threat monitoring, incident reporting and response coordination?

Although their mandates differ, multiple reporting channels and administrative boundaries risk creating confusion during a major cyberattack.

Malaysia’s expanding digital economy, growing data-centre industry and increasingly ­interconnected financial and government systems make these weaknesses potentially costly.

The challenge is no longer simply detecting cyber attacks, but ensuring critical infrastructure can withstand them, recover quickly and maintain essential services.

Rather than creating more committees or agencies, the government should demonstrate that existing institutions operate under clear command structures, share intelligence effectively and conduct rigorous national cyber-defence exercises.

Perhaps, it should publish meaningful performance indicators, including incident-response times, vulnerabilities addressed and recovery capabilities.

Cybersecurity should not be measured by the number of agencies, strategies or conferences Malaysia has, but by how effectively the country can prevent, contain and recover from a serious attack.