IMAGINE receiving a phone call from someone who sounds exactly like your child, sibling or close friend, urgently asking for money. You recognise the voice, but what if it is not really them? With artificial intelligence, scammers can now clone voices using recordings found online, making it increasingly difficult to distinguish genuine requests from elaborate impersonations.
As AI makes cyberattacks more sophisticated and convincing, Malaysia faces the growing challenge of protecting not only its digital infrastructure but also the people who depend on it. This will require strong policies, more secure technology and greater public awareness.
Consistent enforcement and better awareness
For Malaysians, the risks extend to everyday activities and essential services. AI-powered attacks can target online banking, digital payments, food and energy security, as well as Internet-connected devices. Universiti Tun Hussein Onn Malaysia cybersecurity and Internet of Things (IoT) specialist Dr Cik Feresa Mohd Foozy says these attacks are becoming faster and more accessible with AI, even to those with limited technical skills.
Malaysia has introduced several measures to address growing threats. There is the Malaysia Cyber Security Strategy 2025–2030, the Cyber Security Act 2024, and the National Cyber Security Agency (Nacsa) has its AI Systems Cyber Security Framework (AISCF). The Cybercrimes Bill 2026, passed in July 2026, will replace the Computer Crimes Act 1997 and covers identity theft and the use of AI-generated fake videos or audio to commit crimes. But policies cannot cover all ground, says Cik Feresa.
She argues that consistent enforcement and public awareness are now the priorities, guided by two standards: “zero trust”, where one should not automatically trust any user, device or system; and cyber resilience, which refers to the ability to withstand and recover quickly from attacks.
Cik Feresa advises the public to remember three simple words, “pause, verify and report”.
“Never share your MyKad number, banking details or confidential documents with public AI chatbots. Cybersecurity is everyone’s responsibility, and resilience means being ready to recover, not only to prevent attacks,” she adds.
Cybersecurity is no longer only about protecting data. As information technology (IT), which handles data, and operational technology (OT), which controls physical equipment in critical infrastructure and industry, become more connected, it is also about keeping Malaysia’s national critical information infrastructure running, says Cik Feresa.
Protecting critical infrastructure
From her experience assessing operational systems, Cik Feresa explains that the most common weaknesses are outdated equipment, incomplete device records, open remote access and IT and OT teams working separately.
“Unlike IT, OT must prioritise safety and continuous operation, so security updates cannot always be applied immediately. This is why older equipment often needs to be isolated rather than simply patched,” she says.
To address these vulnerabilities, she says authorities should ensure that operators of OT systems, such as power, water and rail, keep a full inventory of connected devices, separate OT from IT networks, restrict remote access, replace or isolate outdated equipment, and run joint IT and OT incident response exercises.
As AI systems face new risks such as data poisoning (feeding false data to an AI) and prompt injection (hidden instructions that trick an AI), she says authorities should also promote wider use of AISCF to secure AI systems.
With strong policies and an informed public, Cik Feresa believes that Malaysia is well positioned to face these threats and continue strengthening its cyber defences.
Declining digital trust
While AI is increasingly being used to strengthen cyber defences, Universiti Sains Malaysia cybersecurity researcher Associate Professor Dr Manmeet Mahinderjit Singh warns that AI systems themselves are becoming targets.
Attackers can manipulate the data used to train AI models, feed them deceptive inputs or extract sensitive information from poorly secured AI tools, says Manmeet, whose research currently focuses on AI Security and Digital Trust. These vulnerabilities become more concerning as organisations increasingly rely on AI to detect and respond to cyber threats.
“Securing AI therefore means protecting the models, not just the networks around them,” she says, highlighting the importance of adversarial testing, continuous monitoring and utilising established security frameworks.
Beyond technical vulnerabilities, Manmeet says AI-driven deception is also eroding public confidence in digital services. From cloned voices used to impersonate family members to deepfake videos, these attacks exploit the trust people place in familiar voices, images and online platforms.
She describes this as digital trust, referring to the confidence people place in the authenticity, integrity and reliability of digital identities, information and services.
“A society that cannot trust its digital channels cannot fully benefit from them. Hence, digital trust is not a soft concept but a pillar of national security,” she says.
From policy to practical action
On the policy front, Manmeet acknowledges that Malaysia has built a strong regulatory foundation in a remarkably short time.
The Cyber Security Act 2024, amendments to the Personal Data Protection Act and the Online Safety Act 2025 are among the measures introduced to address cybersecurity and digital safety concerns.
She also points to the government’s ongoing efforts to develop an AI Governance Bill, supported by initiatives such as the Malaysia AI Safety Institute (MY-AISafe), the MY-AI Standards platform and the Voluntary AI Code of Ethics. These efforts aim to promote responsible AI development while strengthening safety, accountability and data protection.
However, she stresses that the priority now is to translate these initiatives into practical safeguards. This includes requiring AI-specific risk assessments in critical sectors, strengthening security audits and adversarial testing, and ensuring human oversight of high-risk AI decisions.
“Any insecure AI system, tool or platform that people trust blindly is a liability, not an asset,” she cautions.
Manmeet believes cybersecurity and digital trust must be a shared responsibility, with the government providing effective regulation and enforcement, businesses developing secure AI systems, and individuals taking an active role in protecting themselves through a habit of verification.
“As Malaysia races to adopt AI, one thing must not be compromised; innovation should never come at the expense of citizens’ safety, privacy and digital trust,” she says.
