While Malaysian companies embrace AI agents for higher productivity gains, companies need to be aware of new data security risks that AI agents introduce, and it is essential to roll out AI agents together with appropriate data governance and security.
Data risks with AI Agents
An employee asks the company AI agent a simple question: what is my manager’s salary? The agent searches the company files it has access to, discovers a spreadsheet in HR’s SharePoint and reveals everyone’s salaries, even the CEO’s.
Nothing was hacked. No credential was stolen. No policy was broken.
This happens because an AI agent has no independent sense of what is confidential. It searches anything it can reach to complete its task. In government agencies, this may be citizen data. In financial institutions, it may be customers’ bank details. In hospitals, patient data. In other words, the AI agent leaks data that may cause reputational and financial damage to the organisation.
Most organisations are not yet prepared to handle new data risks arising from AI adoption. IBM’s Cost of a Data Breach Report 2026 found that 68% of organisations that reported an AI-related breach did not have any security policies or governance to monitor AI use. This is exacerbated by the fact that employees are often using personal or shadow agent accounts on corporate devices, and these shadow accounts are not monitored. This means AI usage is almost unchecked and can lead to serious data loss.
Regulations
Malaysia’s AI governance framework is moving from voluntary guidance to enforceable obligation. The National AI Office issued a public consultation paper on a proposed AI Governance Bill in July 2026, with the Bill targeted for completion by the end of the year. Proposals include a risk-based framework, defined developer, deployer roles, and incident reporting duties.
Furthermore, the Personal Data Protection (Amendment) Act 2024 requires companies to notify the Commissioner of a data breach, and to notify affected individuals where the breach is likely to cause significant harm. Failure to notify carries a fine of up to RM250,000, imprisonment of up to two years, or both. Breaches may carry penalties of up to RM1 million.
Data Governance for AI Agents
How can an organisation roll out AI agents for productivity, while maintaining good data governance?
Teams need to have tools in place to monitor AI agents and to implement effective data governance.
InsiderSecurity has developed such as a cybersecurity tool for its users. For more than 10 years, government agencies, critical infrastructure and enterprises in the region have been using InsiderSecurity’s enterprise cybersecurity solutions. By developing advanced cybersecurity software in Asia for Asia, InsiderSecurity provides exceptional local engineering support to its users.
InsiderSecurity’s Data Security Platform enables enterprises to realise the productivity gains from AI agents while putting in place effective data governance for AI agents.
“Our users do not need to slow their AI rollouts down. They just need to be able to answer what data the AI agents can reach, and monitor what the agents are doing. This is an access and monitoring problem, and it is the problem we have been solving for our users for over a decade.” Said Jonathan Phua, CEO of InsiderSecurity.
InsiderSecurity’s Data Security Platform enables its users to address key areas in data governance for AI agents:
1. What agents do I have?
InsiderSecurity discovers the AI agents operating across Microsoft 365 and cloud services, including shadow AI agents.
2. What data can the agents access?
For every agent, InsiderSecurity maps the data it can reach, including write and delete permissions, and flags excessive access so that IT teams can tighten it before an incident occurs.
3. Is an agent accessing data it is not supposed to access?
InsiderSecurity monitors each agent’s activity, alerting teams to unauthorised or unintended data access, data leaving the organisation, and behaviour that drifts from the agent’s assigned scope.
4. Where are the audit logs for the agent?
Agent data access is recorded in a reviewable audit trail, giving security teams, auditors and regulators evidence of what an agent did, to which data, and when.
IT teams can now see every AI agent running in their environment, what data each one can reach, and when an agent’s behaviour turns suspicious.
About InsiderSecurity
InsiderSecurity (insidersecurity.co) was started from Singapore in 2015, and it became the first cybersecurity company accredited by Singapore’s Infocomm Media Development Authority in User and Entity Behaviour Analytics, and the first cybersecurity software company in ASEAN to achieve CSA STAR Level 2 certification, the gold standard in cloud security, alongside ISO 27001.
InsiderSecurity’s enterprise cybersecurity solutions are deployed and trusted by government agencies, critical infrastructure and enterprises in the region, for the past 10 years.
InsiderSecurity's Data Security Platform provides comprehensive data security for enterprises, covering AI Agent security, database security, cloud data security and insider risks in on-premise or cloud infrastructure.
With its engineering offices in Malaysia and Singapore, InsiderSecurity provides exceptional local engineering support.
For more information, please contact InsiderSecurity
Email: [email protected]
WhatsApp: +60 10-527 5342
Website : insidersecurity.co