ARTIFICIAL intelligence (AI) is reshaping the world, with both promise and peril. While Malaysia’s ambition to lead in AI innovation is gaining momentum, the same technology is now powering a more insidious threat: a new generation of cybercriminals who are faster, more convincing, and harder to detect. 

From voice cloning to deepfake scams, attackers are using AI to mask their intent and manipulate human trust. These are not theoretical risks. A recent survey by Fortinet reveals that nearly half (almost 50%) of Malaysian organisations have faced cyber threats powered by AI in the last year. These AI-driven attacks are escalating rapidly, with 54% of organisations reporting a two-fold increase in such incidents, and 24% experiencing a three-fold surge. 

These figures tell a story of growing awareness but also widening gaps in preparedness.

Malaysia’s digital economy is scaling rapidly, with AI-related revenue projected to contribute over 25% of gross domestic product (GDP) by the end of 2025. Recent quarters have seen a surge in digital investment, with RM29.5 billion pouring in between April and June alone — more than double the previous period. This growth is essential for national competitiveness, but it also expands the attack surface. 

The government’s forward-leaning strategy is clear. Initiatives like the National Artificial Intelligence Framework, the Cyber Security Act 2024, and the AI Technology Action Plan (2026–2030) are laying the groundwork for secure AI adoption. The establishment of the National Artificial Intelligence Office (NAIO) and the AI Safety Institute signal a strong policy response to the new wave of AI-driven threats. 

Still, cybercriminals are evolving faster. AI has accelerated the shift towards cybercrime-as-a-service. Attackers now use AI tools to automate reconnaissance, generate polymorphic malware, and craft hyper-personalised scams in local dialects, all of these at an unprecedented scale. These tools are lowering the barriers to entry, allowing even non-technical actors to conduct sophisticated attacks. 

To stay ahead of the increasingly sophisticated threats, defenders must apply the same principles that make AI so potent in the hands of adversaries — automation, context awareness, and agility. Cybersecurity strategies must evolve from reactive response to predictive, intelligence-led operations that integrate automation, analytics, and real-time decision-making. 

This shift is especially important in Malaysia, where many organisations operate with lean security teams. According to a recent Fortinet-IDC study, only 19% of Malaysian enterprises felt highly confident in their ability to defend against AI-powered attacks. Another 20% reported having no capability at all to track such threats, highlighting a growing readiness gap. 

By embedding AI into threat detection and response workflows, security teams can reduce alerts fatigue, accelerate investigation timelines, and better protect against increasingly evasive attack techniques. The ability to make faster, more informed decisions, without relying solely on manual intervention, is becoming a defining characteristic of modern cybersecurity resilience. 

On a broader scale, the increased use of AI in both cyberattacks and defences is reshaping how businesses must think about operational risk and technology governance. As digital infrastructure becomes more critical to competitiveness, the ability to withstand AI-driven threats will influence investor confidence, regulatory compliance, and customer trust. This is no longer just a technical issue. It is fast becoming a boardroom and policy concern. 

AI is not just changing how attacks happen, it is amplifying their reach, precision, and unpredictability. The next phase of threats may combine digital deception with real-world consequences, as adversaries target cloud infrastructure, identity systems, and operational technology with increasing precision. 

To navigate this evolving landscape, organisations need to move beyond reactive measures. This means adopting continuous risk assessment practices, implementing zero-trust principles, and strengthening their ability to detect and respond to synthetic content such as deepfakes and voice clones. 

It also calls for stronger cross-sector collaboration and deeper investment in cybersecurity talent. From a systemic perspective, building national cyber resilience requires a coordinated approach that spans industries, government, and the technology ecosystem. Public-private partnerships, industry standards, and shared threat intelligence will be critical to reduce fragmentation and elevate baseline defences across the economy. 

Resilience now depends on anticipating what comes next, enabling smarter decisions, and preparing teams to respond with the speed and confidence that today’s threats demand. 

Malaysia’s journey towards an AI-powered economy is well underway. But as we embrace AI’s transformative potential, we must also confront its misuse. Securing Malaysia’s digital future will depend not only on policy and infrastructure, but on a collective ability to act, adapt, and outpace the adversaries hiding behind the mask of AI.

Kevin Wong is country manager at Fortinet Malaysia.