ORGANISATIONS in Malaysia are facing a surge in cyberattacks powered by artificial intelligence (AI). From data harvesting to model training, automated exploitation and adaptive persistence, the scale and sophistication of AI-driven attacks are rapidly increasing.

Malaysia saw a staggering 78% increase in ransomware cases in the fourth quarter of 2024, highlighting the urgency of having robust and coordinated efforts to raise the nation's cyber preparedness. 

Globally, the cost of cybercrime is currently estimated at over seven trillion US dollars, and it is set to increase steadily in the coming years, signalling that cyber threats continue to be a significant and evolving problem for Malaysian businesses. Just in March last year, Prime
Minister Datuk Seri Anwar Ibrahim said that the digital system of Malaysia Airports Holdings Bhd was attacked by hackers demanding a ransom payment of US$10 million (RM44.39 million) and resulted in days of disruption. 

Cloudflare’s latest Signals Report further paints a clear picture of the escalating cyberthreat landscape, with the company thwarting over 20.9 million DDoS attacks last year — a 50% increase from the previous year. 

As ransomware and AI powered cyber threats become an increasingly significant area of concern for businesses in Malaysia, it is imperative that stakeholders recognise that the security risk landscape in 2025 is more volatile and complex than ever.

This complexity also means cyber resilience can no longer be the domain of IT departments alone; it is a strategic imperative that spans the entire C-suite.

Remote work and cloud adoption have expanded the attack surface for insider threats, making them harder to detect.

From bot-driven credential stuffing to AI-orchestrated DDoS attacks, malicious actors are scaling their operations to automate attacks, evade detection and exploit vulnerabilities faster than organisations can respond.

Today, 94% of login attempts using stolen credentials are launched by bots, testing thousands of passwords per second. AI-powered automation is also behind a surge in high-impact, persistent DDoS campaigns, often fuelled by vast botnets and unsecured IoT devices.

Generative AI also affords criminals the ability to create hyper-realistic identities by blending real and fake data to bypass traditional verification systems. AI-generated personal details, deepfakes, and automated credential stuffing make these identities harder to detect.

AI-driven threats require AI-powered defenses. As generative AI becomes embedded in workflows, organisations will need to integrate AI-enhanced threat detection, automated defences, and strong credential hygiene to ensure they are facing the enemy head-on.

With the integration of AI in the overall security posture, organisations can drive more comprehensive security observability and leverage AI-powered detection to analyse vast datasets, identify anomalies and neutralise emerging threats in real time.

The threats don’t stop there. There are countless other headwinds that organisations need to navigate in today’s security landscape.

For instance, employees are adopting generative AI tools faster than security teams can keep up, creating “Shadow AI” blind spots that bypass traditional governance and compliance.

Furthermore, geopolitical tensions are spilling into cyberspace, with organisations underestimating these cyber threats, assuming neutrality while state-sponsored attacks disrupt industries and expose critical supply chain vulnerabilities.

Meanwhile, the uneven adoption of post-quantum cryptography — despite a jump from 3% to 38% in HTTPS traffic secured with quantum-safe encryption in March 2025 compared to a year ago — reveals a troubling lag in enterprise readiness.

With quantum computing poised to break traditional encryption, leaders must accelerate the adoption of post-quantum cryptography to protect long-term data and meet evolving regulatory expectations.

Supply chains remain one of the weakest links. With enterprises relying on dozens and even hundreds of third-party scripts, a single compromised vendor can be an open door for attackers. According to the World Economic Forum, 54% of large companies see third-party
risk management as their top cyber resilience challenge. 

Amid all of these emerging risks, Zero Trust isn’t optional anymore, it’s a necessity to seal these gaps.

Static passwords and basic multi-factor authentication (MFA) no longer cut it in a world of session hijacking, phishing-resistant threats and MFA bypass techniques. Enterprises must evolve towards full Zero Trust architectures, including password-less authentication and continuous, risk-based access controls. 

The good news is that 86% of organisations have already invested in or are planning to invest in Zero Trust solutions. However, only one-third have fully deployed it, highlighting a crucial execution gap.

Organisations will need to evolve their Zero Trust strategy from isolated controls to a single, unified layer spanning their entire enterprise. The focus will shift from secure, remote access management alone to unifying identity, data, and traffic policies across every environment. 

Thankfully, many leaders are already moving toward platforms that are resilient by design, are global by default, automate responses, and offer real-time visibility. That’s where the real value is: not just reducing risk but enabling agility.

Those that get ahead will be the ones that embed Zero Trust into their digital foundation — making it part of how they build, scale and innovate securely.

Finally, compliance can no longer be reactive. Cloudflare’s study has also found that 40% of Malaysian organisations are already spending more than 5% of their IT budget to address regulatory and compliance requirements while 51% reported spending more than 10% of their work week keeping pace with industry regulatory requirements and certifications.

Started as the Malaysian Cyber Security Act 2024, Malaysia is expected to launch the National Cybersecurity Strategy for 2025–2030 soon. This blueprint aims to strengthen the country’s cyber defence capabilities, enhance national resilience and effectively respond to the growing range of cybersecurity threats.

Alongside, it will lead the development of the joint Asean Cybersecurity Collaboration Strategy 2026-2030 involving 10 Asean member states.

Under the current cybersecurity framework, companies who fail to comply or report cybersecurity incidents face fines up to RM500,000. However, further from just avoiding legal penalties, ensuring a robust security posture has wider implications on protecting trust, reputation and long-term resilience in an environment where the cost of inaction is rising.

In an era of AI-charged attacks, rising regulatory demands and complex digital interdependencies, cybersecurity can no longer be siloed, reactive or an afterthought.

Companies need to move decisively in adopting AI-enabled defences, securing their supply chains, accelerating post-quantum readiness and unifying Zero Trust frameworks across their ecosystems.

Kenneth Lai is the area vice president (Asean) at Cloudflare.