This article first appeared in Digital Edge, The Edge Malaysia Weekly on August 10, 2026 - August 16, 2026

Malaysian banks are moving beyond firewalls to monitor customer behaviour, secure digital identities and control artificial intelligence (AI) systems as real-time payments leave less time to detect and stop fraud.

The change is widening the scope of cyber defence from a bank’s own network to its customers, external partners and the automated agents moving between their systems.

“We are moving from protecting or monitoring the wall towards monitoring the behaviour of the user or client,” says Tahrizi Tahreb, chief information security officer (CISO) at Bank Kerjasama Rakyat Malaysia Bhd (Bank Rakyat). Banks now look for transactions outside a customer’s usual hours, unusual timing and other changes in how an account is used, he points out.

Tahrizi was speaking at the “Cyber Defense 2.0: Safeguarding Payments, Data, and Identity in the Fintech Age” panel discussion at the Fintech Revolution Summit Malaysia 2026 held in Kuala Lumpur on July 23. The panel discussion was moderated by YTL Digital Bank Bhd (Ryt Bank) CISO Goh Ser Yoong. It also featured Boost Bank chief technology officer Shankar Krishnan and Crest Infosolutions Sdn Bhd founder and CEO Hemant Prasad.

The monitoring of users’ or clients’ behaviour matters because criminals no longer need to breach a bank’s systems to steal from its customers. Reported scam losses in Malaysia reached RM2.8 billion in 2025, according to Bank Negara Malaysia.

Shankar says a bank can build an “amazing system” and still see customers lose money when criminals manipulate the people using it.

“The perimeter now extends into our parents’ pockets,” he says, referring to fraudulent WhatsApp messages and links targeting older users. Shankar says one practical response is to warn older family members about common scams and encourage them to pass the information on.

For banks, that makes public awareness and the rapid exchange of fraud intelligence part of cyber defence. Goh says institutions need to alert customers quickly when criminals change their methods because payments now happen in a split second.

Tahrizi points to the National Scam Response Centre’s 997 hotline and the coordination among banks and regulators as another part of that wider defence.

“This is a consolidated effort. You cannot rely only on the bank itself, but on the network of banks and the regulator to help prevent advanced attacks.”

The same logic is changing how banks think about identity. Tahrizi says the era of one-time passwords sent through SMS may be ending, but one-time passwords delivered through banking applications and other authentication methods remain relevant.

“Identity is no longer one element of security. It is the security,” he says.

When a payment can move from one account to another in seconds, the central question is whether the person instructing the bank is really who he or she claims to be. Tahrizi says zero-trust controls and full multi-factor authentication should apply to ordinary customers, rather than being reserved for selected or premium accounts.

He adds that the difficulty lies in maintaining those controls without making everyday banking unnecessarily cumbersome.

“We need to balance protection with the ease of the business process and transaction.”

Goh says identity checks begin long before login, during onboarding, when documents, signatures and consent records are verified. If that process fails, every later authentication step may rest on an identity that was never properly established.

AI is changing both sides of cyber defence as the same tools can help criminals scale attacks as well as allowing banks to analyse threats and respond faster.

Shankar explains that bank boards have moved beyond asking whether banks use AI, and are focusing instead on how the technology is secured.

He says for Boost Bank, the immediate benefit is time, pointing to the analysis of firewall rules and system logs, which his team once carried out manually using spreadsheets. The data can now be fed into an AI platform.

“You get the results in minutes, with a well-processed report,” he says.

Boost Bank has built internal tools to triage suspected phishing emails, assign a confidence score and pass the final decision to a user. It also uses automation to identify internet-facing assets that technology teams may have overlooked and to prioritise software vulnerabilities according to their actual risk.

Instead of relying only on a conventional critical, high, medium or low rating, the bank considers whether a vulnerability is being actively exploited, whether similar attacks have occurred in the region and how the affected infrastructure is configured.

That allows a lean security team to direct its attention to threats most likely to cause harm. It also illustrates why banks are adopting AI even as the technology gives attackers greater speed and scale.

“Agents can fail hundreds of thousands of times. They just need one success. If we are going to work on a traditional model and say, ‘I have a security operations centre and it will take care of it’, we are never going to get there,” says Shankar.

The answer is not to let AI operate without limits. Boost Bank registers models under a model risk management framework before deployment and places their use within broader data and AI governance controls.

He stresses that human accountability remains the dividing line, ensuring that there is still human verification within the loop.

“AI is not going to be accountable for any decisions we make. The decision still comes back to a human,” says Shankar.

That principle becomes more difficult to apply when AI agents begin communicating and carrying out tasks on behalf of individuals and organisations.

Non-human identities already include applications, automated services and other software that require access to systems and data. AI agents expand the category because they can take a series of actions rather than simply performing a fixed technical function.

Crest Infosolutions’ Hemant says the number of such identities is climbing quickly, citing research that states there are now about 144 non-human identities for every human one, up from roughly 80 a year earlier. The figure, he adds, may already be higher.

“There are more non-human entities than human entities,” he emphasises.

Hemant says banks may soon have their internal agents exchanging information directly with agents operated by payment partners and other external organisations.

“How does your agent trust your partner’s agent to be the real identity exchanging data between them? That is where things are going to get more and more complicated.”

The panel members agree that Malaysia has yet to establish a single framework governing AI in financial services. In its absence, banks are setting internal policies and drawing on external references, including guidance from the US’ National Institute of Standards and Technology and the Open Worldwide Application Security Project, as well as the European Union’s AI Act.

At Boost Bank, Shankar says the starting point is an acceptable-use policy for AI, supported by controls over how models are registered, tested and deployed.

Ryt Bank’s Goh says the regulatory gap does not excuse inaction. “Even though there are no regulations, it does not stop organisations from doing self-regulation and self-governance.”

Tahrizi of Bank Rakyat believes banks should anticipate the direction regulators are likely to take and establish the basic controls before detailed local stipulations are enforced.

“We need to foresee the trends and movement of regulation that will be coming. Look at the core foundational requirements and whether we are meeting them,” he says.

Some of the most important work is also less futuristic, says Crest Infosolutions’ Hemant, as financial institutions still struggle to establish what customer data they hold, where copies are stored and how long the information should remain in their systems.

“You cannot protect what you don’t know or what you cannot find,” he says.

Banks and other large organisations are investing in data lakes, classification and labelling. Those projects help locate sensitive information, although Hemant points out that indiscriminate labelling can create a separate problem when too much data receives the same classification.

The larger weakness is what happens at the end of the data’s useful life.

“The challenge still remains the governance part, how long to keep the data. Keeping too much customer data is also a bigger problem because, when you have too much customer data, you need to continue investing in protecting and guarding it.”

Older records continue to impose storage and security costs even when their value to the business has diminished. If an organisation reduces protection because the board is unwilling to fund the same controls for data that is seven or eight years old, the risk returns.

Hemant says organisations need clearer rules for disposing of information once the applicable legal and compliance requirements have been met.

“I haven’t seen a lot of organisations purging the data when it is not needed,” he says.

For Ryt Bank’s Goh, this is a reminder that the next generation of cyber defence still depends on the work institutions should already be doing.

“Some of these classifications and data labelling are not Cyber Defense 2.0. They are cyber hygiene that we have been practising for years.”

Save by subscribing to us for your print and/or digital copy.

P/S: The Edge is also available on Apple's App Store and Android's Google Play.