DigitalEdge
Make The Edge Malaysia your preferred
Malaysia is strengthening its cybersecurity foundations as businesses, public services and critical infrastructure become more digitally connected. The Cyber Security Act 2024 has reinforced the importance of stronger governance and accountability, while the adoption of cloud services, automation and artificial intelligence (AI) continues to change how organisations operate.
But regulation and technology address only part of the challenge. Malaysia also needs people with the expertise to implement security effectively, govern emerging technologies and respond when incidents occur.
Fortinet’s 2026 Global Cybersecurity Skills Gap Report found that 93% of Malaysian organisations surveyed experienced at least one breach over the preceding 12 months. More than half reported costs exceeding US$1 million (RM4.02 milliion), while 70% took longer than a month to recover.
A shortage of cybersecurity skills remains one of the main contributors to these incidents, 71% of Malaysian respondents said. The issue is no longer simply that qualified professionals are difficult to find but that many organisations have yet to make cybersecurity capability a sustained business investment.
Competition for experienced cybersecurity professionals is significant, yet 55% of Malaysian IT and security leaders said they struggled to obtain approval to add cybersecurity talent.
This tension is revealing. Organisations recognise that cyber risks are rising, but security hiring can still be treated as a discretionary expense, leaving cybersecurity teams to protect expanding digital environments without a corresponding increase in expertise or capacity.
This can leave technology investment outpacing the expertise required to support it. Organisations may approve new platforms because the expenditure is visible and implementation has a defined timeline, while developing people is less immediate and requires training, career pathways and a longer-term commitment.
But security technology does not operate independently. Its effectiveness depends on whether an organisation has people who can configure it correctly, interpret the information it produces, connect that information with wider business risks and act quickly during an incident.
The consequences should make this a board-level concern. More than half of Malaysian respondents said an executive or board member had faced individual penalties following a cyberattack.
Accountability is moving upwards, but investment decisions have not always kept pace. Boards do not need to become cybersecurity specialists, but they do need sufficient understanding to ask whether their organisations possess the capabilities, not merely the tools, to manage their exposure.
AI adding second dimension to skills gap
This challenge is becoming more urgent as organisations adopt AI.
AI-powered security tools can help defenders analyse large volumes of information, detect unusual behaviour and respond more efficiently. In Malaysia, the majority of organisations are already using or testing AI-enabled cybersecurity solutions, with many reporting improvements in the effectiveness of their teams.
AI can help organisations make better use of scarce security expertise, but it does not remove the need for that expertise. In some areas, it increases it.
Malaysian organisations now need people who can develop and understand AI models, oversee AI-enabled tools and automate security operations. Yet nearly three-quarters said recruiting cybersecurity talent with specific AI experience is a significant challenge.
At the same time, security teams must contend with attackers using AI to increase the speed, scale and credibility of their campaigns. Defending against this requires people who understand both the technology and the evolving threat landscape.
The result is not one skills shortage, but two overlapping ones: the longstanding shortage of cybersecurity professionals and an emerging shortage of people who understand the intersection of AI, security and governance.
More than three-quarters of Malaysian organisations expect demand for AI oversight and governance roles within cybersecurity teams to increase over the next three years. However, only 65% of business leaders believe their boards fully understand the risks arising from employees’ use of AI.
This gap between adoption and oversight is where risk can accumulate. AI use will not remain confined to approved corporate platforms, as employees can already access a growing range of public and embedded AI services, sometimes with limited awareness of how corporate information may be stored, processed or reused.
Policies are necessary, but they will not be enough on their own. Organisations need managers who can translate them into working practices, employees who understand the consequences of their choices and security professionals who can identify where controls are failing.
Broader approach to building cyber talent
Malaysia cannot rely solely on recruiting more conventional cybersecurity specialists. Demand is evolving too quickly, and organisations are competing for many of the same experienced professionals.
A broader workforce strategy is needed, beginning with identifying the capabilities organisations lack today and those they will require as AI adoption expands. Leaders should then develop a multi-year plan to build them through targeted recruitment, training, certification, mentoring and practical experience.
Organisations should also invest in the people they already have. Structured development and internal mobility can help employees from technology, risk, compliance and other related functions transition into cybersecurity roles, while certifications can provide clear learning pathways and help validate that people possess the practical capabilities their roles require.
The recruitment pool must also become broader. Cybersecurity teams need deep technical expertise, but they increasingly require capabilities in business risk, regulation, data governance, communications and human behaviour.
Women, mid-career professionals, people from adjacent disciplines and candidates without conventional technology backgrounds can all contribute when given structured pathways into the profession. Expanding access to cybersecurity careers will not solve the shortage immediately, but it can build a stronger and more sustainable talent pipeline.
Cybersecurity workforce planning also cannot remain the responsibility of the chief information security officer alone. Human resources teams should incorporate cybersecurity and AI capabilities into their talent strategies, while business leaders and boards must regularly assess whether the organisation has the expertise needed to support its digital ambitions.
Technology will remain essential to Malaysia’s cyber resilience, but its value ultimately depends on the people who deploy it, interpret what it reveals and act when threats emerge. Closing the skills gap therefore requires the same sustained attention as any other strategic business risk.
Kevin Wong is the country manager for Fortinet Malaysia, a global cybersecurity firm
Save by subscribing to us for
your print and/or
digital copy.
P/S: The Edge is also available on
Apple’s App Store and
Android’s Google Play.
