As Malaysia moves from policy ambition to execution on its national AI agenda, enterprise security leaders face shifting regulatory expectations and a rising tide of AI-driven cyberthreats. The new AI Malaysia agency, the AI National Action Plan 2026-2030 and an upcoming AI Governance Bill all point toward a unified framework for governance and accountability.
Organizations can no longer treat cybersecurity, data protection and AI compliance as separate check-box exercises. They must fold these mandates into a single technology risk management strategy. And because both attackers and employees are using AI tools, security leaders must retire “trust by default” in favor of a “verify trust” model.
“The mindset needs to change from ‘can we detect an AI-generated attack’ to ‘what happens if the attacker is able to convincingly impersonate someone,” said Dato’ Ts. Dr. Haji Amirudin Abdul Wahab, former CEO of CyberSecurity Malaysia, the national cybersecurity agency under the Ministry of Digital.. “We need to ensure that all the messages, voices and video which can be manipulated can be verified… The role that CISOs need to do to ensure trust by default will be shifted to ‘verify trust.”
In this video interview with CISONow, Wahab also discussed:
• How Malaysia’s national AI agenda is being put into practice across banking, manufacturing, healthcare and the public sector;
• Aligning the Cyber Security Act 2024, PDPA amendments and AI governance guidelines into one organizational strategy;
• Framing AI exposure in financial, reputational and operational terms to win board buy-in.
Dato’ Ts. Dr. Haji Amirudin Abdul Wahab FASc is former CEO of CyberSecurity Malaysia, the national cybersecurity agency under the Ministry of Digital. With more than 30 years of ICT experience across public, private and international bodies, he leads national cyber resilience strategy, e-sovereignty monitoring and strategic risk management.
