• Some critical infrastructure operators take days to detect incidents they must report within six hours, says Arun Kumar
• He wants AI agents governed like staff, each with an owner and limited access

Some of Malaysia’s critical infrastructure operators still take days to detect a cyber incident, leaving them short of a six-hour reporting requirement that has applied since August 2024, according to ManageEngine’s Arun Kumar.

The gap carries more weight after September, when a cyber incident hit the terminal operating systems at the Port of Tanjung Pelepas (PTP) in Johor. The port is run by Malaysian conglomerate MMC Corporation’s ports and logistics division, with Maersk subsidiary APM Terminals holding a 30% stake, and handled more than 14 million twenty-foot equivalent units (TEU), the standard measure of container volume, in 2025.

PTP detected the incident at 11.34pm on 9 September and suspended container operations as a precaution. It began a phased restart the next day, processing some export containers manually at the gate. Italian logistics outlet TrasportoEuropa reported that PTP appeared on the Direwolf group’s leak site on 11 September, citing the tracker Ransomware.live. PTP has not confirmed a ransomware attack or attributed the incident to the group.

The incident came in a year when the National Cyber Security Agency (NACSA) recorded 5,110 cybersecurity incidents from January to September, its chief executive Ir Dr Megat Zuhairy Megat Tajuddin told Bernama on 9 November.

Arun, ManageEngine’s regional vice president for Asia Pacific, was asked about the wider lessons of incidents like PTP’s. In an email interview with Tech Wire Asia, he said ports and data centres now depend on constant data exchange between operational systems and corporate IT. Terminal systems feed shipping lines and customs, while vendors often monitor power and cooling equipment remotely.

“When the corporate side is compromised, operators often have to shut operational systems down as a precaution, because they cannot be certain how far the attacker has reached,” he said.

He said attackers rarely need anything sophisticated. Stolen credentials and vendors’ remote access accounts remain common ways in, and once inside, attackers go after identity systems. Citing CyberSecurity Malaysia’s Q2 2026 Cyber Incident Summary Report, he said incidents rose 24% from the previous quarter to 2,715, with ransomware groups targeting Active Directory servers and VMware environments.

PIKOM’s Cyber Resilience in Malaysia 2026 report, based on a March 2026 survey mainly of its members, found 25.6% of affected organisations had experienced credential theft or identity-based attacks.

Six hours to report a critical infrastructure incident

The Cyber Security Act 2024 covers National Critical Information Infrastructure (NCII) entities across 11 sectors. Each must carry out a cyber risk assessment at least once a year and undergo an audit every two years. An entity must alert NACSA as soon as it discovers an incident, then file a detailed report within six hours. A fuller account is due within 14 days.

Arun said many operators have policies in place, but many lack visibility of their own assets, particularly operational systems and machine accounts.

“A six-hour reporting window is hard to meet for organisations that still take days to detect an incident,” he said.

Budget 2027 tasks NACSA and the Malaysian Communications and Multimedia Commission with developing local data protection technology that can withstand quantum computing threats. Arun said that kind of national effort has limits.

“Public funding cannot secure systems that private operators own and run,” he said. He added that operators should start with backups and tight control over who can reach critical systems, and be able to show that control at any point in the year.

Accountability stays with the operator

Arun said under the Act, a breach that comes through a vendor or managed service provider remains the NCII entity’s responsibility.

“An operator can outsource execution, such as IT operations or security monitoring, but it cannot outsource accountability,” he said.

NACSA now licenses providers of managed security operations centre monitoring and penetration testing. The amended Personal Data Protection Act also places security obligations directly on data processors.

Arun said banks and other operators already under sector regulation tend to write security clauses and incident notification timelines into supplier contracts. In logistics and manufacturing, contracts still focus mainly on uptime and service levels.

Budget 2027 also includes a RM30 million MDEC fund to help 4,000 micro, small and medium enterprises adopt AI and automation. Arun said many of those firms supply larger operators and will soon connect new tools to their customers’ systems.

“A contract will not stop a compromised vendor account from being misused,” he said. He advised operators to ask suppliers for evidence rather than assurances, and to remove a supplier’s access as soon as its contract ends.

Johor’s concentration of data centres and port capacity

Arun said the threats facing Malaysia remain broadly similar to those across ASEAN. “What has changed is how much is now concentrated in one place,” he said, pointing to Johor, where much of the region’s data centre build-out sits alongside one of its busiest transshipment ports.

PwC’s Global Data Centre Outlook estimates that Malaysia had around 1.2GW of pre-leased data centre capacity in the first half of 2026, the second-highest in Asia Pacific after Japan. It projects about US$287 billion in cumulative data centre investment in Malaysia between 2026 and 2050, second in ASEAN behind Singapore.

“An incident in that corridor has consequences well beyond Malaysia,” Arun said.

He said power and land still decide where data centres are built, while cyber readiness counts once operators compete for tenants. He was unable to name a specific deal, as he said those discussions are confidential, but said security questions now come up much earlier in due diligence.

He also drew a line between data residency and data security in Budget 2027’s planned sovereign AI cloud. “Hosting data in Malaysia tells you where it resides, not who can reach it,” he said. “Cyber readiness rarely wins a deal on its own, but a weak answer can slow a deal down.”

The government says Malaysia is recognised at Tier 1 for its readiness to move to post-quantum cryptography. PwC’s Malaysia findings, which the firm republished in a July 2026 report on post-quantum security, show 42% of organisations have yet to implement or plan quantum-resistant security measures.

AI agents need owners

ManageEngine’s Identity Security Outlook 2026 found machine identities outnumber human ones by 100 to one or more. Arun acknowledged the study surveyed 515 professionals in the US and Canada only, but said the company sees the same pattern in the region, with more of these identities now acting on their own.

“A service account runs the same task in the same way every time, while an AI agent can decide its next step, call several systems, and reach data it was never meant to access, often with broad permissions,” he said.

He advised treating AI agents like employees, each with an assigned manager and only the access it needs.

ManageEngine, which sells identity and privileged access tools, lets customers build such agents through its Zia AI. Arun said a customer could let a service desk agent unlock a user’s account on its own while requiring a technician’s approval before it grants administrator rights.

“Every action an agent takes is logged and traceable, because a promise is not a control, but a log is,” he said.

He said ManageEngine is accountable for the platform working as designed, and the customer for what it authorises an agent to do. He recommended starting with agents that recommend rather than act.

Where automation should stop in operational technology

In February, Gartner predicted that by 2028, “misconfigured AI in cyber physical systems (CPS) will shut down national critical infrastructure in a G20 country.”

“If AI disables a user account, you can reverse the action in minutes. However, if AI stops a crane, conveyor, or cooling system, this halts operations and creates safety risks,” Arun said.

He recommended automating freely on the IT side and at the boundary with OT, such as cutting off a suspicious remote session into the operational network, while leaving any change to how equipment runs to someone who understands the operation. PwC’s 2027 Global Digital Trust Insights, which surveyed 3,934 business and technology leaders worldwide, found only 22% would let AI act fully autonomously in cyber defence.

Preparing for the AI Governance Bill

Arun said controls also need to work when employees forget their training. Gartner found in February that “existing security awareness efforts continue to fail to reduce cybersecurity risks as GenAI adoption accelerates,” with more than 57% of the 175 employees it surveyed using personal GenAI accounts for work.

Digital Minister Gobind Singh Deo has said the AI Governance Bill will be tabled in the Dewan Rakyat early next year. Arun said organisations should first find every AI tool in use, including employees’ personal accounts, and give each one a risk level and an owner.

“Organisations will also need people who can supervise AI, not just use it,” he said, pointing to Budget 2027’s plan to train and certify 5,000 AI professionals through MDEC.