PETALING JAYA: Malaysian companies face cybersecurity risks due to budget and expertise challenges despite recognising its importance, say leading trade groups.
Despite using various digital tools like accounting software, customer relationship management systems, e-commerce platforms, payment gateways, cloud storage and social media tools to enhance efficiency, they said many companies remain reactive and ill-prepared for cybersecurity risks.
Malaysian Consortium of Mid-Tier Companies president Martin Ang said feedback from members showed that mid-tier companies generally assess their cybersecurity risks infrequently, often only after an attack or due to audit requirements.
“Routine risk assessments are not yet a standard practice due to resource constraints and limited awareness of cybersecurity’s importance,” he said in an interview yesterday.
Ang noted that more progressive mid-tier firms are adopting measures like employee training, penetration testing and third-party vulnerability assessments to identify and prioritise cyber threats.
“They typically secure networks with firewalls, intrusion detection systems and virtual private networks, using encryption protocols to protect sensitive data alongside antivirus software.
“However, update frequencies vary, with larger firms following structured schedules while others update on an ad hoc basis,” he said.
“Employee training on recognising threats like phishing is inconsistent, with many viewing cybersecurity as a technical issue limited to IT teams.”
To effectively combat cyber threats, Ang urged Malaysian businesses to shift toward comprehensive cyber resilience and risk management training for all.
“Cybersecurity must be seen as an essential investment rather than an afterthought. Investing in robust cybersecurity measures protects data and builds trust with stakeholders, especially in a regulatory environment shaped by laws like the Personal Data Protection Act,” said Ang.
SME Association of Malaysia president Chin Chee Seong highlighted that many SMEs, including larger ones, struggle to afford cybersecurity due to high costs.
“They often don’t prioritise cybersecurity until problems arise and they lack skilled staff, leading to reliance on outsourcing. These challenges are exacerbated as they focus budgets on other needs like marketing and operations,” he said, adding that SMEs typically rely on basic tools like antivirus software and firewalls.
Chin noted that SMEs often seek external help for cybersecurity due to a lack of in-house skills.“They find assistance through IT consultants, government agencies like MDEC and CyberSecurity Malaysia, industry groups, managed security service providers, cloud platforms or referrals. However, high costs and limited awareness make accessing these services challenging,” he said.
Chin said some Malaysian SMEs have experienced breaches, resulting in financial losses from paying hackers and repairing damage, operational disruptions, loss of customer trust and legal troubles due to inadequate data protection. Association of Private Hospitals Malaysia president Datuk Dr Kuljit Singh stated that private hospitals are increasingly prioritising cybersecurity to protect sensitive patient information, maintain trust and ensure regulatory compliance.
He noted that private healthcare employs industry-standard security methods similar to those in financial institutions.
“By adopting robust security measures and staying abreast of technological advancements, private hospitals can mitigate risks and enhance cybersecurity, creating a safer environment for patients and providers alike,” he added.
