Cybersecurity is no longer just an IT problem. As artificial intelligence makes online scams more convincing, protecting personal information, business systems and public trust is becoming a shared responsibility.

As Malaysia continues to embrace digital services, online banking, artificial intelligence and internet-based communication, cybersecurity is becoming increasingly important to everyday life.

However, the same digital transformation that creates new opportunities also introduces new risks. Cybercriminals can exploit weaknesses in data protection, manipulate users through convincing messages and misuse emerging technologies to make fraudulent activities harder to recognise.

The challenge is no longer limited to preventing hackers from accessing computer systems. It also involves protecting people from deception, safeguarding sensitive information and ensuring that the public can continue to trust digital communication.

AI Is Making Online Scams More Convincing

Artificial intelligence is changing how cybercriminals can approach potential victims.

Traditional phishing attacks often contain suspicious links, spelling mistakes or generic messages. These warning signs can make fraudulent communications easier to identify.

Generative AI, however, can help criminals produce more convincing messages tailored to particular individuals, organisations or situations.

AI-generated voice clones and deepfake videos can also be used to impersonate people, potentially making fraudulent requests appear to come from trusted colleagues, family members or company executives.

For example, an employee might receive a message that appears to come from a senior manager requesting an urgent payment. A criminal could combine publicly available information, an impersonated identity and a convincing message to pressure the employee into acting quickly.

The employee may believe the request is genuine, particularly if it arrives during a busy working day.

The danger is not simply that AI can generate convincing content. It is that people may act on that content before verifying its authenticity.

This makes awareness alone insufficient. Individuals and organisations also need reliable procedures for checking identities, approving transactions and handling sensitive information.

Growing Awareness Does Not Automatically Mean Better Protection

A report cited by Malaysia Cyber Consumer Association president Siraj Jalil highlights the extent of public concern about digital threats.

According to figures from the GSMA ASEAN Consumer Scam Report cited in Bernama's coverage, 96% of consumers were worried about falling victim to scams or hacking, while 66% had changed their daily behaviour to protect themselves.

The report also found that 41% of consumers ignored calls from unknown numbers and 56% avoided incoming calls altogether, according to Siraj's remarks.

These figures illustrate an important challenge: people are changing how they communicate because they are concerned about fraud.

Although caution can help reduce exposure to scams, excessive distrust can also affect legitimate communication. People may hesitate to answer genuine calls from banks, businesses or government agencies because they cannot confidently distinguish them from fraudulent ones.

This creates a broader problem for the digital economy.

When users no longer feel confident about the authenticity of messages, calls and online transactions, trust in digital services can weaken.

Cybersecurity must therefore address both the technical risks and the uncertainty experienced by the people using these services.

Data Breaches Can Damage More Than Financial Accounts

When people think about cybersecurity incidents, they often imagine stolen passwords, compromised bank accounts or financial losses.

However, the consequences of a data breach can extend much further.

Exposed personal information can potentially be used for identity theft, targeted phishing, impersonation and other fraudulent activities. Information obtained from one incident may also help criminals construct more convincing attacks against the same individuals or organisations.

For businesses, compromised information can damage customer confidence and raise concerns about whether sensitive records are being adequately protected.

For public institutions, the consequences may be even broader. Unauthorised disclosure of sensitive government information can undermine confidence in public services and potentially expose information relevant to national interests.

Associate Professor Dr Mohd Khairie Ahmad of Universiti Utara Malaysia, commenting in the Bernama report, emphasised that data security is closely connected to national resilience, public trust and the reliability of digital communication.

This highlights a crucial point: data protection is not merely a technical requirement. It is an important part of maintaining confidence in the institutions and services people depend on.

Why Businesses Cannot Rely on Employees Alone

Employees are often described as the weakest link in cybersecurity. However, placing the entire responsibility on individuals overlooks the wider security environment in which they operate.

An employee might recognise a suspicious email but still be exposed to a highly convincing impersonation attempt. A customer might use a strong password but suffer the consequences of a data breach at a service provider.

Organisations therefore need to build systems that reduce the likelihood and impact of human error.

Practical measures include:

• Multi-factor authentication: Add another layer of protection beyond passwords.
• Transaction verification: Require independent confirmation for unusual or high-value payments.
• Access control: Limit access to sensitive information according to job responsibilities.
• Employee training: Teach staff to recognise phishing, impersonation and suspicious requests.
• Security monitoring: Investigate unusual account activity, access patterns and transactions.
• Incident response planning: Establish clear procedures for responding to suspected breaches and communicating with affected parties.

These measures work best together. Training helps employees recognise threats, while technical controls and verification procedures reduce the chance that a single mistake will lead to a serious incident.

False Information Can Make a Cybersecurity Crisis Worse

Cybersecurity incidents can also create an information problem.

When an organisation experiences a suspected breach, people naturally want to know what happened, whether their information was affected and what action they should take.

If accurate information is delayed, rumours and speculation can spread through social media and messaging platforms.

AI-generated content can make this situation more difficult by enabling the rapid production of convincing but false claims, fabricated screenshots or manipulated recordings.

The result may be confusion about the incident itself, the spread of incorrect instructions or the impersonation of organisations attempting to communicate with affected users.

This is why incident response should include clear and timely communication alongside technical investigation.

Organisations should explain what is known, what remains under investigation and what affected individuals should do next, while protecting sensitive information.

At the same time, members of the public should verify major claims through official channels rather than relying solely on forwarded messages or unverified social media posts.

Building a Safer Digital Environment in Malaysia

Strengthening cybersecurity requires cooperation between government agencies, businesses, technology providers and the public.

Government and industry organisations need to maintain appropriate data protection, improve detection capabilities and establish effective incident response procedures. Digital platforms also have a role in addressing fraudulent activity and reducing opportunities for abuse.

Malaysia's Cyber Security Act 2024 (Act 854) provides a legislative framework for national cybersecurity, particularly concerning the country's designated National Critical Information Infrastructure sectors. However, effective cybersecurity also depends on implementation, technical capability, skilled personnel and continued adaptation to evolving threats.

The Bernama report also highlighted the importance of developing local cybersecurity capabilities. Building expertise within Malaysia can help strengthen the country's ability to investigate incidents, maintain critical technologies and respond to emerging threats.

For organisations, this means treating cybersecurity as an ongoing business priority rather than an issue to address only after an incident occurs.

For individuals, it means developing practical habits such as using unique passwords, enabling multi-factor authentication, checking unexpected requests through trusted channels and avoiding the disclosure of confidential information without verification.

Verification Is Becoming an Essential Digital Skill

As AI-generated messages, voices and videos become increasingly convincing, people need to develop a habit of verifying information before taking action.

A message that appears to come from a manager should not automatically authorise a payment. A familiar voice should not be treated as conclusive proof of identity. A professional-looking email should not be trusted simply because it contains accurate company details.

The same principle applies to AI-generated information: a confident answer or realistic-looking document is not necessarily accurate.

For important decisions, verification should involve independent evidence, trusted communication channels and established organisational procedures.

Trust should be supported by evidence, not appearance.

This principle is particularly important when money, personal information, business operations or public safety are involved.

Cybersecurity Is About Protecting Trust

Malaysia's digital future will depend not only on adopting new technologies but also on ensuring that people can use them safely and confidently.

AI can improve productivity, communication and business operations. Digital services can make everyday transactions more convenient. Connected systems can help organisations work more efficiently.

But these benefits depend on the ability to protect the information and people behind them.

Cybersecurity must therefore go beyond firewalls, passwords and technical defences. It must also include responsible technology use, effective organisational controls, reliable communication and the ability to distinguish genuine information from manipulation.

The central question for every organisation is no longer simply whether its systems are connected or technologically advanced.

It is whether those systems, and the information they handle, can be trusted.

As AI and digital services continue to evolve, protecting that trust must remain a shared responsibility.