by Thulasy Suppiah, Managing Partner
THE Prime Minister’s recent warning in Parliament that Malaysia could become a target of cyber threats deserves attention, but it should not lead us into panic. Recent viral cyber-threat maps have understandably caused concern. Yet, the National Security Council has cautioned against treating such online activity as proof of successful attacks, while the National Cyber Security Agency (NACSA) raised the national cyber threat level from low to medium as a precautionary measure.
Cybersecurity policy should be driven not by viral maps or fear, but by what Malaysia is building and how well those systems are prepared for emerging threats. In this regard, one project deserves particular attention: the Sovereign AI Cloud announced in Budget 2027.
The government states that the cloud is being planned to ensure that the rakyat’s data and the nation’s strategic information remain under Malaysian control. That is a vital objective. But keeping data under Malaysian control is only one part of digital sovereignty. A system can be sovereign and still be highly vulnerable.
The issue also extends beyond a single cloud project. As critical sectors, industries, public systems, and infrastructure increasingly explore and integrate AI, the digital environment Malaysia needs to protect will become increasingly complex. AI introduces security risks that go beyond those associated with traditional information systems.
NACSA itself recognises this in its 2026 AI Systems Cyber Security Framework. The framework identifies risks including data poisoning, prompt injection, model theft, unauthorised access, and attacks on the AI supply chain. Some of these threats do not simply attempt to break into a system; they actively interfere with the data an AI system relies on, the instructions it receives, or the outputs it produces.
That is why one principle within NACSA’s framework is particularly important: Secure-by-Design. Cybersecurity must be architected into an AI system from its inception, rather than patched on as an afterthought once it has already been developed or deployed. For the Sovereign AI Cloud, that principle should drive decisions over data protection, access controls, third-party components, continuous monitoring, testing, and incident response right from the design stage. The same rigorous thinking should guide AI systems used across our critical infrastructure and public services.
Malaysia is not starting from zero. We already have the Cyber Security Act 2024, NACSA, designated NCII sector leads, and now an AI-specific cybersecurity framework. The question is no longer whether Malaysia understands that cybersecurity matters. The task now is to ensure these laws, institutions, and frameworks are consistently translated into the very systems we are building today and those we will rely on in the future.
Before the Sovereign AI Cloud advances from a policy announcement to implementation, the government must clarify exactly how NACSA’s Secure-by-Design principles will be embedded into its architecture, procurement requirements, and arrangements with technology partners. Security testing, continuous monitoring, third-party risk management, and incident response are not secondary considerations to be settled only after deployment.
NACSA has already provided the framework. What matters now is whether it actively shapes the systems Malaysia actually builds.
If the purpose of the Sovereign AI Cloud is to keep the rakyat’s data and the nation’s strategic information under Malaysian control, then sovereignty cannot stop at ownership or control alone. A sovereign cloud must also be one whose infrastructure is designed, tested and defended to remain secure.
Written By:
Thulasy Suppiah
Lawyer focusing on AI, Data Centers & Cybersecurity
Managing Partner @ Suppiah & Partners
UG-13, Lexa Galleria, 45, Jalan 34/26,
Wangsa Maju, 53300 Kuala Lumpur.
Handphone no: 012-4915238
© 2026 Suppiah & Partners. All rights reserved. The contents of this newsletter are intended for informational purposes only and do not constitute legal advice.
