AI-driven cyberattacks are getting faster and more autonomous. In this byline, Malis Selamat, Managing Director, ASEAN at Sophos, explains what Malaysian organisations should prioritise now.
Most AI and cybersecurity conversations have focused on AI writing better phishing emails or cloning voices for fraud calls. That’s real, but it understates what’s happening now.
What’s different about agentic AI is autonomy. An attacker can hand an AI agent a goal rather than a script, and the agent will scan for exposed services, adapt when a defence blocks it, and chain intrusion stages together with little human input.
Table of Contents
How Agentic AI Is Industrialising Malware
A threat intelligence disclosure in June 2026 revealed a fully operational threat-actor lab built to develop malware that defeats endpoint detection tools. An AI “manager” directed several agents through code generation, testing and revision, running each build against live security products before shipping it. It wasn’t theoretical red-teaming. It was a working pipeline, industrialising what used to be slow, manual malware development.
Why AI-Driven Cyberattacks Hit Faster
The bigger structural story sits in Sophos’ latest Active Adversary Report, drawn from 661 incident response and MDR cases. Median attacker dwell time has fallen to three days, and identity-based attacks (stolen credentials, weak MFA, poorly protected accounts) now lead software exploitation as the main way in.
Sophos’ State of Identity Security 2026 found 71% of organisations suffered an identity-related breach in the past year, while 67% of surveyed ransomware victims traced their incident to an identity attack.
AI-driven cyberattacks aren’t inventing new ways through the door. They’re collapsing the time between getting in and doing damage, a bigger problem for defenders working at human pace. Malaysia’s numbers point the same way: CyberSecurity Malaysia’s Cyber999 centre logged a 29% jump in reported data breach incidents in the first quarter of 2025 alone.
Why This Is a Governance Problem, Not Just a Tooling One
The Cyber Security Act 2024 and Bank Negara Malaysia’s revised Risk Management in Technology (RMiT) policy have raised expectations around incident reporting, risk assessment and cybersecurity controls. The Personal Data Protection (Amendment) Act 2024 adds mandatory data breach notification, in force since June 2025, and higher penalties.
In July, Parliament passed the Cybercrimes Bill 2026 to replace the Computer Crimes Act 1997 and address increasingly complex cyber threats, including the misuse of AI. The Digital Ministry’s draft Artificial Intelligence Governance Bill is expected to be tabled this quarter or by the first quarter of 2027 at the latest.
Frameworks alone don’t close the human gap, though. In January 2026, BNM fined Bank Kerjasama Rakyat Malaysia Bhd RM1 million after an external breach of its IT infrastructure, citing inadequate cybersecurity controls and incident response, not a missing policy.
Most governance frameworks were built for human-paced threats. AI-driven cyberattacks move, adapt and escalate at machine speed, forcing organisations to rethink not just their security tools, but how quickly decisions, accountability and response can happen.
4 Priorities to Defend Against AI-Driven Cyberattacks
None of this calls for panic. The fundamentals haven’t changed; they matter more. Four things are worth prioritising:
- Identity first. Phishing-resistant MFA and tight management of both human and machine (“non-human”) identities should top any 2026 security roadmap, especially with PDPA breach-notification duties and RMiT identity controls in force.
- Assume compressed timelines. With a three-day median dwell time, detection, containment and response must run in parallel, not as sequential steps with review gates, usually through 24/7 managed detection and response rather than business-hours monitoring.
- Match machine speed with machine speed. When an AI-assisted pipeline can generate and test dozens of evasion variants in an afternoon, detection must work off attacker techniques and behaviours, not just known signatures, because the payload may be new every time.
- Close the human gap. Tools without investment in people and forensic readiness leave the weakness BNM’s RM1 million fine on Bank Rakyat put a price on. Tabletop exercises and response drills matter more as AI compresses response windows.
Agentic AI hasn’t replaced the attacker’s human intent, and human error on the defending side still drives many incidents. What it has done is remove the friction that once gave defenders breathing room. That breathing room must now be re-engineered into enterprise defence against AI-driven cyberattacks before it disappears for good.
About Sophos
Sophos, a global cybersecurity leader, defends more than 625,000 organisations worldwide with Sophos Fusion, its AI-native defence system powered by agentic AI and elite human expertise. Headquartered in Oxford, U.K., Sophos detects, investigates and neutralises threats before they disrupt business. Learn more at www.sophos.com.
