New cyber force must complement, not compete with existing agencies
PETALING JAYA: Malaysia’s proposed cyber force could become a crucial line of defence against increasingly sophisticated digital threats, but experts warn its effectiveness will hinge on clearly defined roles and seamless coordination with existing cybersecurity agencies to avoid overlap and confusion.
Prof Dr Ainuddin Wahid Abdul Wahab of Universiti Malaya’s Centre of Research for Cybersecurity and Network said establishing a dedicated cyber force as the fourth service branch of the Malaysian Armed Forces was a timely and necessary move, as cyberspace had emerged as a new battlefield alongside land, sea and air.
He likened Malaysia’s defence structure to a house with three strong walls – the army, navy and air force – but no protection for its “digital front door”.
“Cyberspace is now a battlefield too, so it deserves its own branch, not just a borrowed unit,” he added. Ainuddin said a dedicated cyber force would provide specialised command, dedicated funding and structured career pathways, significantly strengthening Malaysia’s ability to detect, prevent and respond to cyber threats targeting government and defence systems.
However, he stressed that the new force must complement rather than duplicate the work of existing agencies such as the National Cyber Security Agency and CyberSecurity Malaysia.
“Their roles must remain separate but connected. If they do not share information, it is like three guards locking different doors but never communicating with one another,” he explained.
Effective intelligence sharing, clearly defined responsibilities and a unified command structure would be essential to building a resilient national cyber defence ecosystem.
Ainuddin warned that Malaysia was facing an increasingly complex cyber threat landscape, ranging from cyber espionage targeting government and defence information to ransomware attacks on essential services and potential assaults on critical infrastructure such as power grids, ports and financial systems.
“Our critical infrastructure is like the body’s vital organs. If attackers hit the power grid or banking system, the whole country feels it, not just one sector,” he said.
As Malaysia accelerates its digital transformation through initiatives such as e-government services, smart ports and digital banking, Ainuddin noted that the country’s cyber attack surface would continue to expand.
“A dedicated force focused on threat intelligence and rapid response is needed rather than simply repairing damage after attacks occur,” he added. On the growing threat of cognitive warfare, in which hostile actors manipulate public perception through digital platforms, Ainuddin said the risks extended well beyond technical attacks and could undermine national stability.
“Cognitive warfare does not hack computers; it hacks minds,” he warned, adding that misinformation, deepfakes and manipulated content could be weaponised to influence public opinion.
He urged Malaysia to strengthen media literacy, accelerate fact-checking efforts and foster closer cooperation between defence and communications agencies to counter such threats.
“Cyber defence cannot only be about firewalls. It must also include defending the information space,” he said. Ainuddin also underscored the importance of developing and retaining cybersecurity talent, saying advanced technology alone would be insufficient without skilled personnel.
“Technology is only as good as the people using it, like buying a top-of-theline ambulance with no trained paramedics on board,” he explained.
He added that Malaysia would face stiff competition from the private sector in recruiting cybersecurity specialists, making competitive remuneration, specialised training and long-term career development essential.
However, International Islamic University Malaysia deputy legal adviser Assoc Prof Dr Sonny Zulhuda urged caution, saying Malaysia should first consider whether establishing a separate cyber force was necessary or whether strengthening cyber capabilities within the existing military branches would be a more practical and effective solution.
“In my view, it is more appropriate to focus on ‘cyber capability’ rather than ‘cyber force’,” he explained. Sonny said the army, navy and air force should each enhance their cyber capabilities to support their respective operational requirements.
“Creating a cyber force in addition to but independent of the existing forces may not be necessary and could create substantial legal, administrative and operational challenges,” he added.
He said issues involving command authority, legal jurisdiction, operational responsibilities and inter-agency coordination would need to be comprehensively addressed before any new military cyber structure was established.
