AS Malaysia advances its digital economy priorities set out in Budget 2027, national sovereignty is no longer defined solely by geographical boundaries. In today’s increasingly interconnected global economy, a new aspect must be considered: digital resilience, particularly the country’s ability to secure systems, safeguard citizen data and maintain operational continuity.
Malaysia’s digital economy is expanding rapidly, with a national push to increase its contribution to the gross domestic product to 30 per cent by 2030. With investments in regional data centres, cloud infrastructure and a planned sovereign AI cloud, the physical security perimeter is no longer central to defence.
In its place, digital identity has become the primary control plane for access control and system defence.
Non-human identities and the expanding attack surface
Digital acceleration across Malaysia is reflected in rapid cloud adoption, expanding digital services, and the integration of AI-led automation. However, this expansion has created an identity attack surface that is larger and more fluid than many organisations can track.
The human identity footprint is growing significantly, supported by national initiatives like MyDigital ID, which has over 14 million registered users across 203 public and private services. Yet beneath the surface of enterprise IT systems lies a parallel proliferation of non-human identities.
Every cloud application, application programming interface (API) integration, automated service account and AI software agent introduces a new machine identity. In many environments, these non-human identities outnumber human users and operate with elevated privileges, yet they are governed with far less rigour. Service accounts often remain active long after their initial purpose has ended and API keys remain embedded in legacy applications without clear ownership.
Because attackers increasingly rely on valid credentials, misconfigurations, and excessive access rights rather than traditional malware, detecting an intrusion becomes significantly harder when the access appears legitimate.
Rising governance and regulatory requirements
Regulatory expectations across Southeast Asia are raising the stakes for identity governance. Domestic legislation, such as the Cyber Security Act 2024, underscores the legal and operational accountability of national critical information infrastructure entities to enforce strict access controls. Across the broader region, regulatory mandates are similarly tightening. Vietnam’s Personal Data Protection Law emphasises operational accountability for data access, Singapore’s Personal Data Protection Act enforces strict accountability obligations alongside mandatory breach notifications, and Thailand’s Personal Data Protection Act mandates robust security measures to prevent unauthorised access. Particularly for Malaysian enterprises expanding across Asean, controlling access is no longer sufficient; organisations must continuously demonstrate control with clarity, context, and complete visibility across their identity landscape.
Beyond static reviews: Identity posture management
Organised crime groups in Southeast Asia are rapidly leveraging AI and automation to scale cybercrime operations. A United Nations Office on Drugs and Crime policy brief highlighted the region as an emerging testing ground for AI-driven crimes, where automated tools, synthetic identities, and deepfakes execute large-scale fraud. Locally, the Malaysian Communications and Multimedia Commission (MCMC) has blocked over 5.7 billion scam calls and messages. Unfortunately, defensive readiness often lags behind the sophistication of these evolving threats.
Misconfigurations remain one of the primary drivers of identity exposure. Weak authentication mechanisms, unmonitored machine accounts, and accounts with too many permissions create vulnerabilities that remain hidden until they are exploited.
To address this gap, identity security posture management (ISPM) is emerging as a critical defensive layer. An ISPM solution continuously evaluates how identities are configured and checks whether access rights align with policies. By identifying excessive permissions and automating access reviews, ISPM solutions enable organisations to transition from periodic manual audits to continuous assurance. This reduces the window of exposure created by rapid digital scaling.
Detecting behavioural anomalies at speed
As ecosystems grow more dynamic, security models that focus exclusively on external threats lose effectiveness when an adversary holds valid credentials. Identity threat detection and response solutions can shift the defensive focus from simple authentication to continuous behaviour analysis. They monitor how identities act in real time, identifying anomalies such as unusual login locations, unexpected privilege escalations, or abnormal lateral movement across network segments.
When integrated with automated response controls, modern identity solutions can dynamically restrict permissions, require additional multi-factor authentication methods, or terminate suspicious sessions instantly. This contains identity-based threats before an attacker can move laterally across enterprise systems.
A proactive strategy for regional leadership
Fragmented security architectures (where access management, privileged access management, identity governance and threat detection exist in isolated silos) leave critical visibility gaps. Unifying identity data thus enables organisations to adopt a proactive approach to security. By embedding predictive analytics, continuous exposure management and automated mitigation into their security architecture, enterprises can prevent identity risks before they escalate into operational disruptions. Southeast Asia’s digital economy has the potential to reach USD 2 trillion by 2030. As Malaysian organisations position themselves at the heart of this regional growth, identity management can no longer be viewed as a back-office IT team task. Establishing risk-aware, continuous identity governance will provide the security, trust and resilience needed for Malaysia to solidify its position as a trusted digital economy leader.
Arun Kumar is the Asia-Pacific Regional Vice President at ManageEngine. The views expressed in this article are the author's own and do not necessarily reflect those of Sinar Daily.