Small and medium-sized enterprises (SMEs) that make up roughly 97% of all business establishments in Malaysia.
While critical infrastructure has tightened defenses under the Cyber Security Act 2024, SMEs remain the weakest link in this country.
SMEs hold valuable corporate data and connect directly to larger enterprise networks but rarely possess the budget or dedicated security personnel to defend against sophisticated, AI-driven phishing and automated exploits.
SMEs are frequently targeted and labeled as the weakest link in cyber defense because of limited IT budgets, a lack of specialized security staff, and heavy reliance on employees who face growing phishing and ransomware threats
Smaller firms struggle to afford enterprise-grade security software, automated patch management, or dedicated IT personnel.
According to data from Chubb, a global insurance and security leader operating across 54 countries, nearly half (48%) of cyber incidents stem from human and administrative errors, with many SME leaders citing a poor understanding of threats among staff.
In Malaysia, studies show that a large majority of SMEs have faced cyber incidents, and the country ranks high in Southeast Asia for web-based cyberattacks targeting smaller businesses. [1, 2]
Human error—such as falling for phishing emails or social engineering—contributes to the vast majority of cyber claims.
Employees are often untrained rather than careless.
Hackers frequently compromise smaller suppliers as an entry point to attack larger corporate or enterprise ecosystem partners. [1, 2]
Shockingly, 62% of corporate network intrusions now originate from third-party suppliers or the software supply chain, according to the Global Cybersecurity Insights Report (2025).
Financial constraints are the biggest hurdle for SME cybersecurity.
The governments can bridge this gap by offering subsidies that lower the barrier to entry eg the government covers up to 50% to 70% of a business's cybersecurity software or consulting fees for the first year to kick-start continuous adoption.
For SMEs that cannot afford a full-time Chief Information Security Officer, government agencies such as MDEC co-fund cybersecurity consultants to conduct basic "health checkups" and set up baseline cyber hygiene.
FLK (leekhean.foo@gmail.com) is a content creator under the Newswav Creator programme, where you get to express yourself, be a citizen journalist, and at the same time monetize your content & reach millions of users on Newswav. Log in to creator.newswav.com and become a Newswav Creator now!
The User Content (as defined on Newswav Terms of Use) above including the views expressed and media (pictures, videos, citations etc) were submitted & posted by the author. Newswav is solely an aggregation platform that hosts the User Content. If you have any questions about the content, copyright or other issues of the work, please contact creator@newswav.com.
