- 11 hours ago
Belanjawan 2027 aims to accelerate Malaysia's AI ecosystem, from workforce development to digital infrastructure. However, greater connectivity and automation bring new cybersecurity risks.
We speak to Snehal Antani, CEO & Co-Founder of Horizon3 on preparing for next-generation threats, and why organisations must move beyond traditional security approaches.
We speak to Snehal Antani, CEO & Co-Founder of Horizon3 on preparing for next-generation threats, and why organisations must move beyond traditional security approaches.
Category
🗞
NewsTranscript
00:01As Malaysia accelerates its digital transformation agenda, Blanjawan 2027 has reinforced the country's ambitions in artificial intelligence, digital innovation and
00:11cyber security.
00:12While new investments and initiatives create significant opportunities for businesses and the broad economy, they also introduce new risks and
00:19challenges that organizations must be prepared to manage.
00:22So today, we'll explore how businesses and institutions can strike the right balance between embracing emerging technologies and maintaining strong
00:30cyber resilience in an increasingly complex threat landscape.
00:33Joining us to share his insights on these developments and what they mean for organizations moving forward is Snehal Antani,
00:39CEO and co-founder of Horizon 3.
00:40Good morning, Snehal.
00:42Good morning.
00:44Thank you for joining me this morning on Niagawani.
00:46We see that the Budget 2027 allocates RM30 million to actually help 4,000 MSMEs adopt AI and train 5
00:53,000 AI professionals.
00:54So on your opinion, how can businesses embrace AI without increasing their cyber security risks?
00:59I think as organizations adopt AI agents to help their people do more work, AI agents are the best example
01:07of insider threat.
01:09And so if you're not good at securing against insider threat, you'll have a very hard time securing against AI
01:14agents.
01:15So you have to focus on the fundamentals of making sure agents don't have too many permissions, make sure you
01:21have the right observability and auditing to know every decision the agent is making,
01:26and to verify the right guardrails so that the agents are not able to take actions outside of what it's
01:33authorized to do.
01:35With Malaysia targeting 200,000 AI skilled workers and planning a sovereign AI cloud, how can the country ensure its
01:42growing AI capabilities and infrastructure are actually secure?
01:47The best way to make sure you're secure is to start from day one on looking at your organization through
01:54the eyes of the attacker.
01:56So you want to hack yourself every single day to understand, can the attacker steal your data, gain access to
02:03your servers, compromise your user IDs and passwords?
02:06The longer you wait, the more expensive it will be to find and fix those problems.
02:12So you want to shift left and find and fix and secure these new data centers, these new GPUs, these
02:19new model providers from the beginning so that you're cheaper, faster and more secure from the start.
02:24So as the country's digital ecosystem expands, attention must also turn to the threats on the horizon.
02:31So as Milici prepares for post-quantum threats, with NACSA and MCMC developing homegrown data protection technologies,
02:39what should organizations do now to prepare for the next generation of cyber attacks?
02:45I think first and foremost, to worry about the next generation of threats without first mastering the fundamentals of cybersecurity
02:52will give you a false sense of security and you just don't have enough resources to do both.
02:58So first, you have to master the fundamentals of cyber defense.
03:02Do you know how to prioritize vulnerabilities properly?
03:06Do you know how to verify that your security tools are actually working?
03:09Do you know how to build and exercise and practice the process of incident response?
03:16Step one is master the fundamentals.
03:18Then step two is to start thinking about the next ridgeline of threats from post-quantum and the way that
03:24your data can be stolen and decrypted later from new forms of very high-speed AI-based attacks and all
03:32of these other new emerging threats that are happening.
03:34But if you focus on the emerging threats without fixing the fundamentals first, you're going to have a very hard
03:40time.
03:40And so master the fundamentals and then start to prepare for the next ridgeline.
03:45So of course, being prepared is one thing and demonstrating that preparedness is another.
03:49So with stronger cybersecurity requirements for Malaysia's 11 critical infrastructure sectors,
03:55how can organizations prove their defenses can withstand real-world attacks beyond meeting compliance requirements?
04:04Yeah, the best way to think about it is, don't tell me we're secure, show me.
04:09And then show me again tomorrow and then show me again next week.
04:12Because the environment is always changing and the enemy or the adversary is always adapting.
04:18And so what you want to make sure you recognize is there's no magic AI button that's going to fix
04:24all of your cyber defenses.
04:26So first you master the fundamentals.
04:28Then you start to hack yourself every single day to verify that your security defenses are actually working.
04:36And then you want to understand your security posture over time.
04:40Because when you say that I am secure, you might be secure today, but you're not secure tomorrow.
04:46I am compliant.
04:47Well, I'm compliant today.
04:48I may not be compliant tomorrow.
04:50We have to start saying, I am resilient.
04:52I am defensible, which is understanding your security posture over time, especially for critical infrastructure segments.
05:02So as AI makes cyber attacks faster and more sophisticated, why is periodic penetration testing no longer enough?
05:08And how can autonomous security testing help organizations to identify vulnerabilities before attackers do?
05:16So AI in cyber warfare changes skill, it changes scale, and it changes speed.
05:23So we, our AI hacker, and at Horizon 3, we pioneered this whole concept of AI hackers, hacked a bank
05:31in 70, or hacked a defense tech company in 77 seconds.
05:34That is speed.
05:36Can your defenses detect, respond, and stop in 76 seconds?
05:41Yes or no?
05:41Because at 2nd 77, the AI hacker will have complete control over your network.
05:46For skill, we actually had a 9-year-old kid, the son of one of our employees, use our technology
05:52to hack a bank in 4 minutes and 12 seconds.
05:55That child didn't have expert hacking skills.
05:58It was point, click, and shoot.
06:00And then finally, for scale, we can create 100,000 AI hackers right now and target an entire healthcare sector,
06:09an entire manufacturing sector, an entire defense sector.
06:12We have infinite cyber bullets.
06:14We don't have to be selective of the target.
06:17And so the question in the world of AI and cyber warfare is, can you defend fast enough with an
06:23adversary that doesn't need as much skill, that has infinite cyber bullets that can target you directly, or target your
06:30critical suppliers to achieve their objective?
06:33And that's the way we need to be thinking about cyber strategy going forward.
06:37The adversary, the enemy, has unlimited cyber bullets.
06:41What will they do with them?
06:43Those are actually very scary examples given by you.
06:47So that raises an important question about how security is tested.
06:51So as organizations face increasingly sophisticated cyber threats, how can autonomous security testing help businesses continuously identify and also address
07:00exploitable weaknesses before attackers do?
07:03And looking ahead as well, what are the most important cybersecurity priorities organizations should focus on over the next three
07:10to five years, perhaps?
07:13So when the mythos model came out, the whole world became worried and scared about vulnerabilities.
07:20But the issue is that being vulnerable doesn't mean you're exploitable.
07:25You may have defensive controls in place that prevent that vulnerability from actually being usable by the attacker.
07:32So number one, is the issue actually exploitable in your network?
07:36Number two, are threat actors known to use that particular vulnerability?
07:42And then number three, what is the consequence or risk to the business if that vulnerability is exploited?
07:48Does it give access to a lab that has no business risk?
07:52Or does it give access to sensitive data that could be very damaging to the company if it is stolen?
07:58So if you can understand confirmed exploitable, known to be used by a threat actor and detailed and precise business
08:06consequence, you have enough information to make a risk-based decision on whether to accept the risk of this cyber
08:14of this vulnerability not being fixed,
08:16or to find money and find resources and find people to actually go off and fix it.
08:22Because the hardest part of the job, at least when I was a CIO, is deciding what not to fix.
08:27The second hardest part of the job was proving that we were actually secure and getting better over time.
08:34And continuous security testing is crucial in both of those problem sets.
08:39Snihal, if I may add, one about the concern about cyber security is about the talent, which always remains a
08:48challenge worldwide.
08:49So what more can businesses do and educational institutions and policymakers do to actually close the skills gap and build
08:56a stronger cyber workforce?
08:59Yeah, a cyber workforce, a really good cyber expert or a good cyber operator is an expert in IT administration.
09:07They're experts in network engineering.
09:10They're experts in understanding software lifecycle.
09:13So you can't just become a cyber expert with a single program or a single boot camp or a single
09:20degree.
09:20It takes years of building the expertise in network engineering, in IT administration, in software lifecycle.
09:28And so the first thing you've got to do is recognize you have to build your workforce and you have
09:34to build these fundamentals across the workforce first.
09:38Then you have to give them operational experience of securing, operating and defending your enterprise to make sure they understand
09:46how to very quickly detect threats, contain those threats and eradicate those threats.
09:51There is no shortcut. There is no magic AI button that's going to change the speed at which you can
09:58build cyber operators.
09:59It's like trees. The best time to plant a tree was 25 years ago.
10:03The next best time is today.
10:04The best time to build cyber operators was five years ago.
10:07The next best time is now.
10:09And we have to make sure we educate on the fundamentals first.
10:11Okay, as an industry expert, what could be some of the common mistakes organizations make when strengthening their cybersecurity posture
10:19and how can they avoid them?
10:21And finally, if you could leave business leaders with one key message on preparing for the future of cybersecurity, what
10:27would it be, Snehal?
10:30So the first part is the common mistakes and probably the biggest mistake that I see is organizations don't train
10:37like they fight, meaning they learn how to deal with an incident.
10:41In the middle of the incident, they don't practice what to do if an attacker gains access to their network.
10:48And not just practicing at Tuesday at 3 p.m. when everyone's in the office, but at 3 a.m.
10:54in the middle of a holiday, or if you have a European subsidiary in the middle of August when everyone's
10:58on vacation.
10:59You want to stress and build the muscle memory for how to deal with an incident before the incident happens
11:06so that you know what to do when things go wrong.
11:09That's kind of the first biggest common mistake.
11:12The second area, as I mentioned before, is deciding what not to fix and being able to prove the investment
11:20in cyber is actually reducing your risk and attack surface.
11:24And that's all about how many problems do you have?
11:27How quickly are you fixing them?
11:29How effective are you at detection and response?
11:31And how are you improving over time across each of those metrics?
11:37And then finally, for the future of cybersecurity, if I can hack you in 77 seconds, can you stop me
11:44in 76 seconds?
11:45And the answer is probably not.
11:47The future of cyber warfare is AI versus AI with humans by exception.
11:54And you have to start thinking through how do you automate as much as you can in your security operations
12:01center so that if a human is required, it's for very specific, very high-end complicated scenarios, and that you
12:08have built almost like the human body's reflex system into your network defense.
12:13So it sees an attacker has gained access, and you know how to immediately shut down that segment of the
12:19network to minimize the damage the attacker can go off and do.
12:23All right, interesting perspective and also advices.
12:26We've covered a lot from ground today, from security, AI adoption, and protecting critical infrastructure to preparing for post-quantum
12:33threats and embracing continuous security validation.
12:36So clearly, as Malaysia advances its AI ambitions and digital economy agenda, cybersecurity can no longer be viewed as a
12:42standalone IT function.
12:44It must be embedded into every stage of technology adoption, from infrastructure and workforce development to governance, risk management, and
12:51continuous security validation.
12:52So that was Nihal Antani, the CEO and co-founder of Horizon 3.
12:55Thank you for sharing your insight on how organizations can strengthen their cyber resilience, prepare for evolving threats, and build
13:01greater confidence.
13:02Thank you so much.