SOVEREIGNTY in cybersecurity demands a redefinition.
Previously, our focus was on building capacity — developing Malaysian talent with technical expertise in areas such as incident response, threat intelligence and digital forensics.
The Malaysia Cyber Security Strategy 2020-2024, particularly its third pillar, laid the groundwork by promoting research and development (R&D) and innovation. The first national strategy focused on establishing an ecosystem to nurture cybersecurity capabilities.
Now, with the 2025-2030 strategy, R&D and innovation are central to our national ambition. This strategy is driven by a whole-of-society model that calls for synergy between government, industry and the community.
This raises a critical question: Can Malaysia achieve true cybersecurity sovereignty?
We found our answer in an unlikely place: post-quantum cryptography (PQC). When we first explored cryptology with Universiti Putra Malaysia (UPM), we discovered that Malaysian researchers were already making waves.
Based on a study conducted in December 2024 — an analysis of 400 publications between 1996 and 2023 — UPM ranked third globally. Overall, Malaysia ranked seventh globally, alongside nations such as China, France, Japan, the United States, India, Germany, Australia, Taiwan and Canada.
A notable finding was that the research group at UPM led by Professor Dr Muhammad Rezal Kamel Ariffin ranked sixth globally. UPM has been engaged in PQC research since 2015. We soon realised that this expertise extended beyond UPM.
Universiti Teknologi Mara, Universiti Teknikal Malaysia Melaka, Universiti Sains Malaysia, Universiti Malaysia Sabah and CyberSecurity Malaysia are home to brilliant minds in cryptology.
This led to the establishment of Pusat Teknologi dan Pengurusan Kriptologi Malaysia (PTPKM) at the end of 2024, announced by the prime minister in his 2025 Budget speech. PTPKM is an initiative to consolidate and empower local experts in preparation for the quantum computing era.
What began as a national effort quickly evolved. As we engaged with global forums, we found ourselves not just learning, but being listened to. Malaysia’s aspirations in PQC were gaining attention.
In my keynote address at GISEC Dubai in early 2025, I shared for the first time my belief that Malaysian cryptology talent could spark a new phenomenon in the global PQC landscape.
The algorithm developed by our experts has the potential to use shorter parameters — potentially enabling more efficient and less resource-intensive PQC deployment. I told the audience: Malaysia may offer the world an alternative. The response was overwhelmingly positive.
After the event, I told my team: This is no longer just a national initiative — it is a global one. Though I wondered if I was being overly ambitious, the momentum proved otherwise.
We launched the Proof-of-Concept (POC) PQC Programme Sandbox Initiative under the National PQC Migration Plan (2025–2030) to test our algorithm in real-world scenarios. Initially, we targeted 11 technologies across the 11 National Critical Information Infrastructure sectors.
But the response exceeded expectations: more than 40 technologies from 30 local and international providers joined the sandbox.
Malaysia has the talent and expertise. Achieving sovereignty in cybersecurity, especially in PQC migration, is within reach. What we need now is a collective push: a challenge, a shared purpose and the right support.
One year after the announcement of PTPKM, on the same platform, the prime minister introduced a new entity: the Cyber Security and Cryptology Development Centre (CSCDC).
This centre will consolidate the functions of R&D, innovation and capacity building — not just in cryptology — bringing together the role of PTPKM and broader cybersecurity development under one roof.
CSCDC will be led by the National Cyber Security Agency as a national entity to drive Malaysia’s cybersecurity future.
From Oct 28 to 30, Malaysia will host the world’s largest PQC Conference, with more than 2,000 international experts attending both in person and online. I will share Malaysia’s aspirations and extend an open invitation to global partners to join Malaysia and Asean in building a resilient, sovereign and collaborative cybersecurity future.
On Nov 12, another landmark event will take place: a conference and exhibition showcasing Malaysian quantum-safe technologies.
This is a declaration that Malaysia is ready to lead, collaborate and innovate. We are no longer technology users. We are becoming technology developers.
The writer is chief executive of the National Cyber Security Agency
© New Straits Times Press (M) Bhd
