Compliance

Malaysia's cyber threat level is now Medium: what to do

nPro Team · 11 November 2026 · 3 min read

Nacsa has raised Malaysia's national cyber threat level from Low to Medium. Here is what the nine preparedness measures mean for NCII entities and their suppliers, and five steps CIOs and DPOs can take this week.

On 4 November 2026, Malaysia's National Security Council announced that the National Cyber Security Agency (Nacsa) had raised the National Cyber Security Threat Level from Low to Medium. Nacsa has stressed that this is a precautionary step, not a sign of a crisis. For CIOs and DPOs, it is still a clear prompt to check whether monitoring, patching and response plans would hold up under pressure.

What happened

The change followed remarks by Prime Minister Anwar Ibrahim in the Dewan Rakyat on 3 November. He said Malaysia could be among the countries targeted for cyberattacks, citing its growing digital infrastructure and data centre industry and its stance on international issues, and said the assessment was based on government intelligence.

Entities in the National Critical Information Infrastructure (NCII) must now implement nine cybersecurity preparedness measures. Published reports name four of them: 24-hour monitoring, system patching, multi-factor authentication and updated service continuity plans. NCII sector heads must also submit weekly threat status reports to Nacsa, even when there are no incidents.

In the days that followed, Nacsa said it had recorded 5,110 cybersecurity incidents from January to September 2026, compared with 5,837 in the same period last year. Its chief executive, Dr Megat Zuhairy Megat Tajuddin, also warned that attackers are moving beyond data theft towards disrupting daily operations, including operational technology in healthcare, energy, water supply and supply chains.

Why it matters

NCII entities already carry obligations under the Cyber Security Act 2024 (Act 854). The new measures add a practical test: can you show round-the-clock monitoring, and can you produce a weekly status report from real data rather than estimates?

Organisations outside the NCII should not assume this is someone else's problem. Many supply services to NCII operators, and Nacsa has issued Cyber Security Threat Preparedness and Handling Guidelines for non-NCII organisations. Data theft also remains a risk alongside disruption, and under Malaysia's amended Personal Data Protection Act a personal data breach brings its own notification duties. Knowing what data left, and when, matters as much as stopping the intrusion.

Five practical steps to take now

  1. Test your 24-hour monitoring. Check who watches alerts outside office hours, and confirm that an overnight alert reaches someone who can act on it.
  2. Close the patching gap. Nacsa's NC4 issued eight alerts and advisories in October alone on vulnerabilities affecting NCII entities and government agencies. Match each advisory against your asset inventory and record what was patched.
  3. Extend multi-factor authentication. Cover every remote, privileged and third-party account, including service providers with administrative access.
  4. Rehearse your continuity plan. Run a short tabletop exercise on two scenarios, the outage of a core system and a leak of sensitive data, and update the plan with what you learn.
  5. Make reporting repeatable. Build your weekly threat summary from logs, alerts and data movement records, so it takes minutes to produce and stands up to scrutiny.

How a self-hosted platform helps

nPro brings SIEM, XDR, EMS network monitoring and DLP into one platform that runs on your own infrastructure, on-premises or in a private or public cloud. Logs, endpoint detections, network events and data loss events land in the same database and dashboard, which supports continuous monitoring and makes a weekly status report easier to assemble from evidence.

nPro DLP adds the data side of the picture. It blocks unauthorised USB and device use, uploads to cloud services through a browser extension, clipboard copying and screen capture, and monitors sensitive data discovery and printing. Because the platform is self-hosted, your security telemetry stays on infrastructure you control, in the location you choose.

If you want to see what sensitive data is moving across your endpoints before the next advisory lands, start with the free 30-day Data Exposure Audit.

Frequently asked questions

What is Malaysia's current national cyber threat level?

Since 4 November 2026, Malaysia's National Cyber Security Threat Level has been Medium, raised from Low. The National Security Council announced the change and described it as a precautionary measure.

Who must follow Nacsa's nine preparedness measures?

Entities in Malaysia's National Critical Information Infrastructure (NCII) must implement them. Published measures include 24-hour monitoring, system patching, multi-factor authentication and updated service continuity plans, and NCII sector heads must send Nacsa weekly threat status reports. Nacsa has issued separate guidelines for non-NCII organisations.

Does a Medium threat level mean Malaysia is under attack?

No. Nacsa's chief executive said the change is not an indication that the country is facing a cyber security crisis. It is a precaution that asks critical sectors to strengthen monitoring and readiness.

Sources

Related reading

See how nPro implements this

The documentation covers configuration, agent deployment and the current status of each capability.

View documentation More articles