Malaysia Is Building Data Centres at Record Speed. Is Cybersecurity Keeping Up?

Malaysia is rapidly becoming Southeast Asia’s next digital infrastructure powerhouse. Billions of Ringgit are flowing into new hyperscale data centres, cloud regions, AI infrastructure, and digital services. Global technology companies including Microsoft, Google, Amazon Web Services (AWS), Oracle, and ByteDance have announced significant investments, particularly in Johor and the Greater Kuala Lumpur region.

While these investments strengthen Malaysia's position as a regional digital hub, they also introduce a new challenge that receives far less attention than power, cooling, or cybersecurity.

A modern data centre is no longer just a building filled with servers. It is the foundation of cloud computing, AI workloads, financial services, healthcare systems, government platforms, and thousands of businesses that depend on continuous availability. Every new facility built increases Malaysia's digital capability but also expands its cyber attack surface.

Key Highlights (TL;DR)

• Malaysia has emerged as one of Southeast Asia's fastest-growing data centre markets.
• More than RM140 billion worth of data centre investments have been announced in recent years.
• Johor is expected to become one of the region's largest data centre hubs due to land availability, connectivity, and proximity to Singapore.
• Cybersecurity should be integrated from the planning phase, not added before go-live.
• Identity security, network segmentation, vulnerability management, monitoring, and incident response are critical components of every modern data centre.
• Continuous monitoring through MDR and SOC services is becoming essential as attacks grow more sophisticated.

Malaysia's Data Centre Boom

Malaysia has experienced unprecedented growth in data centre development over the past few years. Rising cloud adoption, artificial intelligence, digital transformation initiatives, and regional demand have positioned Malaysia as a preferred destination for hyperscale infrastructure.

Several factors contribute to this rapid growth:

• Competitive operating costs compared to neighbouring countries.
• Strong international connectivity.
• Government support for digital investments.
• Availability of land for hyperscale developments.
• Increasing demand for AI and cloud computing.

Johor has become particularly attractive because of its proximity to Singapore, where land and power constraints have limited new data centre developments.

Trend	Impact
Hyperscale investments	Growing demand for secure cloud infrastructure
AI workloads	Higher-value computing assets requiring stronger protection
Enterprise migration	More business-critical systems moving into data centres
Regional cloud expansion	Larger attack surface for cybercriminals

The Cybersecurity Conversation Is Often Missing

When organisations discuss building a new data centre, conversations usually revolve around power capacity, cooling systems, rack density, fibre connectivity, physical security, and construction timelines.

Cybersecurity is frequently treated as a deployment activity near the end of the project instead of a design requirement from the beginning.

This approach creates unnecessary risks because many security weaknesses become significantly more expensive to fix after infrastructure has already been deployed.

Cybersecurity Should Begin Before The First Server Arrives

Security should be embedded throughout the entire project lifecycle.

Project Phase	Cybersecurity Activities
Planning	Risk assessment, compliance requirements, security objectives
Design	Network segmentation, Zero Trust architecture, identity design
Procurement	Vendor security reviews and product evaluation
Provisioning	Server hardening, firewall configuration, MFA, EDR deployment
Testing	Vulnerability assessment and penetration testing
Operations	Continuous monitoring, patch management, incident response

Five Critical Areas Every Data Centre Must Secure

1. Identity and Access Management

Modern attackers increasingly target identities instead of infrastructure. Administrative accounts, privileged credentials, and remote access systems must be protected using multi-factor authentication, least privilege, privileged access management, and regular access reviews.

2. Network Segmentation

Flat networks allow attackers to move laterally after compromising a single device. Separating production, management, backup, and user networks significantly limits the impact of a successful breach.

3. Infrastructure Hardening

Servers, hypervisors, storage platforms, and management interfaces should follow recognised security baselines such as the CIS Benchmarks. Default configurations should never be used in production environments.

4. Continuous Monitoring

Building a secure environment is only the beginning. Organisations need continuous visibility into security events through SIEM platforms, endpoint detection and response (EDR), managed detection and response (MDR), and 24×7 security operations.

5. Incident Response Readiness

Every organisation should assume that security incidents will eventually occur. Having documented response procedures, tested backups, forensic capabilities, and clearly defined responsibilities enables faster recovery and minimises operational disruption.

AI Infrastructure Raises The Stakes

The rapid growth of artificial intelligence is driving demand for larger and more powerful data centres. These environments host valuable AI models, sensitive datasets, and high-performance GPU clusters that have become attractive targets for cybercriminals.

Protecting AI infrastructure requires organisations to secure APIs, administrative access, software supply chains, container platforms, orchestration systems, and the underlying cloud infrastructure.

Security Is A Business Requirement, Not An IT Feature

Cybersecurity should not be viewed as an obstacle to digital transformation. Instead, it enables organisations to operate confidently, meet regulatory obligations, maintain customer trust, and reduce the likelihood of costly cyber incidents.

As Malaysia continues attracting global technology investments, organisations that prioritise cybersecurity from the earliest planning stages will be better positioned to support long-term growth while protecting their most valuable digital assets.

Final Thoughts

Malaysia's data centre industry is entering an exciting period of growth. New facilities will power cloud computing, artificial intelligence, financial services, manufacturing, healthcare, and countless digital services that businesses rely on every day.

However, every new server deployed, every network connected, and every workload migrated also creates new opportunities for cyber attackers.

The question is no longer whether cybersecurity should be part of a data centre project. The real question is whether organisations are involving cybersecurity early enough.

In the race to build the digital infrastructure of tomorrow, security must be designed in from day one, not bolted on after deployment.