Modern national defence extends beyond physical borders and conventional military strength to encompass digital networks, electronic warfare (EW) and cybersecurity.
While network-centric warfare has streamlined military operations through rapid data sharing, hyperconnectivity has also created critical vulnerabilities. Adversaries can now achieve strategic advantages by disrupting or manipulating digital information.
Today, conflicts span the physical domain, cyberspace and the electromagnetic spectrum simultaneously. EW tactics such as jamming and spoofing can disrupt communications, radar and satellite navigation. However, effective EW capabilities must be supported by robust cybersecurity to protect the underlying software, data pipelines and internal networks from state-sponsored malware.
Recent conflicts illustrate this interdependence. During Russia’s 2022 invasion of Ukraine, a cyberattack against the Viasat satellite network disrupted communications alongside military operations, including efforts to interfere with battlefield communications. Ukraine responded by expanding its use of decentralised internet infrastructure and alternative navigation technologies, including vision-based drone navigation. These developments demonstrate how digital resilience can support operations under attack.
Iranian-linked activities have also highlighted the strategic implications of digital interference. GPS spoofing in the Strait of Hormuz has affected maritime navigation, while cyber operations attributed to groups such as OilRig demonstrate how digital capabilities can be used to pursue strategic objectives beyond conventional battlefields.
For middle powers such as Malaysia, a central challenge is reliance on foreign-owned digital defence and artificial intelligence technologies. Building strategic networks on foreign software and hardware can expose countries to security risks, including unauthorised data access and potential service disruption during crises. Physical borders alone can no longer guarantee national security, making technological sovereignty an increasingly important national priority.
A comprehensive approach to digital national defence must address technology, governance, legislation, financing, capability development and institutional culture.
Technical and governance dimensions
Traditional security software that relies exclusively on signature-based detection is inadequate against many modern forms of malware. Malaysia should strengthen its ability to use AI-assisted threat detection to identify anomalies and support timely responses. However, pursuing complete technological isolation would be economically inefficient for a middle power. Resilience instead requires a balance between domestic technological capabilities and strategic international cooperation to diversify supply chains.
From a governance perspective, effective national coordination is essential to bridge the gap between public administration, the military and private operators responsible for critical infrastructure, including power grids and telecommunications. Existing cybersecurity institutions should work closely with defence agencies to establish clear responsibilities, share threat intelligence and coordinate responses.
Regulatory and financial realities
Legislation should require operators of critical infrastructure to report significant cybersecurity incidents within clearly defined timeframes, supported by proportionate penalties for non-compliance. As cyber threats cross national borders, Malaysia should strengthen alignment with relevant international standards and cooperation mechanisms, including the Budapest Convention on Cybercrime and the United Nations’ Open-ended Working Group on security of and in the use of information and communications technologies.
Developing sovereign technologies also requires sustained public investment and research and development (R&D) incentives. Government support should help small and medium enterprises (SMEs) strengthen their cybersecurity, as weaknesses in smaller suppliers can create entry points into larger networks.
The global shortage of cybersecurity professionals further underlines the need for dedicated university programmes, industry partnerships and simulated cyber ranges for practical training.
Global and regional strategies
International and regional approaches offer useful lessons for Malaysia, although their institutional arrangements and legal frameworks differ.
Infrastructure and networks
The Five Eyes intelligence partnership facilitates intelligence sharing and cooperation among its members. Malaysia can draw lessons from coordinated cybersecurity practices while developing its own arrangements for protecting critical infrastructure and managing cross-border threats.
Within Asean, cooperation on cybersecurity, secure data management and information exchange could strengthen regional resilience. Data localisation and confidential computing may also contribute to data protection where appropriate, subject to technical requirements and applicable laws.
Artificial intelligence
AI governance should establish clear accountability, risk controls and meaningful human oversight, particularly when systems support national defence decisions. Malaysia and Asean can also invest in AI models adapted to regional languages, operating environments and security requirements.
Supply chains and operations
Intelligence-led supplier assessments and Software Bills of Materials (SBOMs) can help organisations identify software components and assess supply-chain risks. Asean could further strengthen regional incident-response cooperation through existing cybersecurity networks and national computer emergency response teams (CERTs).
Recommendations: The Malaysian context
Malaysia has made progress in cybersecurity policy and institutional development, including its performance in the International Telecommunication Union’s Global Cybersecurity Index. Key initiatives include the Cyber Security Act 2024, the Malaysia Cyber Security Strategy 2025-2030 and the Defence Industry Policy. The establishment of the Cyber Force Nucleus Team also reflects efforts to develop dedicated military cyber capabilities.
Despite these initiatives, gaps remain between policy and implementation. Domestic R&D in advanced predictive security software is still developing, shortages of specialised engineering talent persist, and funding must be sustained to support long-term technological self-reliance.
To address these gaps, this article proposes the Digital Ecosystem for National Defence (Digital END). The framework applies a Whole-of-Government and Whole-of-Society (WOGOS) approach, broadening national defence beyond a predominantly military responsibility into a coordinated national effort.
The Digital END framework is structured around four interconnected pillars: government, industry, universities and the armed forces.
1. Government – policy and enforcement
Central agencies should establish clear requirements for integrating appropriate domestic technologies into defence procurement. Where commercially and operationally viable, procurement contracts should include technology-transfer arrangements, skills development and long-term funding to support local alternatives. Such arrangements should protect national security while maintaining clear intellectual property, performance and accountability requirements.
2. Industry – critical infrastructure and systems
Domestic companies should translate research into deployable products and scalable systems. Industry participants should also develop the expertise to maintain and upgrade these technologies over their operational lifecycles, reducing excessive dependence on foreign suppliers and strengthening domestic control over critical systems.
3. Universities – research and talent
Academic institutions should advance fundamental research in AI and cybersecurity while developing specialised engineering talent. They should also work with industry and defence agencies to test and validate locally developed software before deployment, incorporating secure-by-design principles from the outset.
4. Armed forces – tactical edge
The armed forces should define operational requirements arising from modern battlefield conditions and test prototypes in realistic environments. Their feedback should inform further development by universities and industry, ensuring that technologies meet operational needs and can function under demanding conditions.
Through continuous coordination, integration and knowledge sharing, the Digital END ecosystem could help embed domestic technological capabilities, responsible AI governance and adaptive cybersecurity practices across civilian and military networks.
The global security landscape has changed significantly. As digital networks, electronic warfare and AI become increasingly important in strategic competition, physical borders alone are insufficient to guarantee national security. Excessive reliance on foreign technology suppliers can expose critical infrastructure to disruption, unauthorised access and data exploitation. For Malaysia, developing domestic technological capabilities is therefore an important component of long-term national resilience.
Achieving technological sovereignty does not require complete isolation from global markets. It means developing the domestic capacity to control, secure and sustain critical national security networks while cooperating with trusted international partners.
The proposed Digital END framework offers a potential model for reducing institutional silos and bringing government, industry, academia and the armed forces into a coordinated defensive ecosystem. Sustained investment in domestic R&D, proportionate data protection measures and the development of local engineering talent could strengthen Malaysia’s ability to protect its digital infrastructure and maintain strategic autonomy in an increasingly unpredictable security environment.
Colonel Ungku Suzaini Ungku Ahmad RMAF is with the Royal Malaysian Air Force and is currently attending the National Resilience College at the National Centre for Defence Studies (PUSPAHANAS) in Putrajaya.
The views expressed here are the personal opinion of the writer and do not represent those of Twentytwo13.
