KUALA LUMPUR — Malaysian compliance officers have spent much of 2026 bracing for tighter enforcement under the Cybersecurity Act 2024 and closer scrutiny from Bank Negara Malaysia.

A new global study from Ensign InfoSecurity (“Ensign”), Asia Pacific’s largest pure-play cybersecurity services provider, gives them something concrete to work with: evidence that AI models can now consistently gain initial access to a defended network, but evading detection remains far less reliable.

The finding comes from Ensign’s AI Cyber Range Assessment, part of its 2026 Cyber Threat Landscape Report. Ensign put ten frontier AI models, five built in the West and five in the East, through a controlled cyber range simulating a university network, then set each of them against the same eight-stage attack, from breaking into a learning portal to disappearing without a trace once inside. Every model ran the gauntlet sixteen times, for 160 attempts in total.

Getting in was nobody’s problem. Staying hidden was another matter

Initial access was guaranteed across all ten models. The three strongest performers, OpenAI’s GPT-5.6 Sol, Anthropic’s Claude Opus 4.8 and Z.AI’s GLM-5.2, each cleared seven of the eight stages of the Ensign AI Cyber Range Assessment. Staying hidden proved far harder: not one model could reliably slip past the detection tools already sitting on the network, and even the best performers managed only partial success.

For compliance teams, that gap matters more than the headline finding. The Cybersecurity Act 2024 has put Critical Information Infrastructure operators on notice, and Malaysia’s National Cyber Security Agency (NACSA) is pushing sectors under its watch to shore up back-end security, while Bank Negara tightens the rules financial institutions must follow as AI-enabled scams multiply. Ensign’s results point to where organisations should direct additional investment. Perimeter defences still matter and should not be scaled back, but with initial access now close to guaranteed for a capable model, they can no longer be the only line of defence. Strengthening detection and response, so organisations can catch and contain an attacker already inside, is where the effort now needs to go.

Cost is fast losing its role as a natural defence too. Z.AI’s GLM-5.2 matched GPT-5.6 Sol’s offensive performance at roughly one-fifth of the price and open-source Eastern models generally delivered far more capability per dollar than their Western counterparts. Malaysian organisations weighing their security budgets should assume that gap will keep closing.

“No single control can stop every attack, and Ensign’s AI Cyber Range Assessment shows why detection and response matter. With the Cybersecurity Act 2024 raising the bar and Bank Negara placing greater emphasis on cyber resilience, the findings from the assessment gives local compliance and security teams an evidence-based case to budget more resources for stronger internal defences and detection response tools, beyond prevention,” said Jeremy Moke, EnSOC Director, Ensign InfoSecurity Malaysia.

“The capability gap between AI models is narrowing fast, and cost is unlikely to remain a barrier for threat actors much longer. That changes how quickly organisations need to move. Security controls cannot remain static; what separates a good cyber defender now is how fast they adapt.”

The full 2026 Cyber Threat Landscape Report, including the complete AI Cyber Range Assessment scorecard and cost comparisons, is available for download at https://www.ensigninfosecurity.com/resources/threat-insights/cyber-threat-landscape-report-2026. For more information about Ensign InfoSecurity and its cybersecurity solutions, visit www.ensigninfosecurity.com.

Ensign’s AI Cyber Range Assessment tested more than 150 AI models before narrowing the field to the ten strongest performers. Each was placed inside a simulated university network built with the security controls most organisations already run, then walked through eight stages of a typical attack: first breaking in, then working through the network, and finally trying to stay there undetected. Every model faced the same sixteen runs, 160 attempts in total. Data is current as of 13 August 2026. The full scorecard, methodology and cost breakdown sit in Ensign’s 2026 Cyber Threat Landscape Report, available on request.

About the report

The Ensign InfoSecurity Cyber Threat Landscape Report is an annual publication capturing Ensign’s APAC observations on threat actors, attack trends and emerging risks shaping the region. It draws from Ensign’s regional cybersecurity operations, threat intelligence, incident response work and international collaborations, with the aim to sharpen awareness and support cyber defenders and leaders across the region.

About Ensign InfoSecurity

Ensign InfoSecurity is Asia Pacific’s largest pure-play cybersecurity services provider and a trusted global partner, delivering end-to-end security solutions across the cyber lifecycle. Headquartered in Singapore, Ensign is recognised for its deep capabilities spanning advisory and assurance, secure architecture and systems integration, threat intelligence, managed security operations, and incident response. Ensign also drives innovation through Ensign Labs, developing advanced proprietary solutions to address complex customer challenges. With over two decades of experience, Ensign provides resilient, intelligence-led security tailored to real business risks. For more information, please visit http://www.ensigninfosecurity.com

For media queries, please contact: media@ensigninfosecurity.com