We do security with your budget.

Modern phishing kits clone Malaysian bank and courier portals convincingly, and AI-generated copy has removed the old "look for bad grammar" advice. Effective controls: email filtering, multi-factor authentication so a stolen password alone is not enough, and staff trained against real local examples.

Common entry points: phishing email, remote desktop (RDP) exposed to the internet, unpatched VPN appliances, and stolen credentials. Many groups now exfiltrate a copy of the data before encrypting it — double extortion — so they can threaten disclosure. The two controls that matter: endpoint detection that catches the behaviour early, and a tested offline backup the attacker cannot reach.

Known as credential stuffing, and fully automated. Effective controls are unglamorous and cheap: multi-factor authentication on email and finance systems, a password manager to end reuse, and disabling accounts belonging to staff who have left. Most of the cost here is configuration time, not licensing.

BEC produces some of the largest single losses for Malaysian businesses because the fraudulent instruction arrives inside a genuine conversation, often from a mailbox the attacker actually controls. Controls: multi-factor authentication on mail, alerting on inbox forwarding rules, and a written policy that any change of bank details is verified by phone to a previously known number.

Modern trojans establish remote access, harvest stored browser passwords, log keystrokes and load further payloads, frequently as the first stage of a ransomware deployment. Because many operate in memory using legitimate system tools, signature-based antivirus alone is unreliable — behavioural detection through EDR is what identifies them. Application control and removing local administrator rights close most of the entry routes.

SQL injection abuses input fields that pass user text straight into a database query, allowing an attacker to read or alter records — still one of the most common causes of customer data exposure. Related web attacks include cross-site scripting and file upload abuse. Controls: parameterised queries, keeping the CMS and its plugins patched, removing unused plugins, and a web application firewall in front of the site.

The controls are procedural as much as technical: least-privilege access so staff can only reach what their role requires, prompt account revocation on departure, restrictions on removable media, and logging of bulk downloads from shared drives. Under the PDPA, an accidental disclosure of personal data carries the same obligations as a deliberate breach.

This includes compromised software updates, breached managed service providers with remote access into client networks, and third-party plugins on company websites. Practical controls: limiting and reviewing vendor remote access, network segmentation so one supplier connection cannot reach everything, and requiring security assurances from vendors handling company data.

Volumetric attacks are absorbed upstream rather than at the office connection, so mitigation belongs at the CDN or hosting layer — services such as Cloudflare handle this well and are inexpensive at small-business scale. Application-layer floods aimed at login or search pages need rate limiting instead. The exposure is revenue and reputation rather than data loss.