Budget 2026, tabled on 10 October 2025, links cybersecurity skills to Malaysia’s wider workforce development agenda.

Under Budget 2026, the Ministry of Digital announced an additional 50% tax deduction for micro, small and medium enterprises (MSMEs) undertaking recognised AI and cybersecurity training. Employers should confirm the eligibility of a specific course before relying on the incentive.

Cybersecurity is also receiving investment beyond workforce development. Budget 2026 includes RM30 million to strengthen national cybersecurity, including cybersecurity programmes and the development of advanced cryptographic security services. The Government’s Budget 2026 touchpoints also identify areas such as cryptography, post-quantum technologies and cybersecurity training for National Critical Information Infrastructure (NCII) entities.

The message extends beyond a single tax measure. As Malaysia becomes more digitally connected, developing the people who understand, manage and secure digital environments is becoming part of the national digital agenda.

For Malaysian employers, this raises a more practical question:

What cybersecurity capabilities should businesses be developing?

Budget 2026 Brings Cybersecurity Training into the Business Conversation

Cybersecurity training is often approached reactively.

01

A new threat emerges.

02

An organisation experiences an incident.

03

A compliance requirement changes.

04

A business adopts a new cloud platform or digital service.

Training then follows in response to that immediate requirement.

Budget 2026 creates an opportunity for employers to look at cybersecurity capability more systematically.

The Government’s additional tax deduction proposal places cybersecurity training alongside AI capability as an area where Malaysian MSMEs are being encouraged to strengthen workforce readiness.

However, businesses should be careful not to interpret the announcement as an automatic additional tax deduction for any cybersecurity course.

In its Q&A for the National Tax Seminar on Budget 2026, held on 14 October 2025 and updated on 28 January 2026, Lembaga Hasil Dalam Negeri Malaysia (HASiL) stated that the incentive’s detailed conditions would be specified through subsidiary legislation.

That distinction matters, particularly for employers already using HRD Corp to support employee training.

What About HRD Corp?

For many Malaysian employers, workforce training is already closely associated with HRD Corp.

The Human Resources Development levy is separate from employees’ EPF contributions. Eligible registered employers contribute a levy to HRD Corp, which can subsequently be used to support retraining and upskilling through eligible training grants.

According to HRD Corp, employers covered under the PSMB Act with 10 or more Malaysian employees are generally required to register and pay a monthly levy of 1% of wages plus fixed allowances. Employers with five to nine Malaysian employees may register voluntarily and pay a levy of 0.5% on the same basis.

The accumulated levy effectively provides registered employers with an existing mechanism for investing in employee development.

This creates an obvious question:

Can an employer use HRD Corp funding for a cybersecurity course and also claim Budget 2026’s additional 50% tax deduction on the same training cost?

Based on current official clarification, businesses should not assume so.

In the same Q&A, HASiL stated that a company would not qualify for the additional 50% deduction where it did not bear the training cost. Questions 96 and 97 specifically address AI training paid for or reimbursed through HRDF. Employers should confirm how the applicable rules treat their proposed cybersecurity training expenditure.

Employers should not assume that training costs reimbursed through HRD Corp also qualify for the additional tax deduction.

At the same time, being an HRD Corp contributor does not necessarily exclude an MSME from the Budget 2026 measure altogether. The official Budget 2026 tax measures contemplate eligible MSMEs that contribute to HRDF within the proposed training incentive framework.

The important distinction is who ultimately bears the qualifying training cost and whether the expenditure meets the final eligibility requirements.

Employers should therefore verify the applicable tax rules, recognised training requirements and final subsidiary legislation before treating a particular cybersecurity programme as qualifying expenditure.

More importantly, businesses should not allow the choice between HRD Corp funding and a potential tax incentive to become the starting point for their cybersecurity strategy.

The first question should still be: What skills does our organisation actually need?

Cybersecurity Skills Are Not One-Size-Fits-All

Cybersecurity is too broad for a single course or certification to address every requirement.

An employee who needs to understand fundamental cyber risks does not require the same expertise as a security operations analyst. Likewise, the skills needed to respond to incidents differ from those required to design enterprise security architecture or lead an organisation-wide cybersecurity programme.

A more practical approach is to develop capabilities progressively.

CYBERSECURITY CAPABILITY PATHWAY

LEVEL 01

Foundation

Build the Security Fundamentals

Objective

At the foundation level, the objective is to establish an understanding of cybersecurity concepts, terminology and common risks.

Audience and scope

For professionals beginning a cybersecurity career, or IT professionals whose responsibilities increasingly involve security, this can include threats and vulnerabilities, identity and access, network security, basic risk concepts, data protection and secure digital practices.

Development context

Foundation-level development can also help professionals understand how security fits within the broader IT environment before moving into specialised roles.

Pathway reference

Trainocate Malaysia’s Top Cybersecurity Skills for Malaysia’s Digital Future in 2026 maps foundation pathways across multiple technology and cybersecurity providers.

KEY TAKEAWAY

The objective at this stage is not to turn every learner into a cybersecurity specialist. It is to establish the knowledge required to understand security responsibilities and progress into more specialised areas.

LEVEL 02

Intermediate

Move from Understanding to Application

Context

As responsibilities increase, cybersecurity becomes more operational and role specific.

Core capabilities

Intermediate capabilities can include security operations, incident response, vulnerability assessment, penetration testing, network defence, cloud security, digital forensics, identity and access management, and governance, risk and compliance.

Role alignment

At this stage, organisations should increasingly align training with actual job responsibilities.

A security operations analyst may require stronger threat detection and incident-response capabilities. A cloud professional may require specialised cloud security knowledge. Someone responsible for governance or audit may need deeper knowledge of controls, risk and compliance.

Provider pathways

Depending on the role and technology environment, Trainocate’s cybersecurity campaign maps intermediate pathways across vendors and certification bodies including AWS, CompTIA, EC-Council, Fortinet, ISACA, ISC2, Microsoft and Palo Alto Networks.

KEY TAKEAWAY

The goal should not be to accumulate certifications broadly. It should be to match learning and certification pathways to the capabilities required by each role.

LEVEL 03

Expert

Build Security Architecture and Leadership

Context

At the expert level, cybersecurity responsibilities extend beyond operating individual security controls.

Leadership responsibilities

Professionals may be responsible for designing security architectures, leading enterprise security programmes, managing complex risks, establishing governance frameworks or translating technical cybersecurity issues into decisions for senior management.

Capability mix

This requires a combination of technical depth, risk understanding, architecture and leadership.

Advanced pathways

Advanced pathways can therefore cover areas such as security architecture, information security management, advanced governance and risk, enterprise security strategy and security leadership.

WORKFORCE PLANNING VALUE

For organisations, this progression from Foundation to Intermediate and Expert provides a more useful model for workforce planning than treating cybersecurity training as a one-off activity.

From Training Budget to Cybersecurity Capability

Whether training is funded through an organisation’s own budget, supported through HRD Corp or potentially eligible for a tax incentive, the funding mechanism does not determine whether the organisation becomes more secure.

What matters is what capability the training develops.

Before selecting courses, organisations can begin with practical questions:

  • 1

    Which roles currently carry cybersecurity responsibilities?

  • 2

    Where are the organisation’s most important security capability gaps?

  • 3

    Which employees need foundational knowledge, and which need specialised expertise?

  • 4

    Are cloud security, identity, incident response, governance or security operations becoming more important?

  • 5
    What capabilities will be required as the organisation adopts new technologies?

Training can then become part of a structured workforce plan.

An IT administrator whose role increasingly involves security may begin by strengthening security fundamentals before progressing into identity, network or cloud security. A security analyst may move towards incident response, threat analysis or advanced security operations. An experienced professional may progress towards architecture, governance or leadership.

Certification can support this journey by providing structured learning and recognised validation of knowledge. But certification works best when it addresses a clearly identified capability requirement, not when earning the credential becomes the objective itself.

Cybersecurity, AI and Cloud Skills Are Becoming More Connected

Malaysia’s wider digital-skills agenda also demonstrates why cybersecurity capability cannot develop entirely in isolation.

In August 2026, the Ministry of Digital announced an expanded Rakyat Digital initiative as part of Malaysia’s digital talent agenda. Under the Malaysia Digital 2030 Action Plan, Malaysia is targeting an 80% digitally literate population and the reskilling of 700,000 workers.

The initiative includes learning modules spanning CyberSAFE, AI Safety, Generative AI, Agentic AI and Cloud.

That combination reflects what businesses are increasingly experiencing in practice.

AI systems depend on data and digital infrastructure that must be protected. Cloud adoption changes how organisations manage applications, workloads, identities and information. Cybersecurity teams increasingly operate across environments where cloud, data and AI intersect.

As Malaysia develops talent to support its AI ambitions, organisations will also need professionals who understand the security and governance requirements surrounding those technologies.

Likewise, as Malaysia develops its cloud capabilities, protecting cloud workloads, identities and data becomes part of the cybersecurity equation. The skills remain distinct, but the environments in which professionals apply them are increasingly connected.

Turning Budget 2026’s Focus into Cybersecurity Capability

Budget 2026 gives Malaysian businesses another reason to examine how they develop cybersecurity skills.

The Ministry of Digital’s announcement of an additional 50% tax deduction for recognised AI and cybersecurity training highlights the Government’s focus on workforce skills. Employers should verify the applicable eligibility and claim requirements before including the incentive in their training budgets. At the same time, HRD Corp continues to provide many registered employers with an established mechanism for funding eligible employee development.

Each funding option should be assessed against its eligibility requirements, including the tax treatment of any reimbursed training costs.

Training should address identified cybersecurity skills gaps and reflect the technical, governance and leadership responsibilities of each role.

WHERE TO BEGIN

Budget 2026 has put cybersecurity skills in focus.

For professionals and organisations considering where to begin, Trainocate Malaysia’s Top Cybersecurity Skills for Malaysia’s Digital Future in 2026 brings together multi-vendor certification pathways across Foundation, Intermediate and Expert levels.

The next step is ensuring that investment in training translates into capability.