- 2 days ago
Following Budget 2027, NIAGA SPOTLIGHT examines what it takes to turn technology spending into stronger business performance—from choosing the right tools to managing ongoing costs and protecting company data.
Join Tehmina Kaoosji and Subhalakshmi Ganapathy, Chief IT Security Evangelist at ManageEngine, for the discussion on maximising new technology via business returns.
Join Tehmina Kaoosji and Subhalakshmi Ganapathy, Chief IT Security Evangelist at ManageEngine, for the discussion on maximising new technology via business returns.
Category
🗞
NewsTranscript
00:10Hello, I'm Tamina Kausji and this is Nyaga Spotlight.
00:13Today our focus falls right back on Budget 2027, post-stabling and also making those
00:19technology investments work. Well, every ringgit a business spends on technology is worth careful
00:25consideration. Now, Budget 2027 includes a 30 million ringgit through grant from MDEC to support
00:32AI adoption as well as automation and professional training. But for business owners, the proof does
00:38come after the purchase. Do these new technology investments improve service, strengthen operations
00:45and also justify the ongoing costs? All of these are pertinent questions for businesses digitalizing
00:52all around Malaysia. Well, joining me to get online into this very interesting discussion is now
00:59Subha Lakshmi Ganapati, who is the Chief IT Security Evangelist at ManageEngine. A very good morning
01:06to you, Subha. Thank you so much for making time to join us for this conversation.
01:10Thank you so much for having me, Tamina.
01:13All right, wonderful. So, Subha, now let's look at first turning budget support into lasting
01:19improvements and Budget 2027 did announce a 30 million allocation via MDEC. And this is specifically
01:26in order to assist roughly around 4,000 MSMEs to adopt AI and automate operations alongside professional
01:36training. So, what kind of support, in your opinion, ought to accompany technology purchases so that we can
01:42give businesses the best chance of using these allocations successfully? That's the key, isn't it?
01:49Yeah, of course. So, the 30 million ringard that Budget 2027 commits through MDEC to help 4,000 MSMEs
01:58adopt AI and to automate their business operation, I see this as a meaningful signal of intent. So, it tells
02:07businesses that government that government is serious about bringing smaller companies along on the AI
02:13journey. So, I would frame this way. Funding is just the starting line and not the finish line. So,
02:20the businesses should treat the support as a seed capital for a long-term transformation plan rather
02:26than a one-time investment or a one-time funding. It shouldn't be a one-off purchase that sits unused
02:33once the
02:34novelty of yourself. So, across the industry, be it like retail, finance, or healthcare, the software
02:40itself is rarely the reason a technology project succeeds or fails. So, the actual value comes from
02:48implementation. That means configuring what you implement or what you adopt or the tool properly,
02:56integrating it with the existing systems that we already run, and building it on reliable,
03:02a well-governed data. So, that's going to be the basic of everything, right? So, the support that
03:09comes with the purchase matters as much as the purchase. I would encourage the business leaders
03:17to secure three things. One, a hands-on onboarding. Two, a clear rollout roadmap on the different maturity
03:25levels or the different adoption levels. And three, the post-implementation support for at least the
03:32first few months. The first few months are often when the real questions start to surface. So, the second
03:41piece that I would like to put on here is training because the capability is the real bottleneck everywhere
03:50in the world today, especially when it comes to AI. So, ENY reports that only 12% of Malaysian employees
03:59received enough AI training to fully benefit from it. This is going to be a new technology to most of
04:05us.
04:06So, training matters the most. So, to put simply, many organizations are not getting full value from what
04:14they have paid for it because of the lack of training, because of lack of to know how to use
04:19it.
04:19So, training should be designed into the plan of adoption from day one and refreshed as the tools
04:27and processes change. And it's also become, you know, a security issue because people remain a business
04:34first line of difference, correct? Exactly. So, Subha, I'm going to pick up on that
04:40very startling fact, which should make Malaysian businesses alarmed enough to take action,
04:46which is to only 12% of companies are successfully able to actually roll out the type of AI business
04:53tools that they have acquired. So, coming back into that. Now, businesses considering this AI or
04:59automation, they also actually need to address their own internal unreliable networks, as well as aging
05:05devices, inconsistent records, or even an inefficient work process. How should management for companies
05:12then establish what is actually holding the business back and decide which problems require addressing
05:18even before they go into the loop of purchasing or introducing new technology? This would be a huge
05:26concern, especially considering those numbers, right? Yes, absolutely. So, many conversations of
05:32adopting AI today start with which AI tool should we buy? But the better starting point is what problems
05:40are we trying to solve? And when the problem is defined in business terms, such as probably a slow
05:46order processing or a frequent downtime or billing errors or technology becomes a targeted investment
05:53rather than a speculative one. So, the second step before deployment is do an audit before acting. So,
06:01every business should keep a current inventory of its devices, applications, and user accounts before
06:08committing to anything new. That way, it fits existing to the entire existing infrastructure very perfectly.
06:15So, that exercise is often revealing. It exposes outdated, which devices are outdated, what's unreliable,
06:23and what's duplicated. For example, two or three tools doing the same job. Are user accounts belonging to people who
06:30already left the organizations long ago? So, you can't protect or optimize what you can't see. So, that
06:38visibility is the foundation of every sound decision that follows. And third, and the point I would like
06:45most owners to remember, AI and automation amplify whatever they sit on. On strong foundations,
06:53they multiply value. On weak networks or aging hardwares or inconsistent records, they multiply the flaws.
07:01So, to put simply, AI doesn't fix a mess. It automates it. So, data supports this. It's an IDC research
07:09survey that says that 45% of AI projects in Asia-Pacific and Japan will miss their expected returns in
07:162026.
07:17And weak data foundations are part of the reason majorly. So, fixing the network devices,
07:24the network and the data quality isn't a delay to AI adoption, but this is what makes an adoption work
07:32very strongly. So, how should a management decide what to fix? That comes with an obvious question after
07:39that, right? So, fixing the right things first, not everything at once, that should be the strategy for,
07:47you know, do the auditing and properly taking up at step by step. I would suggest assessing each issue
07:53against two simple lenses. One, what is the problem costing the business today in lost time, in lost
08:01revenue or frustrated customers? And what is the risk of leaving it unaddressed in downtime or security
08:08exposure or data problems? So, the issues that score high on both, the ones that causes outages,
08:16create security gaps or corrupt your data go to the top of the list. And those deserve budget before
08:23any new tool does. So, this is very much like how we adopt the technology or getting ready for the
08:32technology or AI with a clear visibility and control of what you already have. Built-in automation and AI can
08:40then add value on top of that foundation without adding complexity or cost.
08:44Hmm, well understood. And that is really essential because that brings us to the next question. You'd
08:51mentioned earlier, Subha, that it's absolutely critical that companies also have an active onboarding
08:56process, especially those who are maybe first digitalizing or adopting AI tools. Now, let's look at
09:03actually, what should an owner or a business owner also include in their financial assessment and whether
09:08they are able to test whether the investment is bringing real value to them after the initial onboarding
09:15support has finished? How do they accustom themselves to being the final oversight for all of their automation
09:23enabled tools? And this is a beautiful question that gets discussed in the board very often, Ted Minow. So, the
09:30purchase price
09:31that we often see is the visible cost or the most visible cost. And often, I would say one of
09:37the
09:37smaller ones that we see on board. The price tag is just the entry ticket and not a whole journey.
09:45So, the
09:45first principle is to evaluate the total cost of ownership or the TCO as we say. And beyond the license,
09:52a
09:52business owner or a CXO needs to account for the integration with the existing systems or the data
09:59migration that we talked before and the staff training and ongoing maintenance and support.
10:05So, I would single out cybersecurity in particular because it's the cost most easily overlooked and
10:12most expensive to get wrong. So, every new tool or a connection on a user account is something that
10:20has to be secured. This includes the AI that the companies are going to adopt. So, the second principle
10:27is to budget for overruns. These aren't just a small business problem. So, say for example, IDC,
10:35a research organization projects that AA cost for large Asia-Pacific enterprises could swell up to 30% or
10:43above estimates by 2027. So, if enterprises with dedicated finance and IT teams find these costs hard to
10:53forecast, smaller businesses should build a deliberate contingency into their budgets from the onset.
11:00So, scaling, storage and infrastructure costs tend to grow as usage grows. So, the third principle that I
11:08would like to discuss or which I think matters the most in the context of budget 2027 is to test
11:15long-term
11:15viability. It's not just we just deploy it and then forget and do not maintain. So, the grants
11:22and subsidies are valuable, but they are temporary. They are just the starting point. So, I would
11:29encourage every business to ask one straightforward question. Could the business sustain the full monthly
11:36cost on its own based on the current revenue? If the answer is no, the business case isn't yet viable.
11:43However attractive the initial support looks, you know, and that figure should be revisited at least
11:50once a year because cost and business conditions both keep changing. It's a very fluid or volatile
11:55enrollment. And the fourth important principle is simplicity. Complexity has a way of quietly compounding
12:04cost. Every additional tool means another contract, another integration, another set of updates, another
12:12thing to train people on and another potential entry point for attackers because cyber security as we
12:18spoke is one of the largest costs for businesses today. Consolidating onto fewer well-integrated tools
12:26reduces maintenance costs and shrinks your security attack surfaces.
12:31So, simplicity is a financial strategy and a risk management strategy at the same time.
12:38So, all of that resonates so well, Subha, especially in particular talking about simplifying
12:44after perhaps certain businesses may have already adopted a host of different AI tools,
12:49but if they're struggling, it's better to review periodically, perhaps once every quarter,
12:55even if you're finding that the leakages are beyond your control and spiraling,
12:59and then perhaps reconsolidate. Subha, thank you for the conversation so far.
13:04Most interesting insights. We will take a short break now and we'll be back right after
13:08with the rest of the discussion only on Nyaga Spotlight.
13:33Welcome back to Nyaga Spotlight. Still with me, Tamina Kausji, and looking at one of our post-budget
13:382027 discussions today and making technology investments work. We have with us online Subha
13:44Lakshmi Ganapati of ManageEngine, who is sharing some deep insights into how businesses can better
13:50structure their AI and automation adoption requirements in line with ensuring that business
13:56capacity is optimized. So, Subha, going into the really important question, we had spoken a little
14:03about security and data breaches. Now, let's dig much deeper into it. So, an AI tool may need access
14:09to a company's information to perform useful work, but that access also requires certain parameters,
14:15right? So, before adopting the AI tools, how should a business decide which records should be made
14:22available, who can actually authorize those actions, and also which decisions for security purposes ought to
14:29still entail your human in the loop? This is one of the defining questions of the
14:36next few years, Tamina. So, we have spent decades learning to govern human access to information.
14:43So, with the AI, the next frontier is governing the machine access. So, the first step is to make the
14:49data
14:50access a deliberate business decision, not a default setting. So, businesses should classify their data by
14:57sensitivity. Customers, financial and HR records should be restricted by default with access expanded
15:05only when there is a clear business need and the right safeguards are in place. So, with the AI adoption,
15:12the management and securing of non-human identities is going to be the pain point as well as the important
15:20talks of cyber security. So, an AI tool for its effective functioning doesn't need to see everything
15:27to be useful. It needs to see the right things. So, applying the principle of least privilege to AI.
15:37So, the scale here surprises many people in many enterprises. So, the accounts used by software
15:45already outnumber the human accounts that are there in enterprises. So, each one is a potential point
15:53of exposure, each non-human identities. So, my advice is to treat AI agents like employees. So, give each
16:01one a distinct identity, only the minimum access it needs to do its job and review the access routinely. So,
16:09you wouldn't give a new joiner the keys to payroll on day one and AI deserves the same discipline. And
16:17keep human in the loop where it actually matters, especially when it's going to be a change in your
16:22infrastructure, when it's going to be a change in your business processes. AI is excellent for speed,
16:29drafting, sorting, summarizing, flagging. But decisions with legal, financial, HR or customer impact
16:37should require a human approval. The principle I would leave with the viewers is AI is for speed
16:44and humans for judgment. So, this is also the direction I think most of the global companies are
16:51taking. So, fourth, I would say demand evidence from the vendors and not assurances. So, before adopting a
17:00tool, a business should ask the vendors to show the live activity logs of what their AI
17:06or the tool does. And recognized security certifications and data residency controls that
17:13show where the information is actually stored and processed. And it should check these against the
17:19framework like the my AI standards. So, a verbal promise isn't a control, but a log actually is. So,
17:28we see identity access and management becoming central to AI readiness,
17:33because visibility and control over who and what can reach your data is what allows AI to be used
17:41confidently. So, the goal is not to keep AI away from your information, but to give access to AI,
17:49the same rigor you give people. So, the business can move faster without losing control.
17:55So, selective information scanning. Got it. Subha, you mentioned, of course, knowing where your data
18:02resides. That brings me to the fact that Budget 2027 for Malaysia refers to a sovereign AI cloud that is
18:09still being planned with an emphasis on, of course, keeping strategic information under Malaysian
18:14premises. Now, for businesses choosing cloud services today, what does the location of their data
18:20actually tell them and what must they be able to separately verify when it comes to access,
18:26security, service reliability, and also the cost of moving to another provider when this entire
18:32ecosystem finally does come to fruition? So, the sovereign AI cloud is an important signal of intent
18:39and keeping strategic national information under Malaysian control is a sound principle. For businesses
18:46choosing cloud services today, though I would make one distinction very clearly, data residency and
18:53data security answer different questions. Residency actually tells you where your data sits. Governance
19:01tells you who can reach it. So, hosting data locally helps meet the compliance requirements which is
19:08valuable, but residency alone doesn't mean automatic protection against a no traced access or breaches.
19:16So, probably a building in Kuala Lumpur still needs its own lock and you still need to know who holds
19:23the keys,
19:24right? So, every businesses should verify this separately. First is access and encryption. Businesses should insist on
19:34robust identity controls and full audit logs and get clarity on whether their data can be accessed from outside Malaysia
19:43by the provider,
19:44its partners or its support teams. Ideally, they should have contractual rights to review access records.
19:53And second, as you said, service reliability. Business continuity should rest on binding service level
19:59agreements covering uptime, response times, backup protocols, and financial accountability for outages.
20:06The key point is that those commitments must carry real consequences if they are not getting met. An SLA
20:14without accountability is only a statement of good intentions. And third, and the most often overlooked,
20:22plan your exit as carefully as your entry. So, the market is shifting. Gartner is expecting the demand for
20:29sovereign cloud to move about 20% of current workloads from global to local providers. So, switching providers
20:36will become a normal business decision going forward with stricter regulatory mandates being implemented
20:44across the globe. But it's not going to be an exceptional one. So, before signing, businesses should
20:51pre-negotiate the data export formats, the migration timelines, the exit fee, and the notice period. It's far
20:59easy to agree these terms at the start than at the moment when you want to leave. And avoiding vendor
21:06lock isn't
21:07about distress. It's about keeping the flexibility to make the right decision as your needs, regulations, and the market
21:14actually change. Absolutely. Planning ahead rather than making a decision during a time when it's no longer a
21:21negotiable. So, that brings me, Subha, to asking about the MDEC program, which is also looking to train
21:27and certify around 5,000 AI professionals for an SME, for example, that outsources its technical work.
21:35What type of knowledge, responsibility must remain inside the company? And also, how should an owner
21:42assess whether the training has equipped staff to adequately supervise their own technology, recognize
21:49their problems, and also challenge advice from providers, so that, in essence, we are looking at
21:55full scope professionals who have been trained via these programs? So, the principle here is very simple.
22:03So, when you say you can outsource execution, but you can't outsource the accountability. A business
22:09remains responsible for its data, its customers, and its decision, whoever manages the technology day to day.
22:17So, what must stay inside the company? At a minimum, the core knowledge of where your data is getting
22:24stored, who has access to it, and what your contracts actually say. If that knowledge sits only with an
22:32external provider or the system integrator, the business has lost the ability to make informed
22:38decision about its own operations. So, second, designate a single internal owner. Probably,
22:46when it comes to regulatory mandates, we call it as data protection officer. Someone needs to manage
22:52the vendor relationships and be accountable decision maker when an issue arises. This is very similar to the
22:59data protection officer that most of the regulatory mandates actually demand to have a single internal
23:04owner. So, without that role, oversight tends to fall through the cracks. It doesn't need to be a
23:11technical expert, but it must be someone with the authority and understanding to ask the right
23:17questions to your providers. And toward the upskill for oversight, not just actual operations. As AI
23:24enters more business decisions, the most valuable skill is not only using the technology, it's actually
23:31supervising it. So, the gap is actually real. So, PWC research finds only 20% of workers in Malaysia
23:39combine in-demand skills with strong AI use. That's why I think the Budget 2027's commitment
23:46through MDEC to certify 5000 AI professionals is so welcome. So, I would encourage businesses to use
23:54national programs like this to build supervisory capability in-house, so the staff can actually
24:00judge whether the technology is doing what it should do. We often invest a lot on learning
24:06and using it, but not supervising it. We should also look into learning the
24:11supervision of the AI and adoption tools. So, I would also add that this upskilling should reach across
24:19the workforce and not stay contracted in small group of technical specialists. And the fourth, how should an
24:27owner know whether the training has worked? You know, that's really important. So, measuring the
24:33practical competence and not just the certification. A completion certificate tells you someone has
24:39attended it, someone has completed the test. It doesn't tell you they can act. The better test is to
24:47whether the staff can actually question a provider's recommendation or spot an incorrect or suspicious AI
24:54output or handle realistic scenarios such as a security threat, a system failure or a data
25:00request. Practical scenario-based exercises are far better indicator than a course attendance.
25:08Absolutely. So, all of that taken into perspective would ensure that you actually have an in-house
25:14technological or technical specialist who is able to deal with any and all emergencies. You should no
25:20longer have to outsource anything. Very quickly now, Subha, as we land the conversation, what would you
25:26advise companies and Malaysian businesses looking to plan for their 2027 technology budget? We've got
25:34roughly around 90 days to go before the end of the year. What should they be looking at to purchase
25:38early on next year and what should they leave out depending on what they are able to adjudge?
25:44We previously talked about the total cost of ownership of the TCO and now it's time to talk
25:50about the written on investment. So, the budgeting usually asks one question, what will this actually
25:55written? I would encourage owners to ask a second one, what does it cause to delay the implementation
26:02or the adoption? Every budget line should be assessed through two lenses. The written it's likely to
26:09generate and the consequences of deferring it. They are not equal. Delaying a new feature postpones a
26:15potential benefit. Delaying a security or core infrastructure upgrades risks a serious outages or
26:23regulatory penalties. So, the cost of inaction is rarely the same across the two. So, that leads to the
26:30second principle, protect the core first. So, the threat landscape isn't standing still. So, the cyber
26:37security malicious. The quarter to 2026 report recorded 2715 incidents up to 24% on the previous
26:46quarter and the Cyber Security Act 2024 has raised compliance expectations. So, I would suggest a
26:54clear order of priority. First, your security baseline backups and infrastructure health and second,
27:01investment in your people and then to new tools. So, third, I would say extend the hardware selectivity.
27:09Hardware costs are rising partly due to memory shortages, right? So, rather than refreshing every
27:15device on a fixed cycle, business can use performance data to extend the life of devices that are still
27:22performing well and replace only those that are genuinely failing or critical. So, that frees budget for the
27:29priorities that matters most. Fantastic. So, finally, yes. The practical, yes. Yes, fantastic. Thank you so much for
27:38your deep insights, Subha. That was our discussion looking at Budget 2027 and how exactly we can make
27:44technology investments pay. That's all we have time for today on Nyaga Spotlight. I'm Tamina Kausji, signing off for now.
27:51We'll see you again next week with more business analysis and insights.
27:56.
27:56.
27:56.
27:56.
27:56Transcription by CastingWords