Issue link: https://maltatoday.uberflip.com/i/1547312
15 maltatoday | SUNDAY • 25 OCTOBER 2026 FEATURE cyberattacks are detected, anticipated and repelled ble of identifying vulnerabilities, organisations must ensure they know which assets they operate, keep systems updated and main- tain strong controls over who can access sensitive information. The agent said this made es- tablished security measures par- ticularly important, including accurate asset management, vul- nerability assessment and patch management, secure system configuration, identity controls, continuous monitoring and sup- ply-chain security. Incident response and recovery also remain central to prepared- ness. "Security teams must be able not only to detect and contain an at- tack, but also to restore affected services and ensure systems can withstand future incidents," the aagent noted. How AI is changing cyberattacks AI has brought with it a new di- mension to cyberattacks, forcing those on the frontline to stay even more vigilant. "AI is changing the speed, scale and accessibility of cyber activity," the agent said. AI can help attackers conduct reconnaissance, analyse infor- mation, produce convincing so- cial-engineering messages and identify potential weaknesses. But equally important is the use of AI by the defenders, who can use the technology to process large volumes of security informa- tion, support investigations and respond more quickly to potential threats. For MITA, the answer is not to attempt to predict every new AI capability, but to ensure that exist- ing security measures remain ef- fective as the technology develops. "The right approach is to main- tain strong security fundamentals, continuously assess existing con- trols and test preparedness regu- larly," the agent insisted. AI-related threats are already a concern rather than a distant pos- sibility. The technology can make existing attack methods faster, cheaper and easier to scale—a headache for anyone defending sensitive information and systems. But many times, successful cy- berattacks are those that exploit familiar weaknesses, including unpatched software, stolen cre- dentials, poor system configura- tion and social engineering. "AI does not make traditional cybersecurity obsolete," the MI- TA agent said. "In many respects it increases the value of getting the basics right." An organisation with effective asset management, timely se- curity updates, resilient identity controls, robust monitoring and tested response and recovery pro- cedures is better positioned to withstand attacks assisted by AI. "The technology can also strengthen the defensive side, helping security teams analyse information and investigate sus- picious activity more efficiently," they added. Can MITA prepare for AI- powered attacks? The challenge for a government agency is not simply to identify whether an attack involves AI, but to recognise malicious behaviour and respond before it causes sig- nificant damage. MITA's approach is based pri- marily on attackers' behaviour, techniques and the risks they pose, rather than assuming it would al- ways be possible to distinguish between activity carried out by a person, conventional automation or AI. "There is no single mechanism that can definitively identify all AI-generated malicious activity," the agent said. MITA's response, therefore, relies on multiple layers of se- curity, including monitoring for unusual or malicious behaviour, addressing vulnerabilities, pro- tecting identities and access, and maintaining effective incident-re- sponse and recovery capabilities. The agent said AI may be used defensively but insisted the tech- nology could not be treated as a replacement for established cy- bersecurity controls. Balancing innovation with security AI is increasingly being integrat- ed into everyday services, with political and institutional pressure also encouraging its adoption. But the potential benefits come with questions about whether the nec- essary safeguards are keeping up with the technology's pace. The agent said innovation and security should not be treated as competing objectives. "AI can deliver substantial ben- efits, but adoption needs to be risk-based and governed," they noted. Factors that need to be con- sidered include the sensitivity of the information being processed, the purpose of the system, where data is handled, applicable secu- rity and privacy requirements, human oversight and account- ability. Higher-risk applications require stronger safeguards. The objective is to enable the useful adoption of AI while en- suring that security measures develop alongside the technolo- gy, rather than being introduced only after problems emerge. This is particularly important in government, where AI systems may interact with official infor- mation and services that require strict controls. Protecting sensitive government information The growing use of generative AI by government employees presents another challenge— preventing sensitive informa- tion from being inadvertently shared with external services. Public sector workers may turn to AI tools to summarise documents, draft communi- cations, analyse information or speed up routine tasks. But convenience does not remove the responsibilities attached to handling official information. The MITA agent said gov- ernment employees remained responsible for complying with applicable government ICT security, information-man- agement and data-protection requirements, regardless of whether they used AI in their daily routines. "The use of AI does not re- move those obligations," the agent emphasised. AI services must be used in a controlled manner that reflects the sensitivity of the informa- tion involved and the environ- ment in which the tools have been approved for use. "Sensitive or protected infor- mation should not be placed into unapproved external ser- vices," the agent said. Governance, technical safe- guards and employee aware- ness, it seems, will remain key in a landscape where the use of AI will continue to increase. Malta Information Technology Agency offices (Photo: James Bianchi/MaltaToday)