When PETRONAS embarked on its digital transformation journey in 2017, leadership made cyber resilience a top priority from the outset. Following PETRONAS’ shift towards a more strategic and extensive use of data, technological solutions and new ways of working – as well as its role as the operator of national critical infrastructure – the need to operate securely became a non-negotiable prerequisite. However, an initial assessment of the organization’s cybersecurity posture indicated that substantial improvements were needed to keep pace with its increasingly complex operations and digital initiatives.

Driven by a clear leadership mandate, PETRONAS began building its cyber resilience capabilities in 2018, focusing on five major pillars:

• Enterprise cybersecurity governance: Establishing a holistic framework for managing and enabling cybersecurity consistently across the group
• Cyber defensive operations: Ensuring effective identification, detection and response to cyber threats
• Identity and access: Enhancing clarity and control over who has access to what and when
• Real-time operational technology (OT): Enabling better visibility of and response to threats in the OT environment
• Extensive enterprise-wide education and awareness programme: Supporting all pillars by ensuring employees understand their role in protecting both themselves and the organization against cyber threats.

Ultimately, executive leadership ensured that cybersecurity was not just viewed as an IT concern but as a business imperative, providing the necessary support and advocacy for the intensive three-year programme while integrating it into corporate decision-making. As a result, PETRONAS elevated its security posture from reactive to proactive, establishing cyber resilience as an actionable agenda at every level of the organization.