Identifying key factors of cybersecurity readiness in organizations: Insights from Malaysian critical infrastructure

Abstract

Cybersecurity readiness is critical for safeguarding National Critical Information Infrastructure (NCII) against rapidly evolving threats. This study applies Dynamic Capabilities (DC) theory to examine how Malaysian NCII agencies develop adaptive capabilities to counter such threats. Using a qualitative design, we conducted semi-structured interviews with 16 representatives from 15 organizations spanning finance, telecommunications, transportation, and government. Thematic analysis was employed to interpret readiness factors through the DC dimensions of sensing, seizing, and transforming. Findings reveal that sensing capabilities - such as situational awareness, policy flexibility, and technological agility - enable proactive threat detection and adaptation. Seizing capabilities emphasize dynamic leadership, strategic resource allocation, and proactive risk management as critical for addressing vulnerabilities and reinforcing resilience. Transforming capabilities, including crisis resilience planning, continuous learning, and a security-embedded organizational culture, underscore the need for ongoing adaptation and collaboration to sustain long-term cybersecurity readiness. The study reconceptualizes cybersecurity readiness as a dynamic, capability-driven process rather than a static checklist. The findings show that cybersecurity is not a one-time compliance exercise but an ongoing, evolving process requiring continuous sensing, seizing, and transforming. Leaders must prioritize adaptive governance structures that encourage strategic agility, flexible policy responses, and proactive risk management. The proposed DC-based framework offers practical guidance for high-risk organizations emphasizing leadership commitment, a security-oriented culture, and resource alignment. Although grounded in Malaysia’s NCII context, the framework has broader applicability for critical infrastructure globally.