Inside MITA’s war room where cyberattacks are detected, anticipated and repelled

The age of AI is here. The ever-evolving technology is everywhere you look; from medicine to warfare, and people integrating it into their daily lives.

Having an AI platform that can cut working time by half, or even more in some cases, may sound fantastic. But adopting a technology that evolves every day can pose risks that many overlook until they hit home really hard.

These concerns are compounded when the technology is used by government workers handling sensitive data and information.

Keeping the risks at bay is the Malta Information Technology Agency (MITA), a government entity tasked with safeguarding the state’s IT infrastructure. From its headquarters in Santa Venera, MITA guards against cyberattacks that could pose a threat to the privacy, economic wellbeing and critical infrastructure.

Cybersecurity: A continuous process

Malta cannot afford to treat cybersecurity as a problem that can be solved once and for all. According to a MITA agent, granted anonymity for security purposes, no country or organisation can eliminate the risk of a cyberattack entirely.

“Cybersecurity is not a state of being fully protected or immune from attack,” they said, adding the objective was to reduce risk, detect malicious activity as early as possible, respond effectively and recover services quickly.

Government has established security monitoring, incident-response and resilience capabilities, which continue to develop as threats, technology and regulatory requirements evolve. Malta is also strengthening its national arrangements for incident response, preparedness, information-sharing and coordination.

“Preparedness must be treated as continuous work rather than a one-off achievement,” the agent said.

Government systems are exposed to malicious and suspicious cyber activity on an ongoing basis, as would be expected in any large public-sector digital environment.

However, the MITA agent cautioned against treating every attempted intrusion as a major security incident. Automated scanning, blocked attacks, phishing attempts, common malware and a significant cyber incident represent different levels of risk.

The agency does not publish operational figures or detailed incident data that could expose information about its monitoring environment or security posture. Instead, its priority is to identify, assess and respond to suspicious activity according to the potential risk and impact.

A growing range of threats

While AI is changing the cybersecurity landscape, the threats facing government systems extend well beyond the technology itself.

MITA identifies ransomware, phishing, social engineering, the exploitation of known vulnerabilities and the theft of credentials as key concerns. Attacks targeting suppliers and technology dependencies, insider risks, hacktivism and increasingly sophisticated state-linked activity also form part of the threat landscape.

One of the main challenges is the speed at which weaknesses can be discovered and exploited, the agent said.

As attackers become more capable of identifying vulnerabilities, organisations must ensure they know which assets they operate, keep systems updated and maintain strong controls over who can access sensitive information.

A cyber threat map

The agent said this made established security measures particularly important, including accurate asset management, vulnerability assessment and patch management, secure system configuration, identity controls, continuous monitoring and supply-chain security.

Incident response and recovery also remain central to preparedness.

“Security teams must be able not only to detect and contain an attack, but also to restore affected services and ensure systems can withstand future incidents,” the aagent noted.

How AI is changing cyberattacks

AI has brought with it a new dimension to cyberattacks, forcing those on the frontline to stay even more vigilant.

“AI is changing the speed, scale and accessibility of cyber activity,” the agent said.

AI can help attackers conduct reconnaissance, analyse information, produce convincing social-engineering messages and identify potential weaknesses.

But equally important is the use of AI by the defenders, who can use the technology to process large volumes of security information, support investigations and respond more quickly to potential threats.

For MITA, the answer is not to attempt to predict every new AI capability, but to ensure that existing security measures remain effective as the technology develops.

“The right approach is to maintain strong security fundamentals, continuously assess existing controls and test preparedness regularly,” the agent insisted.

AI-related threats are already a concern rather than a distant possibility. The technology can make existing attack methods faster, cheaper and easier to scale—a headache for anyone defending sensitive information and systems.

But many times, successful cyberattacks are those that exploit familiar weaknesses, including unpatched software, stolen credentials, poor system configuration and social engineering.

“AI does not make traditional cybersecurity obsolete,” the MITA agent said. “In many respects it increases the value of getting the basics right.”

An organisation with effective asset management, timely security updates, resilient identity controls, robust monitoring and tested response and recovery procedures is better positioned to withstand attacks assisted by AI.

“The technology can also strengthen the defensive side, helping security teams analyse information and investigate suspicious activity more efficiently,” they added.

Can MITA prepare for AI-powered attacks?

The challenge for a government agency is not simply to identify whether an attack involves AI, but to recognise malicious behaviour and respond before it causes significant damage.

MITA’s approach is based primarily on attackers’ behaviour, techniques and the risks they pose, rather than assuming it would always be possible to distinguish between activity carried out by a person, conventional automation or AI.

“There is no single mechanism that can definitively identify all AI-generated malicious activity,” the agent said.

MITA’s response, therefore, relies on multiple layers of security, including monitoring for unusual or malicious behaviour, addressing vulnerabilities, protecting identities and access, and maintaining effective incident-response and recovery capabilities.

The agent said AI may be used defensively but insisted the technology could not be treated as a replacement for established cybersecurity controls.

Balancing innovation with security

AI is increasingly being integrated into everyday services, with political and institutional pressure also encouraging its adoption. But the potential benefits come with questions about whether the necessary safeguards are keeping up with the technology’s pace.

The agent said innovation and security should not be treated as competing objectives.

“AI can deliver substantial benefits, but adoption needs to be risk-based and governed,” they noted.

Factors that need to be considered include the sensitivity of the information being processed, the purpose of the system, where data is handled, applicable security and privacy requirements, human oversight and accountability. Higher-risk applications require stronger safeguards.

The objective is to enable the useful adoption of AI while ensuring that security measures develop alongside the technology, rather than being introduced only after problems emerge.

This is particularly important in government, where AI systems may interact with official information and services that require strict controls.

MITA agents on alert for any eventuality

Protecting sensitive government information

The growing use of generative AI by government employees presents another challenge— preventing sensitive information from being inadvertently shared with external services.

Public sector workers may turn to AI tools to summarise documents, draft communications, analyse information or speed up routine tasks. But convenience does not remove the responsibilities attached to handling official information.

The MITA agent said government employees remained responsible for complying with applicable government ICT security, information-management and data-protection requirements, regardless of whether they used AI in their daily routines.

“The use of AI does not remove those obligations,” the agent emphasised.

AI services must be used in a controlled manner that reflects the sensitivity of the information involved and the environment in which the tools have been approved for use.

“Sensitive or protected information should not be placed into unapproved external services,” the agent said.

Governance, technical safeguards and employee awareness, it seems, will remain key in a landscape where the use of AI will continue to increase.