Southeast Asia’s nuclear and radiological facilities are becoming digitalised faster than the region’s rules for protecting them, and a new Perspective article argues that the gap is now a security problem in its own right. Writing in Frontiers in Nuclear Engineering, Julius Cesar Trajano of the S. Rajaratnam School of International Studies at Nanyang Technological University in Singapore examines how the Association of Southeast Asian Nations (ASEAN) is building artificial intelligence and cyber security governance, and asks whether those frameworks can be extended to reinforce nuclear security. His central claim is that as digital technologies become embedded in nuclear facilities and their supply chains, integrating cyber security into nuclear security frameworks is no longer optional but imperative.
The region’s exposure is real even without operating nuclear power plants. Southeast Asia already hosts research reactors and a wide range of medical and industrial radiological facilities whose control, monitoring and information systems increasingly rely on digital technologies, remote connectivity and cloud-based services. According to the article, this expanding digital footprint enlarges the attack surface: a successful cyber intrusion could disrupt health services, industrial processes or research activities, manipulate dose settings or radiation data, or quietly degrade safety and security functions without causing a major radiological release. The threat picture is sharpened by rising regional cybercrime, including ransomware targeting hospitals and critical services, which could encrypt or corrupt systems managing radiotherapy scheduling, dose records, or inventories and movement records of radioactive sources.
A central weakness the author identifies is regulatory rather than purely technical. Many Southeast Asian states have general cybercrime or critical-infrastructure legislation alongside radiation safety and nuclear security regulations, but lack a clear, nuclear-specific cyber security regime. As a result, operators often treat cyber issues as a narrow IT concern rather than an integral safety and security issue. Licensing, inspections and regulatory oversight may not consistently address network architecture and segmentation, access control and logging, or configuration and patch management for critical systems, leaving cyber resilience dependent heavily on individual operator practices and vendor choices. The convergence of information technology and operational technology amplifies the risk, particularly where facilities rely on remote maintenance by foreign vendors; remote access channels, if not tightly controlled, can provide pathways to reactor support systems, radiation monitoring infrastructure, or physical protection systems such as CCTV and access control. Even nominally air-gapped networks remain vulnerable through the routine use of USB drives and other portable media.
Institutional coordination lags the threat as well. Most countries in the region now maintain national computer emergency response teams, but these entities are not always closely integrated with nuclear regulators or facility operators, and nuclear and radiological facilities are not consistently treated as critical infrastructure requiring specialised arrangements. A cyber incident at a research reactor or major hospital may therefore be managed as a routine IT problem, without adequate safety and security assessment, rapid regulatory notification, or close coordination with law enforcement and relevant ministries. The scarcity of joint exercises bringing together cyber agencies, nuclear regulators, operators and emergency responders exacerbates the risk of confusion and delays in an actual event. Underlying all of this are persistent capacity gaps: specialist communities combining nuclear, cyber and policy expertise remain small in many states, and turnover among officials handling nuclear portfolios is high.
The countries are not starting from zero. Indonesia, Malaysia, Thailand, Vietnam and the Philippines, which have research reactors and significant radiological use, have begun updating regulations so that digital systems important to safety and security are explicitly covered. Indonesia’s Nuclear Energy Regulatory Agency (BAPETEN) has been incorporating cyber elements into security requirements for the RSG-GAS research reactor and associated facilities, including expectations on access control, system classification and protection of digital instrumentation and control. Thailand and Vietnam have been revising regulatory frameworks for research reactors and major radiological facilities in ways that increasingly treat cyber threats as part of overall nuclear security obligations rather than a separate IT issue. At the regional level, the ASEAN Ministerial Conference on Cybersecurity and related working groups are developing norms on critical-infrastructure protection and computer emergency response team collaboration, while the ASEAN Regional Forum and various Track 1.5 and Track 2 dialogues have hosted discussions spanning both cyber stability and nuclear security.
The International Atomic Energy Agency plays a central operational role. Through regional workshops, training courses and technical cooperation projects in Asia and the Pacific, it has helped states including Malaysia, the Philippines and Vietnam strengthen their nuclear security regimes with explicit recognition of cyber threats. IAEA nuclear security training in the region now routinely addresses cyber risks to digital instrumentation and control, access control systems and security-relevant monitoring, and peer review missions such as IPPAS have encouraged governments to treat cyber security as an integral part of physical protection and nuclear security culture. Nationally, most Southeast Asian countries have established computer emergency response teams or cyber agencies, such as Singapore’s Cyber Security Agency and Malaysia’s MyCERT, and some have begun working more closely with nuclear regulators. Singapore explicitly treats its radiological and healthcare sectors as part of critical infrastructure for cyber-risk management, and the Philippines has been exploring clearer channels between its Department of Information and Communications Technology, the Philippine Nuclear Research Institute and major hospitals using high-activity sources.
The article’s distinctive move is to mine ASEAN’s AI governance experience for transferable mechanisms. ASEAN has moved from broad principles toward practical tools, including the ASEAN Guide on AI Governance and Ethics endorsed in 2024, the ASEAN Working Group on AI Governance, risk-assessment methodologies, testing and assurance mechanisms, and the 2025 ASEAN Responsible AI Roadmap. The first transferable mechanism is risk-based assessment linked to differentiated levels of human oversight: the Guide recommends assessing AI systems by the probability and severity of potential harm and applying stricter governance to high-risk systems. Applied to nuclear facilities, operators and regulators could classify AI-enabled digital systems by their potential consequences for nuclear safety, security, safeguards and emergency response, so that applications supporting reactor instrumentation and control, radiation monitoring, material accountancy or physical protection receive more stringent assurance, testing, human-oversight and incident-reporting requirements than lower-consequence administrative applications.
A second mechanism is integration into existing organisational risk-management structures rather than the creation of parallel regulatory silos. The Guide recommends adapting existing governance, risk and compliance structures, defining responsibilities clearly, involving senior management, and using testbeds before full deployment. Nuclear regulators could require operators to document where AI is used in safety- or security-relevant systems, identify responsible personnel, conduct pre-deployment testing, maintain records of system changes and establish procedures for human intervention when AI behaves unexpectedly. Singapore’s Model AI Governance Framework and its AI Verify testing framework, which lets organisations test AI systems against principles including transparency, safety, security, robustness and accountability, illustrate how such principles become practical assurance tools; the transferable lesson, the author stresses, is not that nuclear regulators should adopt Singapore’s framework wholesale but that they could develop sector-specific AI assurance and testing arrangements on similar logic. Malaysia’s National AI Office, now institutionalised as AI Malaysia, together with its AI safety institute, shows how coordinating institutions and technical assurance capabilities can function as connective infrastructure between technological expertise and sector-specific regulation.
A third mechanism concerns institutional coordination and regional interoperability. The author proposes that ASEAN use the existing relationship between the AI governance working group, ASEAN cyber security mechanisms and the ASEAN Network of Regulatory Bodies on Atomic Energy (ASEANTOM) to establish a regular channel for exchanging information on AI-related cyber risks affecting nuclear and radiological facilities, through joint technical workshops, common terminology, lessons-learned exchanges and voluntary guidance. The ASEAN Cybersecurity Cooperation Strategy 2026-2030, which recognises emerging challenges associated with operational technology, artificial intelligence, cloud technologies and critical information infrastructure, and the ASEAN Regional Computer Emergency Response Team could be extended to nuclear and radiological incidents by developing protocols through which cyber agencies and nuclear regulators exchange information when a cyber incident has potential implications for nuclear safety or security. The ASEAN Declaration establishing an ASEAN AI Safety Network, listed under the 2026-2030 strategy, offers a near-term regional process that a cyber-nuclear action plan could join rather than duplicate.
These threads converge in the article’s headline recommendation: a regional action plan or roadmap to embed cyber security more systematically into nuclear security policies, deepen cooperation among ASEAN member states, and raise awareness of the AI-cyber-nuclear security nexus among industry, civil society and academia. Concrete elements include a standing coordination mechanism between ASEANTOM and the ASEAN Network Security Action Council, a nuclear-adapted cyber-nuclear risk impact assessment tool piloted in volunteer states with research reactors, joint tabletop exercises bringing together regulators, operators, national computer emergency response teams and law-enforcement agencies, and a restricted regional inventory of which facilities rely on networked digital instrumentation, remote vendor maintenance or cloud-connected monitoring. The author also draws on his experience with the Nuclear Energy Experts Group of the Council for Security Cooperation in the Asia-Pacific, whose Track II dialogues have helped identify AI-cyber-nuclear security risks and raise awareness among policymakers, scientists and academics. He is candid about a limit: ASEAN’s AI governance architecture rests on non-binding, voluntary instruments, an approach that sits awkwardly with the safety-critical, consequence-intolerant character of nuclear security, where regulatory obligations are typically binding. Any roadmap borrowing ASEAN’s AI-governance institutions should therefore treat them as a starting architecture for coordination and capacity-building, not as a template for the binding licensing conditions, mandatory reporting and inspection regimes that cyber-nuclear governance will ultimately need.
Subject of Research: A Perspective article on integrating AI and cyber security governance into nuclear security cooperation in Southeast Asia
Article Title: Preparing for emerging risks: AI, cyber governance, and nuclear security cooperation in Southeast Asia
Article References: Trajano, J. C. (2026). Preparing for emerging risks: AI, cyber governance, and nuclear security cooperation in Southeast Asia. Frontiers in Nuclear Engineering, 5, 1947341. https://doi.org/10.3389/fnuen.2026.1947341
Image Credits: AI Generated
DOI: 10.3389/fnuen.2026.1947341
Keywords: artificial intelligence, cybersecurity, nuclear security, ASEAN, ASEANTOM, Southeast Asia, radiological facilities, AI governance, research reactors, critical infrastructure, Track II diplomacy, IAEA
News Source: Courtney Benton. (October 28, 2026). AI and cyber governance lessons could shore up nuclear security in Southeast Asia. Scienmag.
