Biggest challenge is convincing companies to invest in cybersecurity: SLT

• Group CEO Riyaaz Rasheed says corporates reluctant to fund cyber resilience because risks remain difficult to quantify
• Warns AI agents interacting autonomously creating new cyber threat landscape
• Says boards continue to prioritise financial controls over digital resilience
• Energy costs, semiconductor shortages and talent constraints continue to pressure telecom investment

Sri Lankan companies and Government institutions continue to underinvest in cybersecurity because boards struggle to justify spending against risks that have yet to materialise, Sri Lanka Telecom (SLT) PLC Group CEO Riyaaz Rasheed warned, arguing that the rapid evolution of artificial intelligence (AI) is making that approach increasingly untenable.

Speaking at the National Management Accounting Conference 2026, Rasheed said cybersecurity had become one of the telecommunications sector’s principal strategic concerns as AI evolves beyond generative AI towards autonomous ‘agentic AI,’ where software agents increasingly interact without human intervention.

“One of the biggest challenges we are very worried about is cybersecurity,” he said. “We always tell our clients, ‘please invest, please make sure you cover yourself with cybersecurity because agents are talking to agents.’”

Rasheed said the commercial challenge lies not in recognising the threat but in persuading organisations to allocate capital before suffering an attack.

“A lot of operators, a lot of Government institutes, don’t want to take the first step of making sure you cover yourself because the cost is also not cheap. And you don’t know what the damage could be. So, if you have not gone through it, you are very reluctant to put money on the table for a risk that you don’t know the quantification of,” he said.

He said SLT has intensified engagement with corporate executives and technology leaders to encourage earlier investment in cyber resilience, describing it as a national rather than an operational concern.

“We are trying in every forum to educate, from the CEOs to the CIOs, saying that this is a risk that we as a country cannot take. We should not even go in that way,” he said.

Rasheed said the acceleration of AI is changing the nature of cyber risk faster than many organisations appreciate.

“We started AI probably 10-15 years ago. Then suddenly it broke out. Then, from AI, we have gone into Gen AI. Now we are talking agentic AI,” he said. “What happens to a world when an AI agent deals with another agent without a human in between? You don’t know what will happen. It is so very complex. So we need to be very, very careful.”

Beyond cybersecurity, Rasheed said telecommunications operators continue to contend with structural constraints that directly affect capital expenditure and network resilience.

SLT’s enterprise business encompasses cybersecurity, cloud services, Government connectivity, and data centres, making uninterrupted infrastructure a strategic requirement rather than simply an operational objective.

He said international submarine cable failures remain among the most significant external risks facing the sector.

“Imagine one of these cables gets cut. It’s going to be very challenging for the country, for the economy,” Rasheed said.

Although the company has built redundancy into its international network, a major cable disruption would still have economy-wide implications, he said.

Rasheed also identified semiconductor shortages as a growing constraint on infrastructure investment, noting that supply rather than price has become the primary challenge.

“One of the biggest challenges we have faced in this crisis is the shortfall of hardware. The bigger price is not the price. Even if you pay a higher price, you can’t source them,” he said.

He said major global technology companies have locked in semiconductor production for years ahead, forcing operators to secure hardware well in advance to support network expansion and replace ageing infrastructure.

“As demand grows, you need more and more hardware. You can’t run on old hardware after five or six years,” Rasheed said.

He identified energy costs and the loss of skilled technology professionals as the other structural pressures confronting the industry.

“The first one is definitely the price of energy. Second is the shortfall of hardware. And then the third one is the people. So we need to make sure that we groom new people and bring them up to standard,” he said.

While AI offers significant commercial opportunities, Rasheed said boards should treat cyber resilience as a strategic investment rather than a discretionary technology expense.

“Yes, AI has its own positives, its own benefits,” he said.