Pakistan’s National CERT has recorded more than 1,000 cyberattacks since January, its director general told lawmakers. The body that tracks threats against government and public networks has only 70 people on its payroll.
Haider Abbas gave the numbers while briefing MNAs on the IT and telecom committee. According to him, AI agents now help watch for threats, but about 30% of the work is done that way and the other 70% is still manual. Members asked whether leaning on AI could itself open new weak spots, and he described a security monitoring centre that watches for incoming attacks.
The committee chairman pointed out that hacking attempts tend to jump around 14 August and 6 September, and asked what is done ahead of such dates. The meeting did not produce a detailed answer in public, nor a breakdown of the 1,000 attacks by target or severity, so the number says little about how many succeeded.
Abbas also briefed members on the Information Security Framework Rules, approved in 2023. Under them every institution is meant to go through a yearly cybersecurity audit that scores how strong its defences are; National CERT also publishes an audit framework that governs the registered firms allowed to carry out such audits. The IT secretary told the committee that each province has now named a department to handle cybersecurity.
The session widened into data protection. The head of the Pakistan Digital Authority argued that Pakistan needs a dedicated data regulator and proper oversight of AI as digital infrastructure grows. Federal IT Minister Shaza Fatima Khawaja said regulators do not run an organisation’s operations or set its policy, and that data matters will follow standards issued by the Digital Authority.
MNA Musa Gilani said weaknesses remain in how citizens’ personal information is protected and that the data should stay inside the country. The chairman said the suggestions would be considered, and praised the Digital Authority for the ground it has covered in roughly a year since it started work. A separate idea on the table was a digital strategy commission chaired by the prime minister, so that provinces actually carry out approved policies.
For ordinary users the practical point is the audit rule: banks, hospitals and government offices holding personal records are supposed to be checked every year, but no date for publishing results was given.
