I came across a take in one of the tech talks going around lately that stuck with me: software engineers in Malaysia are still a bit behind when it comes to agentic AI.

I get why someone would think that. Scroll Threads or X and it feels like everyone else is shipping apps with Claude Code over the weekend while our local dev scene stays quiet.

But I don’t think “behind” is the right word. Quiet, yes. Slower to roll it out at work, sometimes. Behind? That depends on which 10% of the market you are looking at.

The short answer

Most serious software work in Malaysia doesn’t happen in public. It happens inside banks, oil and gas, telcos, government-linked companies, insurers, logistics and manufacturing. Internal systems, sensitive data, regulated processes. In those places, a developer can’t just install an AI agent and give it access to the codebase because a YouTube video said so.

So the real question isn’t “why haven’t Malaysian developers moved to AI?” It’s “how do corporates adopt AI safely, and how fast can they do it?” Those are very different questions.

You only see 10% of the market

Think of it like an iceberg. The part above water is the public stuff: startups, indie hackers, open source, side projects, people building in public. That’s where the AI demos come from.

The other 90% is enterprise. Internal portals, back-office systems, integrations, stored procedures moving millions of transactions a day. Nobody tweets about those, and most of the people who build them are not allowed to anyway.

To be clear, that 10/90 split is my own rough estimate from years in the industry, not a number from a survey. There’s no clean statistic for “public versus internal” software work, and I doubt there ever will be, because the internal side is exactly the part nobody reports on. Maybe it’s 20/80, maybe 5/95. The point stays the same: most of the work is the part you don’t see.

I’ve worked on that side for years, as a vendor for retail oil and gas systems. Trust me, you don’t post screenshots of that codebase on Threads, with or without AI.

Why enterprise adoption of agentic AI is slower

Everyone can adapt at any time. The question is how quickly, and what has to happen first.

Compliance and certification: ISMS, ISO 27001 and friends

If your company holds ISO/IEC 27001 or runs an Information Security Management System (ISMS), a new tool that reads source code and sends it to a third-party model is a big change. It goes through the process:

  1. Risk assessment: what data does the tool see, where does it go, who keeps it?
  2. Update the policies and procedures so the new way of working is documented.
  3. Get the proposal reviewed, sometimes with the auditor or an internal audit team.
  4. Roll it out, with controls in place.
  5. Survive the real audit. Pass, and everyone moves on. Fail, and you risk a nonconformity or, worst case, the certification itself.

Nobody wants to be the developer who cost the company its ISO cert because they wanted to try a cool agent.

The AI policy itself

Many companies didn’t have an AI policy two years ago. Now they need one. Which tools are approved? Can you paste client data into a chat? Is generated code allowed in production? Who owns it? What about licensing? Writing that policy takes time, and until it’s done, the safe answer is “not yet”.

Code of conduct and data handling

Client contracts, NDAs and data protection obligations (PDPA here, plus whatever the client’s own country requires) still apply. If the contract says source code and data can’t leave a certain environment, an agent running against a cloud model is a problem until someone clears it.

Provisioning and enterprise subscriptions

Even after approval, there’s procurement. Enterprise plans, data retention terms, SSO, seat management, budgeting, vendor assessment. A personal subscription takes two minutes. An enterprise rollout can take a few quarters.

The HR question nobody wants to say out loud

Once AI is adopted, management starts asking: if the team is now faster, do we still need the same headcount? Retrenchment, restructuring, upskilling, new job scopes. That’s an HR strategy, not a tooling decision, and it makes some companies move very carefully.

Quiet doesn’t mean secretive, and it doesn’t mean behind

This is the part I think people miss. Some assume that if developers aren’t posting about agentic AI, they’re either hiding it or haven’t touched it. There’s a third option: they’re just working.

  • Seasoned developers have no reason to show off. If an agent helped them close a ticket faster, the ticket is closed. Work as usual. Why yap about it?
  • Some have a routine that already works. Not every task needs an agent. Some people use AI for research and reading docs, then do the hardcore programming themselves.
  • Some are bound by work rules. They can’t share what they built, so they share nothing.
  • Some just have a life. Family, kids, aging parents, other responsibilities. Not everyone spends their nights experimenting with agents, and that’s fine.

On the side-project front, a lot of people I know have already gone fully agentic for their own stuff. The ones who haven’t usually have reasons that have nothing to do with skill. So why paint everyone with the same brush?

If you’re into agentic AI, do you still own your code?

Here’s a question back to the people who think everyone else is behind.

When the agent writes the code, do you review it line by line? Do you understand every change before it hits production? Or do you let the AI handle it and move on?

Maybe your app is ten pages. That’s fine, you can eyeball it. I maintain a portal with around 400 different APIs. About 95% of it was written by hand. I don’t talk much about AI for that project because there isn’t much AI to talk about. That doesn’t mean I don’t use AI. It means I know where it fits and where it doesn’t, and in a system that size, I need to own every line.

Using Codex or Claude Code isn’t the same as mastering agentic AI

Running Codex or Claude Code is a great start. But it’s using a public tool, not mastering a practice. A few questions worth asking yourself:

  • Could you replace parts of your CI/CD with AI agents? Which parts should stay deterministic scripts, and which parts benefit from an agent’s judgment?
  • How do you decide which tool to use for which job: a plain script, a single agent, or several agents orchestrated together?
  • Do you have guardrails? What can the agent do on its own, and what needs a human to approve it?
  • Is your workflow something you copied from someone’s thread, or something you refined for your own problems?

There’s nothing wrong with following other people’s workflows. That’s how most of us learn. But at some point you have to invent your own process along the way.

My example: from raw scripts to agent orchestration

My own setup didn’t start agentic. It started as raw shell scripts, the boring kind: build, check, deploy. Over time I kept fine-tuning the process. Scripts became proper tools with checks built in. Then agents started calling those tools instead of me typing commands. Then I started orchestrating several agents across my servers, each with its own job.

This blog is a small example. Publishing used to be me writing Markdown, resizing images and pushing to Git by hand. Now it’s one tool with a few commands: render or upload an image, create a draft, publish. The tool strips photo metadata, never overwrites existing media, checks that every image URL loads, builds the site with Hugo, and only then commits and pushes. Cloudflare deploys it after that.

The agent writes the draft and makes the graphics. The script enforces the rules. I review and decide when it goes live. The agent never gets to skip the checks, and I never have to remember them.

That’s the part I find interesting about agentic work. It’s not “AI writes my code”. It’s deciding which steps should be deterministic, which steps can use judgment, and where the human stays in the loop. Getting that balance right took months of tweaking, and it’s still changing.

So, are we behind?

Some of us, maybe. Every market has people who are early and people who are late. But judging a whole country’s engineers by what gets posted on Threads misses most of the picture.

The enterprise developers are waiting on compliance, policy, procurement and audits, not on motivation. The seasoned ones are working quietly. The busy ones are with their families. And the ones going hard on agentic AI in their side projects are already there, they just don’t need to announce it.

If you want to share what you’ve learned, please do. I’ll read it. Just don’t assume silence means nobody else is doing the work.