Kazakhstan has established a system for protecting digital infrastructure that brings together state technical services, cybersecurity monitoring and incident response centres, and private expert organisations. Their capabilities provide a foundation for the safe adoption of artificial intelligence in the public sector and business.
The development of AI requires protecting not only data and infrastructure, but also applications themselves against interference with their operation. For AI systems, preventing confidential information leaks, controlling access, identifying vulnerabilities, and countering manipulation of input data and user prompts are particularly important.
The development of the national cybersecurity system is also reflected in international assessments. In the International Telecommunication Union’s Global Cybersecurity Index 2024, Kazakhstan scored 94.04 out of 100 and was placed in Tier 2 (Advancing).
The Index assesses legal, technical and organisational measures, capacity development, and international cooperation. Capabilities established in these areas provide a foundation for further strengthening the security of digital services, including solutions that use artificial intelligence.
Sources:
State Technical Service JSC performs technical functions to ensure the cybersecurity of digital assets, including security testing, software analysis, and infrastructure protection. These activities are directly relevant to digital systems that incorporate artificial intelligence components.
STS also addresses AI-specific security risks, including the risk of data leaks when using large language models, unreliable AI-generated information, vulnerabilities in the software environment, and attacks involving the insertion of malicious instructions into model prompts - known as Prompt Injection. AI security is therefore already part of the organisation’s expert agenda.
Sources:
The State Operational Centre monitors the security of government digital assets, identifies threats and incidents, and supports incident response. Its functions are carried out through the National Coordination Centre operating within STS.
When AI is introduced into government information systems, these mechanisms can be used to protect the infrastructure supporting AI services by detecting unauthorised access, suspicious activity, compromised accounts, and data security breaches. Monitoring and incident response provide an essential layer of operational protection, which should be complemented by assessments of risks specific to AI models themselves.
Sources:
TSARKA is a private organisation specialising in cybersecurity services. Unlike government bodies and organisations that perform statutory public functions, TSARKA provides professional and commercial services to protect its clients’ digital infrastructure.
Its main activities include Security Operations Centre (SOC) services, encompassing round-the-clock event monitoring, cyber incident detection, and incident response support; technical analysis and investigations; penetration testing (Pentest); and security assessments of web applications, mobile applications, APIs, networks, and cloud infrastructure.
TSARKA also conducts vulnerability assessments and adversary simulation exercises (Red Team), provides advisory services on secure development and software security testing, and develops the Tumar.One Bug Bounty platform, which connects organisations with independent researchers to identify and remediate vulnerabilities.
TSARKA’s functions are therefore primarily service-oriented and involve technical expertise; they do not constitute governmental supervisory or regulatory powers.
Sources: