Cybersecurity as a Foundation for the Safe Adoption of Artificial Intelligence in Kazakhstan

Kazakhstan has established a system for protecting digital infrastructure that brings together state technical services, cybersecurity monitoring and incident response centres, and private expert organisations. Their capabilities provide a foundation for the safe adoption of artificial intelligence in the public sector and business.

The development of AI requires protecting not only data and infrastructure, but also applications themselves against interference with their operation. For AI systems, preventing confidential information leaks, controlling access, identifying vulnerabilities, and countering manipulation of input data and user prompts are particularly important.

The development of the national cybersecurity system is also reflected in international assessments. In the International Telecommunication Union’s Global Cybersecurity Index 2024, Kazakhstan scored 94.04 out of 100 and was placed in Tier 2 (Advancing).

The Index assesses legal, technical and organisational measures, capacity development, and international cooperation. Capabilities established in these areas provide a foundation for further strengthening the security of digital services, including solutions that use artificial intelligence.

Sources:

1. ITU — Global Cybersecurity Index 2024 report (countries grouped by tier)
2. ITU — Kazakhstan’s profile in the GCI 2024 report (PDF)
3. ITU — publication on Kazakhstan’s 31st place in GCI 2020
4. ITU — official GCI page and information on the preparation of the sixth edition

1. Functions of State Technical Service JSC (STS)

State Technical Service JSC performs technical functions to ensure the cybersecurity of digital assets, including security testing, software analysis, and infrastructure protection. These activities are directly relevant to digital systems that incorporate artificial intelligence components.

STS also addresses AI-specific security risks, including the risk of data leaks when using large language models, unreliable AI-generated information, vulnerabilities in the software environment, and attacks involving the insertion of malicious instructions into model prompts - known as Prompt Injection. AI security is therefore already part of the organisation’s expert agenda.

Sources:

1. Law of the Republic of Kazakhstan “On Cybersecurity” — Article 14, Adilet Legal Information System
2. STS JSC — official website
3. STS JSC — information on monitoring and the National Coordination Centre for Cybersecurity

2. Functions of the State Operational Centre for Cybersecurity

The State Operational Centre monitors the security of government digital assets, identifies threats and incidents, and supports incident response. Its functions are carried out through the National Coordination Centre operating within STS.

When AI is introduced into government information systems, these mechanisms can be used to protect the infrastructure supporting AI services by detecting unauthorised access, suspicious activity, compromised accounts, and data security breaches. Monitoring and incident response provide an essential layer of operational protection, which should be complemented by assessments of risks specific to AI models themselves.

Sources:

1. Law of the Republic of Kazakhstan “On Cybersecurity” — Articles 7-4, 9 and 14, Adilet Legal Information System
2. Rules governing the cybersecurity researcher engagement programme, Adilet Legal Information System

3. TSARKA’s Activities in Cybersecurity

TSARKA is a private organisation specialising in cybersecurity services. Unlike government bodies and organisations that perform statutory public functions, TSARKA provides professional and commercial services to protect its clients’ digital infrastructure.

Its main activities include Security Operations Centre (SOC) services, encompassing round-the-clock event monitoring, cyber incident detection, and incident response support; technical analysis and investigations; penetration testing (Pentest); and security assessments of web applications, mobile applications, APIs, networks, and cloud infrastructure.

TSARKA also conducts vulnerability assessments and adversary simulation exercises (Red Team), provides advisory services on secure development and software security testing, and develops the Tumar.One Bug Bounty platform, which connects organisations with independent researchers to identify and remediate vulnerabilities.

TSARKA’s functions are therefore primarily service-oriented and involve technical expertise; they do not constitute governmental supervisory or regulatory powers.

Sources:

1. TSARKA — official company website
2. TSARKA SOC — round-the-clock monitoring and incident response
3. TSARKA — penetration testing and security assessments
4. TSARKA — Tumar.One Bug Bounty platform