KPMG Japan published a preliminary version of its “Cybersecurity Survey 2026/27,” based on responses from 420 domestic companies. Economic losses occurred at 41.4% of companies that had experienced a cyber incident, and cases involving personal information leaks were also common. As the use of generative AI expands, challenges are emerging in accountability structures and governance for AI security.
The initial report presents the results of a survey conducted from 29 June to 12 August among domestic listed companies and unlisted companies with sales of ¥100 billion or more. It collected 420 valid responses from cybersecurity officers and personnel. The survey was conducted by mail and online questionnaire.
Economic losses occurred at 41.4% of companies that had experienced business impacts from cyber incidents. Personal information breaches involving customers and business partners affected 32.3%, while breaches involving the companies' own employees affected 31.3%. Some respondents reported total losses of ¥1 billion or more over the past year.
Attack methods increasingly included those likely to involve the misuse of generative AI, including phishing, business email compromise, social engineering and payment instructions using deepfakes. Attacks conducted through contractors and business partners accounted for 14.1%, the highest proportion, up from the previous survey.
A total of 87.4% of companies recognized a shortage of security personnel. While 56.9% of companies had increased investment from the previous year, 41.3% had not formulated a medium-term cybersecurity plan. The spread of AI use and delays in establishing responsibility structures were identified at the same time.
Use of or consideration of generative AI stood at 96.6%, while use of AI agents reached 47.9%. Companies that had designated an AI security officer accounted for 26.8%, while 38.2% had not designated a clear person responsible. There were significant differences in the development of AI governance.