In response to a succession of data leaks, we review 8 cybersecurity-related stocks. Focusing on the routes and volumes of publicly disclosed data leaks, this article briefly outlines the current state of countermeasures in the AI era and their future links to regulation.
Recently disclosed personal-information leaks include the exposure of 10,788,963 Yakiniku King member records, approximately 110,000 records leaked via a server operated by a contractor managing inquiries for Daiwa Securities, and suspected exposure involving 1,646 people due to unauthorized Google Workspace logins affecting Nikkei and related parties. In addition, unauthorized access to the Times Car web system affected approximately 6.6 million accounts and approximately 1.6 million identity-verification documents, while Digital Agency GSS was reportedly exposed to a potential leak of approximately 246,000 records after a VPN device vulnerability was exploited. These incidents occurred at different times, and even incidents occurring during the same period cannot necessarily be assumed to have resulted from simultaneous attacks.
The threat posed by AI certainly exists, but there has been no definitive public disclosure that AI was used directly in the incidents disclosed to date. Countermeasures combining an understanding of the intrusion routes with measures to address inadequate defenses are required. It is considered important to understand the respective functional scopes of web and endpoint defenses, while simultaneously strengthening update procedures and authentication and establishing monitoring systems.
The institutionalization of public-private cooperation and deactivation measures took effect on 1 October, creating obligations for specially designated critical-infrastructure operators to introduce the measures and report incidents. Meanwhile, full implementation of the use of communications information is targeted for autumn 2027, creating a time lag between reviews of existing systems and the application of the new framework. Companies will need to continue managing logs, establishing monitoring systems, inspecting contractors and putting recovery systems in place.
This article compares 8 cybersecurity-related companies from the perspectives of their links to regulation, business foundations and financial results. Based on the companies’ latest earnings releases and explanatory materials, it organizes trends in contract scale, ARR, sales, headcount changes and profitability. ALBERT and LAC were excluded from consideration because they have been delisted.