Gartner Japan issued urgent recommendations in response to the increase in unauthorized access incidents involving Japanese companies. The possibility that AI-enabled attacks could become increasingly automated was highlighted, and key points for strengthening defenses were listed.
Since September, a series of serious unauthorized access and personal information breach incidents has reportedly occurred at Japanese companies. On 13 October, Gartner Japan issued urgent recommendations concerning the frequent unauthorized access incidents involving Japanese companies.
The recommendations raise concerns that AI and AI agents could automate the entire process, from broad-scale scanning and vulnerability identification through the generation and modification of attack code and the execution of attacks, leading to a dramatic increase in the speed and scale of attacks.
As an overseas example, the unauthorized access incident at a South Korean financial institution was reportedly assumed to involve an attack combining the Chinese-made agentic penetration-testing tool "ARTEX" with a large language model (LLM). There is a shared recognition that many organizations on the defensive side have not established the basics of vulnerability management, and a July survey found that only 30% of Japanese companies had implemented vulnerability management.
Specific actions for urgent inspections include urgently inspecting publicly exposed assets, checking authentication, authorization and API settings, conducting cross-system log investigations, appropriately deleting personal information, restricting lateral movement within internal networks, checking the status of coordination with third parties, and reviewing remediation and recovery procedures for critical exposures.
Yuichi Isoda (礒田 優一) commented, "Digital defense must be positioned as one of management's top priorities, and executives need to lead from the front."