AI-Powered Threats: How Cybersecurity Became a C-Suite Priority

Cybersecurity Damage

In recent years, cybersecurity incidents have continued to rise sharply. According to the 2025 Edition of the Information and Communications White Paper (1), the number of cyberattack-related communications observed by the National Institute of Information and Communications Technology (NICT) reached 686.2 billion packets in 2024, a 10.7% increase from the previous year. This figure has grown roughly tenfold over the past decade, indicating a significant surge in attack volume.

Among Japanese companies, the average financial damage per incident reached ¥170 million over the past three years—including 2024—representing a 36.8% year-on-year increase. Both the number of attacks and the monetary impact have risen, but the notable growth in per-incident damage indicates that attacks are becoming increasingly large-scale.

The year 2025 has seen cyberattacks targeting Japanese companies become even more severe. A series of large-scale ransomware attacks occurred, and at Asahi Group Holdings, roughly 1.91 million pieces of personal information were leaked and logistics operations were disrupted, causing serious consequences for business continuity.

In the financial sector as well, there have been cases in which individual securities accounts were hijacked and used for unauthorized stock transactions. As attacks grow more sophisticated and IT environments become deeply embedded in social infrastructure, 2025 became a year in which companies were required to strengthen security governance more than ever before.

Japan’s Cybersecurity Policy and Corporate Governance

Japan’s cybersecurity policy has undergone significant change over the past 20 years. Until the 2000s, ministries and companies handled cybersecurity individually, and a unified national strategy was lacking. However, in response to the rise in cyberattacks, the Cybersecurity Basic Act was enacted in 2014, and in 2015 the Cabinet Cybersecurity Center (NISC) was established within the Cabinet Secretariat. This marked Japan’s transition to a cross-government, cross-industry national strategy and initiated full-scale measures addressing critical infrastructure.

Subsequent initiatives included establishing guidelines across 14 critical infrastructure sectors, and organizational strengthening progressed particularly among local governments and large corporations. Yet, entering the 2020s, the rapid increase in ransomware and supply chain attacks made it difficult to rely solely on traditional “passive defense” measures. Reflecting this, discussions on active defense advanced, and in May 2025, legislation related to active cyber defense was enacted. The new law authorizes the government to monitor and analyze communication data and, when necessary, take neutralization measures against attack sources in order to preempt cyberattacks.

Thanks in part to these government initiatives, Japan was ranked Tier 1—the highest of five tiers—in the Global Cybersecurity Index 2024 published by the ITU2. However, challenges remain. According to a survey by NRI Secure3, 92% of companies report a shortage of cybersecurity personnel. Additionally, security awareness among small and medium-sized enterprises (SMEs) remains low: a survey by the Information-technology Promotion Agency (IPA)4 found that 63% of SMEs made no investment in information security during the past three years, including 2024.

Because SMEs in supply chains may serve as entry points for attacks that subsequently impact large corporations, Japan’s overall security risk remains high. Companies therefore need to build security standards that cover entire supply chains. Strengthening supervisory functions at the management level and enhancing risk management capabilities will be critical.

New Threats Driven by AI Evolution

Today, advancements in AI are accelerating the automation and sophistication of cyberattacks. Mass-generation of phishing emails, rapid vulnerability scanning, and optimized post-intrusion operations have become easier, significantly lowering the barrier to launching attacks. Moreover, social engineering that uses AI-generated misinformation, spoofed audio, or deepfake videos has become more severe, making it increasingly difficult for humans alone to detect deception.

Additionally, improvements in AI-based translation mean that Japanese is no longer a “barrier to entry” for attackers. Previously, the complexity of Japanese grammar and writing systems limited foreign attackers, but high-quality AI translation now enables them to easily craft natural-sounding Japanese emails and forged documents—contributing to the rise of phishing and fraud targeting Japanese companies and individuals.

Against this backdrop, cybersecurity is no longer a matter for IT departments alone; it has become a core theme in enterprise risk management. Companies must strengthen security governance not only internally but across their entire supply chains, including business partners.

Cadira similarly recognizes cybersecurity as a foundational element of corporate value and intends to continue promoting the development of sustainable security frameworks through ongoing dialogue with companies.

References (in Japanese)
1 2025 Edition Information and Communications White Paper
https://www.soumu.go.jp/johotsusintokei/whitepaper/ja/r07/pdf/00zentai.pdf

2 https://www.itu.int/en/ITU-D/Cybersecurity/Documents/GCIv5/2401416_1b_Global-Cybersecurity-Index-E.pdf

3 https://www.meti.go.jp/press/2025/05/20250514002/20250514002-2.pdf

4 https://www.ipa.go.jp/security/reports/sme/nl10bi000000fbvc-att/sme-chousa-report2024r1.pdf