Cybersecurity awareness in Japan — the gap nobody is closing
Japanese companies are digitising fast, and security is the part that keeps getting left behind. Why the knowledge gap exists, and where to start closing it.
Doing penetration testing work in Tokyo, one thing comes up again and again. Japanese companies are genuinely digitising. Security is not keeping pace with it.
Since the pandemic a great many organisations have pushed through digital transformation programmes. Systems were modernised, operations moved online. But the question of how to protect those assets routinely drops out of the conversation.
Why the knowledge gap exists
A large part of it, I think, is language.
Most primary security material — vulnerability reports, technique write-ups, serious practical training — is written in English. Only some of it is translated into Japanese, and translation lags. The structural result is that concrete understanding of what actually happens after an attack does not reach the people who need it.
The quiet past is over
Japan historically had a low rate of cybercrime. That history left behind an assumption: we are not a target.
Digitisation makes geography irrelevant. To an attacker, a server in Tokyo and a server in London are the same distance away. Domestic incidents have been rising accordingly.
The gap that stands out most is the shortage of penetration testing. Testing a new application or a public-facing site from an attacker’s perspective before launch is a standard step in many countries. In Japan there are still plenty of teams where the term itself is not shared vocabulary.
Two things that get conflated
This distinction matters, and it is regularly muddled — including in the original version of this piece.
Classifying the person: hat colour
- White hat — works with permission, finding vulnerabilities for the defenders
- Black hat — operates without permission and with malicious intent
This is about position and motive.
Classifying the test: how much you are told
- White-box testing — conducted with full access to internal structure and source code. Testing with the blueprints in hand
- Black-box testing — conducted with no prior information, from the same starting position as an external attacker
This is about method. A white hat performing a black-box test is completely ordinary. The two are independent axes.
Internal versus external teams
- Internal security team — handles day-to-day operations and monitoring. Deep familiarity with your systems, and continuity
- External security team — brings an outside perspective, and finds the structural problems that have become invisible internally because everyone assumes them
These are different roles, not competing options.
Red teaming — simulating the real thing
A step beyond is a red team engagement. Rather than hunting individual vulnerabilities, it sets an objective the way a real adversary would, and tests the organisation’s defences and detection as a whole.
Think of it as measuring “would we notice?” rather than “do we have vulnerabilities?”
The CIA triad as a foundation
The underlying framework for all of it:
- Confidentiality — only authorised people can reach the information
- Integrity — data cannot be tampered with
- Availability — systems and data are usable when they are needed
When weighing a new control, asking “which of these does this protect?” makes prioritisation considerably easier.
The point
Digitisation has brought Japanese companies real opportunity. It brought equivalent risk along with it.
What is needed is not exotic. Understand the basics of penetration testing, build testing into the delivery process, and develop both internal and external capability.
Start by finding out how your systems actually look from an attacker’s point of view. Once.
Originally published on Medium · Medium
