Skip to content
← Back to the Journal
Perspective·

The Defenses Nobody Wrote Down

This week, the head of the ruling party's cybersecurity headquarters called it a state of emergency in cyberspace. More than 20 major Japanese companies have disclosed cyberattacks in recent weeks. Tens of millions of customer records.

Experts point to one shift in particular. AI is helping attackers work past the Japanese language.

For decades, Japanese worked as a security control. Phishing emails read wrong. Fake sites felt off. Reconnaissance was slow for anyone outside the country. Nobody listed it in a risk register. It simply held.

The ID photo held too. Upload your driver's license, prove who you are. Then one breach exposed identity documents for 1.6 million accounts. Now the financial regulator is pushing banks to read the chip in the card instead.

Two defenses. Neither was a decision. Both were conditions.

AI changed the conditions. Nobody owned them, because nobody had written them down.

Over the same year, generative AI use in Japan more than doubled, to 58.8 percent. Attackers and defenders adopted the same technology. They learned different things from it.

In my last piece I argued that judgment has to be written down before a system can be graded against it. Risk works the same way. An assumption nobody wrote down is an assumption nobody governs.

That is what AI literacy means at the executive level. Knowing which of your assumptions the technology just broke. Knowing who in your company owns that question. Knowing what your policy says when a photo of an ID no longer proves identity.

Using the tools is the starting point. Every company runs on defenses it never wrote down. Someone is already testing them.

Sources