Reports of data leaks and ransomware attacks targeting Japanese companies are increasing, but the more difficult question is not simply whether artificial intelligence is being used by attackers, but how much it is actually contributing to the acceleration and expansion of attacks. To obtain a closer reading of the situation, ITmedia AI Plus surveyed the views of five technology organizations: Hitachi, Fujitsu, Accenture, IBM, and an unnamed provider.
The Increase in Attacks Is Not Settled by the Numbers
The five organizations differed in their estimates of the increase in attacks during the recent period. Hitachi said that the volume and speed of attacks had increased, noting that, in its estimate, the period between the disclosure of a vulnerability and its exploitation had shrunk from weeks to hours as artificial intelligence developed. Accenture also spoke of a tangible increase in the number of cases handled by security operations center and incident response teams, but it did not provide statistics specific to Japan.
By contrast, IBM warned against treating the number of published announcements as a direct measure of attack activity, because incidents announced during a given month may have occurred some time earlier. The unnamed provider indicated that more than 70 reports of unauthorized access or similar damage had appeared since September, but these figures may include breaches that occurred in July and August. They may also be inflated because several companies announced that they had been affected by a single service or platform.
What Evidence Is There That Attackers Are Using Artificial Intelligence?
Hitachi believes that the use of artificial intelligence by attackers is likely, while Accenture said that its threat intelligence team had detected cases linked to artificial intelligence agents. It added that intrusion operations are gradually moving toward models in which an automated agent is the center of the operation, rather than relying entirely on a human operator.
IBM and Fujitsu, however, emphasized the limits of what can be proven from publicly disclosed incidents. According to IBM, the cases whose details have been publicly revealed have not shown confirmed evidence of the use of artificial intelligence. Nevertheless, the company believes that the availability of advanced models through low-cost cloud application programming interfaces makes it unreasonable to ignore the possibility that attackers are using them. Another provider likewise considered it likely that these tools are being used to explore vulnerabilities in web systems accessible over the internet, without asserting this in specific cases.
What Is Changing for Companies in Practice?
The recommendations from the organizations surveyed agree that the priority is not to buy a new artificial intelligence tool, but to determine what must be protected first. The steps include identifying the systems and assets essential to business continuity, reducing services and data exposed to the public, applying patches, and verifying the integrity of authentication mechanisms and vulnerabilities in internet-facing interfaces.
Accenture and Hitachi also recommended continuously monitoring the attack surface and unusual communications, while the recommendations highlighted the importance of examining third-party data, including how it will be disposed of after the contract ends. Experts believe that incident response plans and training should be built on the assumption that a breach may occur, rather than on a promise to prevent it entirely.
Where Is Artificial Intelligence Useful in Defense?
Hitachi provided an example in which the time required to prepare threat models was reduced from weeks to hours in a test it conducted. Accenture said that some vulnerability and code-review tasks that previously took weeks or months could be completed within days in short cases. IBM identified three promising areas: threat monitoring and analysis in security operations centers, vulnerability discovery and assessment, and prioritizing patch deployment according to risk.
However, speed does not mean delegating the decision entirely to the system. Hitachi and Fujitsu stressed the need to combine artificial intelligence analysis with expert judgment, while another provider warned that decisions to shut down systems or accept risks remain managerial decisions. Editorial reading: The companies’ responses reveal that the most important change is the potential increase in the speed of attacks, not the disappearance of security fundamentals. Therefore, the practical questions for companies remain what must be protected, what can be shut down, and how they will restore their operations if attackers get past the first barriers.