Redesigning security through white-hat hacking

The more businesses harness data and AI, the more they face a paradox: innovation amplifies exposure to cyber risk. As system integration expands across business units and external partners, not only does the likelihood of attack grow, but the potential damage also becomes more severe. Given the new challenges of the AI era, companies must look beyond traditional protection and build organizations capable of withstanding and recovering from disruption.

What it comes down to is this: attackers routinely use AI, so defenders must also fight back with AI. Malicious AI-driven attacks such as phishing, malware creation and manipulation, and internal data harvesting, are becoming broader, more precise, and more sophisticated. Once inside, AI can instantly search millions of files and locate passwords with ease.

To counter these evolving threats, AI for security monitoring, detection, incident response, and threat hunting is becoming increasingly important. At the same time, organizations must reinforce their systems and training on the assumption that intrusions will occur.

Specifically, there are several foundational measures to take, which include implementing a CSF (Cybersecurity Framework), deploying solutions like EDR (Endpoint Detection and Response), conducting vulnerability assessments, and establishing SOC (Security Operations Center) and CSIRT (Computer Security Incident Response Team) for 24/7 monitoring. On top of these, organizations must layer AI-driven defenses through holistic redesign to keep pace with adversaries who are already automating their attacks (See Figure 1).

Drawing on experience as white-hat hackers (*1) across more than 200 Japanese companies, a common pattern has emerged: “Strong perimeter defense, weak post-intrusion resilience,” meaning that many organizations have invested heavily in preventing intrusions, but far fewer have prepared for what happens after an attacker gets in. While traditional security measures are in place, training and frameworks assuming breaches are insufficient. Red-Team (*2) test results speak for themselves:

When redesigning security, what matters most is how effectively you can “fill the major holes” in the environment. Assuming that attackers will eventually get inside, it’s essential to understand where those large vulnerabilities exist within your organization (see Figure 2).

Once these major gaps are identified and properly addressed, attackers find it much more difficult to advance. If they fail to obtain system administrator privileges, they will wander through the environment seeking application administrator privileges, and if that fails, database administrator privileges, and so on.

This forced movement creates opportunities for defenders to detect and contain the attackers. It is an effective defensive strategy.

Cyber attackers follow a clear sequence: reconnaissance, intrusion, and lateral movement. To prevent their success, it is essential to implement measures at each phase that attackers actively dislike, effectively raising the effort and cost required to continue the attack. Drawing on insights from Uvance Wayfinders consultants and white-hat hackers, here’s how to counter their tactics step by step.

1. Reconnaissance: Narrow entry points and remove footholds

Before attempting intrusion, attackers scour publicly available information to identify entry points such as websites, exposed servers, VPN or cloud login screens. The fewer entry points, the higher the chance they give up.

Even if credentials are stolen, multi-factor authentication can substantially reduce unauthorized access. Traditional perimeter defenses, which many Japanese companies have emphasized, are effective to some extent during the reconnaissance phase because they clearly separate internal and external networks.
However, even the strongest walls contain small cracks and weaknesses. Attackers continuously search for new paths, and if defenses are weak once the perimeter is breached, the organization becomes highly vulnerable.

2. Intrusion: Identify and block all possible paths

Attackers typically use three main routes when attempting to infiltrate a system: (1) intrusion via externally exposed servers, (2) malware infection of employee devices through sophisticated phishing emails, and (3) physical entry into offices to gain system access.

To prevent server-based intrusion, minimize exposed points and enforce strict security settings. For malware defense, strengthening the resilience of endpoints such as employee PCs and mobile devices is essential, along with enforcing communication controls such as proxy-based access and VPN authentication. Even in cases of infection, quick detection and isolation of abnormal traffic can significantly limit attacker activity.

Physical intrusion is surprisingly easy. In multi-tenant office buildings, completely controlling outsider access is virtually impossible. Once inside, attackers may connect to internal Wi-Fi, install rogue devices, or insert malicious USB drives into employee computers. Endpoints are prime targets. Attackers are highly familiar with the behavior and blind spots of common EDR products, and they develop sophisticated malware specifically designed to evade detection.

3. Lateral movement: Restrict internal freedom and block deeper access

Once attackers gain access to internal systems, they do not immediately reach the company’s most critical information or systems. Instead, they move throughout the network in search of higher privileges and valuable information that enables deeper infiltration.
One effective defense at this stage is network segmentation, which divides the environment into smaller, isolated sections.

For example, financial institutions are required to strictly separate core banking systems from employee networks, applying strong access control to prevent movement between them. In many other industries, however, executives and general employees operate on the same large network. Without sufficient segmentation, attackers can freely reach critical systems and sensitive information once inside.

NDR (Network Detection and Response) can also be highly effective because it detects unusual communication or behavioral patterns within internal networks. However, compared to the adoption of EDR, NDR usage remains low among Japanese companies, which in turn grants attackers greater freedom of movement after intrusion.

Even companies that adopt a Zero Trust approach, which assumes the inevitability of an unauthorized breach and therefore requests user verification, cannot assume they are fully protected. Zero Trust makes lateral movement more difficult because systems connect through separate internet paths. However, if attackers succeed in stealing authentication credentials, they can still attempt access from the outside. In this sense, Zero Trust has clear strengths and weaknesses, and a fair assessment is that it is better than traditional models but still imperfect.