Find the risks attackers see—and build systems that deny them freedom to operate

As cyber incidents surge, security has become a core management issue. According to a survey by Teikoku Databank, more than 40% of large enterprises surveyed have experienced cyberattacks. Many of these companies deploy proven tools end-to-end, and appear to have no obvious vulnerabilities or configuration flaws. And yet, they still get hit.

One reason is that security initiatives often become performative. Implemented without being tested for effectiveness and leaving critical “big holes” unaddressed. What is needed now is a firm commitment to business continuity: revisiting business processes through the “attacker’s perspective,” and redesigning security accordingly.

Uvance Wayfinders, Fujitsu’s consulting arm, includes security professionals with deep frontline expertise. In this conversation, two leaders share what today’s threat landscape demands—and what enterprises must prioritize to close the gaps that still remain.

At Wayfinders, Takeshi Sato leads security consulting and is widely recognized as a cybersecurity professional. In his previous role at a security firm, he spent nearly a decade hacking the systems of more than 200 Japanese corporate clients as a “white-hat hacker ” (an expert engaged by companies to test defensive strength), making hidden security risks visible.

“Large enterprises take security seriously. On the surface, there are no glaring vulnerabilities or configuration errors. They’ve deployed a full set of security products,” Sato notes. “But from an attacker’s point of view, many still look extremely vulnerable. I suspect a majority of enterprises stop at implementation—they don’t evaluate effectiveness. As a result, an astonishing number of companies leave ‘big holes’ in place.”

Supply-chain attacks—where smaller firms are compromised first, then used as entry points into larger enterprises—are often cited as common. But Sato stresses that company size does not necessarily correlate with defensive strength. “Attackers can break in directly. If there are no public-facing vulnerabilities or configuration issues, breaching via exposed servers can be difficult. So where do they go? Endpoints. They enter through endpoints, seize AD (Active Directory, a centralized mechanism for managing internal user privileges), and spread ransomware. From the attacker’s perspective, it’s a straightforward approach—and not particularly difficult.”

Based on his work alongside incident response teams, Sato also notes that breaches are often discovered not internally, but through external notifications or third-party reports. “Many companies don’t notice on their own. That suggests there are cases where damage has already occurred—without them realizing it.”

Satoshi Mihara, who oversees technology consulting at Wayfinders, adds that cybersecurity used to be treated like insurance. “Going forward, countermeasures must assume attacks are happening every day—every second. Even if you suffer damage, you need mechanisms that allow you to restore data quickly from backups and continue operations. And even if attackers gain access, you need to transform into an organizational structure and business processes that are resilient to attack—limiting the contamination of sensitive data and restricting system manipulation.”

In recent years, major incidents have been reported across Japanese enterprises as well. Security has become a central theme in modernization—and it requires redesign, grounded in a determination to continue the business no matter what.

Today’s attackers have unprecedented firepower, using cloud services and AI to amplify their scale and effectiveness. “By using AI to generate variants of malware that succeeded in the past, it has become much easier to evade endpoint detection. AI is accelerating attacks,” Sato explains. In other words: preventing intrusion itself has become extremely difficult. What matters is limiting what attackers can do after they get in.

That is where the “attacker’s perspective” becomes essential. Audit systems from the viewpoint of those trying to exploit them, while taking actions to close the “big holes” described earlier. For Wayfinders this is an important principle—and a key differentiator from approaches that focus primarily on checklists or tool adoption.

“For example, if your environment allows attackers to easily obtain Domain Admin privileges after intrusion, then no matter what defenses you put in place, it’s game over once they’re inside,” says Sato. Common weak points include storing admin credential information on shared file servers; leaving environments exposed to Kerberoasting (an attack that steals service account passwords); or failing to correct weak configurations in the organization’s directory services. “Simply ensuring that these common techniques don’t work against you can dramatically improve security effectiveness.”

The attacker’s perspective also matters when evaluating new solutions. “Sometimes we’re asked about introducing cloud-based ID management solutions to strengthen identity controls. Solutions can improve convenience—but can also increase attack entry points. Instead of outsourcing security to products, tightening the basics—reducing the number of administrators, hardening password operations—can be highly effective on its own,” Sato says.

Security is not “solution-first.” The priority is changing rules and processes from a security standpoint to close gaps. When gaps are closed, even if attackers enter, they are slowed down—buying time to detect and contain them.

“Any measure is better than none,” Sato adds. “But the key is identifying what is truly effective. That’s where the ‘attacker’s perspective’ matters. If common techniques don’t work and there are fewer admins, it becomes much harder to attack.”

As a large enterprise with vast numbers of endpoints and boundaries to protect, Fujitsu positions security as a top management priority. As a result the company can offer customers tried and tested measures that Fujitsu has practiced and found effective internally. This is a major strength. Mihara explains: “We are rebuilding our own security based on the attacker’s perspective. The practical technologies and know-how gained through that work are directly applied in Wayfinders consulting.”

Many consulting firms follow a textbook process, propose mechanisms and tools, and stop there. Fujitsu, by contrast, can support end-to-end implementation—recommendations, deployment assistance, and operational support. Fujitsu also works with most security products in the market and has hands-on technical knowledge.