Cybersecurity through the attacker’s eyes
Building an organization that can stop attackers even after they get in
Article | 2026-10-13
9 minute read
Executive Summary
- What Red Team testing reveals: having security controls in place does not necessarily mean an organization can stop an attack.
Even with EDR, SOCs and CSIRTs in place, organizations may still struggle to prevent privilege escalation and lateral movement, or to respond quickly when alerts are triggered.
- What organizations should do: start by making their own risks visible.
The risks in the broader threat landscape are not necessarily the risks an individual organization faces. Organizations should first identify their actual risks and the controls that address them, then strengthen detection and response. The order matters: unresolved risks may allow attackers to achieve their objectives before they are detected.
- The goal: prevent attackers from achieving their objectives, even after they get in.
Preventing every intrusion is extremely difficult. What matters is preventing privilege escalation and lateral movement, detecting attacker activity, and stopping it before the final objective is achieved. The logs, detection rules and response knowledge accumulated through repeated testing and improvement can also provide the foundation for future use of AI.
What does your organization’s security look like through the eyes of an attacker? This article explores the blind spots revealed through Red Team testing.
Cybersecurity has moved from an IT issue to a business issue
The risks facing businesses have changed significantly. Alongside labor shortages, geopolitical risk and increasingly complex supply chains, the rapid evolution of AI is driving cyberattacks to unprecedented levels of scale and sophistication.
In a Fujitsu survey conducted in February 2026 among 1,000 CxOs across 10 countries in North America, Europe and Asia-Pacific (*1), the intensification of cyberattacks ranked as the top external threat to business. When it comes to AI adoption, concerns over information leakage and security were also identified as the biggest challenge.
At the same time, organizations are becoming more deeply interconnected through supply chains and cloud environments. A security incident at one company can affect customers, business partners and even critical infrastructure. In its 2026 cybersecurity measures package, “Project YATA-Shield,” the Japanese government also highlighted the importance of executive-led security initiatives and the use of AI.
Completely preventing cyber threats from entering an organization is almost impossible.
At Fujitsu, we conduct Red Team testing using processes similar to those of real attackers. Without receiving advance information from the organization being tested, the Red Team attempts to gain initial access, escalate privileges and move laterally through the environment to determine whether the final attack objective can be achieved.
In our most recent Red Team tests across 22 organizations, we gained initial access to every organization tested. None was able to completely prevent us from achieving the defined attack objective (Figure 1).
* Based on Fujitsu Red Team tests of 22 organizations conducted from January to August 2026. More than half had over 10,000 employees. These results apply only to the organizations tested and do not represent the intrusion rate for organizations in general.
What is particularly striking is that many of these organizations had already implemented security products and established security functions.
In some cases, privilege and access management had not been designed on the assumption that an attacker might already be inside the environment. This allowed access to systems that users did not ordinarily need to reach. We also saw cases where weaknesses in people and processes meant that there were few meaningful barriers to attacker activity after initial access. Even where suspicious activity was detected, organizations often struggled to respond quickly enough.
Frontline teams may already recognize these issues but still be unable to address them because of constraints around staffing, budgets, authority or business impact. Revisiting privilege management and access controls can also require changes to business processes and responsibilities.
Cybersecurity is therefore no longer an issue for the IT department alone. It has become a business issue directly linked to business continuity and enterprise value.
For attackers, initial access is only the starting point
Many organizations patch vulnerabilities and have already deployed security products and services. From an attacker’s perspective, however, the presence of those controls does not necessarily reflect how strong the organization’s defenses actually are. Attackers may combine multiple entry points, including internet-facing systems, employee devices and weaknesses in physical security.
An organization may have no obvious vulnerabilities or configuration errors in its external systems, and its employee devices may be well protected by endpoint detection and response (EDR) and network controls. But that does not mean there is no way in.
When technical intrusion is difficult, an attacker may look for another route. They might enter an office and find a Wi-Fi password displayed on a wall, credentials written on a sticky note, or an unlocked device that provides the next foothold.
Once attackers gain access, they move on to activity inside the organization. At that point, they begin assessing the environment from a different perspective (Figure 2).
For attackers, initial access is only the starting point. They then seek administrative privileges, expand their reach while avoiding detection, and work toward achieving their ultimate objective.
The important question is whether the organization is actually in a position to stop them.
What attackers dislike most is an organization that can stop them
What attackers dislike is an organization where, even after gaining access, they cannot obtain administrative privileges, cannot move freely through the environment, and are detected and stopped (Figure 3).
The difficulty of operating after initial access varies significantly from one organization to another. Two factors that make a particularly large difference are how easily attackers can escalate privileges and how easily they can move laterally.
In many of the organizations we tested, administrative accounts and credentials were not sufficiently protected. In some cases, privilege escalation required little more than finding stored credentials and using them to log in.
Standard employee accounts could also access a surprisingly broad range of resources, while critical systems such as authentication servers existed on the same network. As a result, there were very few cases in which lateral movement was genuinely difficult.
By contrast, in organizations where privileged accounts were tightly controlled and login paths were restricted, or where least-privilege principles and network segmentation were rigorously applied, attackers could still gain initial access but their ability to move was significantly constrained. Escalating privileges and moving laterally became much more difficult.
The other thing attackers dislike is rapid detection followed by rapid action.
During our testing, some organizations did generate alerts in response to our activity. However, in most cases, even when the activity was detected, it did not lead quickly enough to actions such as isolating a device or disabling an account.
From an attacker’s point of view, simply being detected is not the main concern. What matters is being stopped.
Seen through the eyes of an attacker, basic controls such as privileged account management, minimum necessary access and least privilege, network segmentation, and rapid response after detection can create some of the biggest obstacles.
That is because the attacker’s objective is not simply to get in. It is to achieve an end goal, such as deploying ransomware or stealing sensitive information.
How AI is changing both attack and defense
The evolution of AI is also having a major impact on cyberattacks. AI is increasingly being used to support activities such as identifying entry points, escalating privileges and moving laterally through environments.
For example, generative AI can make tasks that previously required a certain level of technical or linguistic expertise easier to carry out. Instructions such as “create malware that is less likely to be detected by antivirus software” or “make this phishing message sound natural to a Japanese recipient” can lower the barriers to carrying out these activities.
More recently, AI systems with strong cybersecurity capabilities such as “Claude Mythos” (“Mythos”), have also emerged. These technologies are making it possible to conduct vulnerability research and identify configuration weaknesses in far less time than would traditionally have been required.
But AI cannot solve every security problem.
Excessive privileges and weaknesses in response after detection cannot be fixed simply by using AI such as Mythos to find vulnerabilities. The priority should be to build an organization in which attackers cannot easily obtain administrative privileges, cannot move freely, and can be detected and stopped.
We believe the use of AI in cyber defense will become essential.
AI may be able to connect individual actions that appear legitimate when viewed in isolation and recognize them as part of a broader attack sequence. But there is an important prerequisite. Organizations need to be collecting the logs required to make attacker activity visible.
AI cannot analyze data that does not exist.
In practice, many organizations are either not collecting the logs they need or are collecting them without making sufficient use of them. AI is not a silver bullet. Organizations must first put basic controls in place and establish effective detection and response processes.
Only once that foundation exists does advanced analysis and defense using AI become a realistic option (Figure 4).
Conclusion: continuous improvement makes organizations stronger
Red Team testing can make previously hidden risks visible. The important question is what the organization does with what it finds.
Improvements need to be addressed across three dimensions: People, Process and Technology. Technology improvements are often relatively straightforward, while changes involving people and processes take more time. Even something as seemingly simple as revisiting administrative privileges may require changes to business processes, roles and responsibilities.
That is why the value of Red Team testing goes beyond identifying technical weaknesses. It also lies in making risk visible and creating a catalyst for the organization as a whole, including executives and business functions, to begin taking action.
The next step is to strengthen detection and response through the Blue Team (Figure 5). Depending on the organization’s level of maturity, this may involve improving log collection and monitoring, refining detection rules, and using threat hunting to proactively investigate and identify potential threats and take the necessary action.
Once detection and response capabilities are in place, the next step is Purple Team testing.
Using techniques employed by attackers and known attack methods, the Purple Team tests the entire process, from log collection and detection through decision-making and response, helping the organization continuously strengthen its response capabilities.
Make risk visible. Strengthen defenses. Improve response.
By repeating this cycle, organizations can move away from trying to become an organization that is never breached, and toward becoming one that does not allow attackers to achieve their objectives even when they get in.
The logs, detection rules and response knowledge accumulated through this process will also provide the foundation for future use of AI.
What matters is the organization’s ability to keep evolving as the threat landscape changes. As attackers become more sophisticated, organizations must keep learning, testing and improving.
That ability to evolve continuously is what will make organizations stronger and more competitive in the AI era.
- *1: Fujitsu CxO Survey Report 2026 (based on a survey of 1,000 CxOs across 10 countries)
Takeshi Sato
Lead of Security Consulting, Uvance Wayfinders
Takeshi Sato has extensive experience in cybersecurity, specializing in attack simulation and countermeasure planning to help organizations visualize security risks and optimize their strategies. After positions involving vulnerability assessment and SOC analysis at a major telecommunications company, he led Red team testing operations and a white-hat hacker team at a global security vendor. In 2025, he joined Fujitsu to leverage his practical expertise in cybersecurity under Uvance Wayfinders and drive the advancement of next-generation security consulting.
Uvance Wayfinders
Consulting by Fujitsu
Uvance Wayfinders helps organizations build cyber resilience through continuous improvement, from identifying risks through Red Team exercises to strengthening detection, response, and readiness through Blue Team and Purple Team practices.
Related Information
The cyber leadership gap: Are we discussing compliance or risk?
Redesigning security through white-hat hacking
Contact us