“yamory,” a vulnerability management cloud service operated by Assured, Inc. of the Visional Group, has launched an emergency response plan for information leak countermeasures in response to a government advisory. The move comes amid a sharp increase in unauthorized access targeting web system vulnerabilities and personal information leak incidents.

Key points of the incident: Overview of yamory’s emergency response plan

Assured, Inc., which handles the cybersecurity business within the Visional Group, launched the “Emergency Response Plan for Information Leakage Countermeasures” on October 9, 2026, for its vulnerability management cloud “yamory.” This plan aims to help companies rapidly build autonomous security defense postures against a succession of unauthorized access and personal information leakage incidents. Its main components combine the automatic visualization of risks through a free trial of “yamory” with individualized risk analysis and operational support by expert consultants. By automatically extracting vulnerabilities lurking in corporate IT systems using an auto-triage function and clarifying remediation priorities, it significantly reduces the analysis burden and manual verification man-hours for security personnel. Please refer to the figure below.

Furthermore, dedicated consultants will participate on an ad-hoc basis to tune triage settings according to system configurations and business characteristics. This makes it possible to separate critical risks that must be prioritized for remediation from risks requiring medium- to long-term responses, and to present executive-level analysis reports and response strategies. Provided through the contact desk (sales-yamory@assured.inc), this service offers a framework that enables organizations to efficiently implement robust threat countermeasures in a short timeframe, even with limited human resources.

The government and relevant ministries’ warnings behind the scenes

Behind the rollout of this emergency response plan are coordinated alerts issued by the government and relevant ministries and agencies. On October 9, 2026, the National Cyber Directorate (NCO) of the Cabinet Secretariat published “Responses Based on Incidents Involving Data Leaks via Unauthorized Access,” and on the same day, the Financial Services Agency (FSA) also issued “Strengthening Cybersecurity Measures in Light of Current Conditions and Responses Regarding Various Transaction Applications.” Furthermore, on the preceding day of October 8, Prime Minister Takaichi expressed deep concern during a parliamentary session over the successive personal information leak incidents, announcing a government-led push to strengthen countermeasures and urging private-sector businesses to rigorously enforce security. Currently, incidents involving massive outflows of personal information and customer data due to unauthorized access exploiting web system vulnerabilities and supply chain compromises are surging. The government’s emergency response meetings have specifically demanded measures such as discontinuing the use of legacy products whose support has ended, the prompt application of security patches, and the thorough implementation of multi-factor authentication. However, a prominent challenge has emerged: many companies are unable to accurately assess the vulnerability scope of their internal systems, causing their security efforts to stall due to a lack of specialized know-how.

Specific Features and Operational Support Supporting Visualization and Analysis

The “Emergency Response Plan for Information Leakage Countermeasures” and the feature set of “yamory” comprehensively address the specific response items required by the National Cyber Security Operations Unit of the Cabinet Secretariat. First, toward the proper management of Web systems and server infrastructure, it automatically collects asset information across all layers, including application libraries, host OSes, containers, cloud environments (CSPM), and network equipment. This enables the identification of externally exposed assets using attribute tags and the centralized management of information assets spanning group companies and supply chains. In addition, it supports the detection of vulnerabilities, license risks, and EOL (End of Life) of open-source software (OSS) included in software. Detected vulnerabilities are cross-referenced with a proprietary database and auto-triaged based on severity and exploitability. In this plan, expert consultants create a “Current Risk Summary Analysis Report,” quantitatively visualizing key performance indicators (KPIs) such as the number of unaddressed vulnerabilities, remediation progress, and residual risk. This enables prompt decision-making support for management and ensures reliable corrective actions.

Threat Trends in Web System Compromise and Corporate Defense Strategies

The Recent Successive Personal Information Leaks from Web Systems and the Sharp Increase in Attacks

Cyberattacks targeting web systems have shown a rapid expansion in recent years in both the number of incidents and the scope of targets. According to research by a security organization, the number of publicly announced domestic web compromises reached 62 cases in 2024, 84 cases in 2025, and 119 cases as of early October 2026, totaling over 265 cases. In particular, 81 incidents—accounting for approximately 68% of the total—have been publicly reported in a concentrated manner since July 2026, marking an unusually high frequency of occurrences. While conventional attacks primarily targeted credit card information on e-commerce sites, recent incidents show that targets have diversified into a wide variety of web systems, including membership-based websites, library book search systems, performance ticket refund systems, and university facility reservation systems. Please refer to the figure below.

Rather than advanced zero-day attacks, the methods being attempted through indiscriminate and automated techniques include inadequate API access controls, authentication flaws, and known vulnerabilities (CVEs) in frameworks and CMSs. In many cases, even basic personal information that is difficult to exploit on its own is comprehensively stolen, posing a widespread threat regardless of company size or industry.

Supply Chain Attacks and the Risks of Unauthorized SaaS (Shadow IT)

Alongside individual web system compromises, supply chain attacks and the presence of unauthorized SaaS (shadow IT) are shaking corporate management. In the “10 Major Information Security Threats 2026” published by the IPA (Information-technology Promotion Agency, Japan), supply chain attacks are ranked second in the organizational category, maintaining a top position for four consecutive years. In the 2024 ransomware attack on ISETO Corporation, the impact spread to client local governments and private companies, leading to the leakage of approximately 1.5 million personal information records. Even if a company’s own systems are robust, there is a structural issue where business partners or contractors with lax security measures become entry points. Furthermore, shadow IT unknown to the information systems department, as well as accounts of former employees and contractors that remain undeleted after the completion of their work (ghost accounts), serve as major loopholes for attackers to infiltrate by masquerading as legitimate access. The policy for establishing the “Security Measures Evaluation System for Supply Chain Strengthening (SCS Evaluation System)” promoted by the Ministry of Economy, Trade and Industry (METI) is also beginning to require proof of security controls, including those of business partners, and there is a strong demand for enhanced third-party risk management.

Future Outlook and Key Focus Areas: Ongoing Vulnerability Management Frameworks Required for Enterprises

In an era where cyberattacks are becoming faster and more automated, countermeasures relying on one-off assessments or annual security audits have reached their limits. Moving forward, it will be essential to establish a “continuous vulnerability management system” that constantly visualizes IT assets and vulnerabilities within the company and across the entire supply chain, enabling immediate, risk-based responses. Operational support that fuses risk detection via automated tools with triage analysis by experts—such as the newly launched emergency response plan for “yamory”—serves as an effective solution even for small and medium-sized enterprises with limited internal resources. Furthermore, “yamory” is a domestic cloud service registered on the government’s “ISMAP Cloud Service List,” and is valued as a management infrastructure that meets high security standards. Going forward, the enforcement of multi-layered security hygiene will be emphasized, going beyond mere vulnerability remediation to include the management of Software Bill of Materials (SBOMs), the implementation of multi-factor authentication (MFA), and the operation of immutable backups. Companies are required to build sustainable security governance capable of instantly adapting to changing threats in order to ensure compliance and maintain social trust.

Reference Page

• [Vulnerability Management Cloud yamory Official Website] https://yamory.io/
• [Assured Inc. Official Website] https://assured.inc
• [Cabinet Secretariat National Cyber Directorate: “Regarding Measures Based on Incidents Such as Data Leaks Caused by Unauthorized Access”] https://www.cyber.go.jp/pdf/press/taiou.pdf
• [Financial Services Agency: “Strengthening Cybersecurity Measures in Light of the Current Situation and Responses Concerning Various Transaction Applications, etc.”] https://www.fsa.go.jp/news/r8/sonota/20261009/20261009.html

【#yamory #VulnerabilityManagement #DataLeakPrevention #Cybersecurity #Assured #Visional #ISMAP】