Cyber Security Cloud Announces Vulnerability Management and Multi-Layer Defense Support Policy for the Frontier AI Era

## Cyber Security Cloud Announces Vulnerability Management and Multi-Layer Defense Support Policy for the Frontier AI Era

Global security manufacturer Cyber Security Cloud Inc. (the "Company") has announced that, in response to the notice "On the Request for Short-Term Responses by Financial Institutions, etc. in Light of Threat Changes Caused by Frontier AI" published by the Financial Services Agency (FSA) and the Bank of Japan on May 22, 2026, the structural issues highlighted in this request are shared by all industries, not just financial institutions. Consequently, the Company will fully support customers in their short-term responses across all industries using vulnerability management services, technical resources, and Web Application Firewall (WAF) products provided by the Company and its group companies.

### Overview of the FSA/Bank of Japan Request

The FSA and the Bank of Japan have pointed out that the development of cutting-edge, high-capability general-purpose AI models, so-called "frontier AI," has significantly shortened the period between vulnerability discovery and attack, leading to a possibility that a large number of vulnerabilities and patches could be provided in a short timeframe. In response, they have requested financial institutions to establish a framework for rapid and appropriate responses, including asset management, vulnerability management, patch application, monitoring, and resilience, under the direct involvement of top management.

Among the short-term responses listed, the technical core areas are as follows:

- Identification of priority services/IT systems and resolution of technical debt
- Addition of human resources for patch application
- Risk-based approaches for patch application processes
- Strengthening of multi-layer defense using virtual patches (WAF) when direct patch application is difficult

### A Shared Structural Issue Across All Industries

While this request is addressed to financial institutions, the underlying phenomenon of "massive vulnerability increases and accelerated attacks due to frontier AI" is reaching all businesses operating Web systems regardless of industry.

In fact, in the attack traffic that the Company observes daily in customer environments, the lead time until the exploitation of new vulnerabilities is continuously shortening across all industries.

The FSA/Bank of Japan request can be positioned as a leading example where this "cross-industry structural issue" has been quickly articulated as a regulatory message to the financial sector. For operators in other industries, the four technical response areas indicated in this request are valid as a checklist for their own short-term response plans.

### The Practical Solution: 'Buying Time' with Virtual Patches (WAF)

Regardless of the industry, the greatest constraint for teams during the short-term response period is the time required for fundamental vulnerability resolution. Asset inventory, impact assessment, patch testing in verification environments, and maintenance adjustments for production deployment involve structural lead times that cannot be shortened merely by the efforts of on-site staff.

Meanwhile, due to AI advancements, the time from vulnerability disclosure to attack is continuing to shorten. Attacks arrive continuously while waiting for fundamental solutions.

The reason the FSA/Bank of Japan request specifically mentions virtual patches is that there is currently no practical means to bridge this structural gap other than multi-layer defense via virtual patches. Cloud-based WAF acts to block attacks prior to fundamental resolution, playing the role of "buying time" for on-site staff to proceed with fundamental resolution.

The Company has established a system to provide virtual patches for both on-premises and cloud environments through "Attack Shadan-kun" and "WafCharm."

### Group Response Policy

As a dedicated cybersecurity manufacturer with an extensive track record, including the cloud-based WAF "Attack Shadan-kun" which holds the No. 1 domestic market share, the Company will fully support the response areas indicated in this request through its group product and service offerings, regardless of industry or environment.

Specifically, leveraging its system that can provide "vulnerability management," "human resource supplementation," and "virtual patches (WAF)" in both on-premises and cloud environments, the Company will support short-term responses not only for financial institutions but also for customers in other industries.