1 source 1h ago
BBSec Proposes External Risk Checks as Unauthorized Access Consultations Climb
BBSec is proposing that companies map the assets attackers can see and look for signs of leaked information, after unauthorized access consultations rose from 37.3 percent of its January to July 2026 inquiries to 57.4 percent from August onward.
Reporting from 1 source: ASCII.jp.
Why it matters
BBSec's own inquiry split shows unauthorized access overtaking other incident types in its consultation load, which is why the firm is pushing companies to check what is visible from outside rather than only the systems they know they run.
Key Facts
- BBSec is a security services company based in Shinjuku-ku, Tokyo, led by president Masato Morisawa.
- Unauthorized access rose from 37.3 percent of BBSec inquiries for January to July 2026 to 57.4 percent from August onward.
- BBSec proposes that companies check externally visible exposed assets and signs of information leakage.
- BBSec proposed rechecking basic countermeasures for public web services on October 8, 2026.
- JPCERT/CC's October 23, 2026 update added attack attempts abusing AI-based penetration testing platforms.
The security firm names retail and e-commerce, travel and lodging, transportation, finance, and manufacturing and logistics as the main targets, and asks business owners and IT officers to set priorities together.
BBSec's proposal asks a question many companies skip: what does our network look like from the outside, and has our information already circulated? Checks limited to known internal systems can miss old environments, test environments, and systems run by affiliates and contractors, and a leak can happen without any service outage to signal it. The firm splits the work by industry. Service operators in retail, e-commerce, travel, lodging, and transportation are asked to confirm whether member registration, reservations, purchases, and point functions fall inside the check, along with the websites, apps, APIs, admin tools, and contracted operations behind them. Finance and payment companies are asked to confirm whether their risk management and IT departments can actually see their exposure. The recommendation follows BBSec's October 8, 2026 call to recheck basic countermeasures for public web services.
Written with AI by Yomimono from the 1 cited source below, including Japanese-language reporting where cited. See our editorial policy.
Add Yomimono as a preferred source on Google