AI Is Now the Battlefield: What NTT's Matsubara Says About Cyberattacks in Japan, And What It Means for the Future of AI

When a company that runs some of the world's largest networks and data centers starts talking openly about cyberattacks, it is worth paying attention. That is exactly what is happening now, as NTT's Matsubara weighs in on the state of cyberattacks in Japan. The message is not a simple "attacks are up." It is something more important: the nature of the fight has changed, and artificial intelligence sits right at the center of that change.

Japan has spent years building one of the most connected, most automated, and most digitally dependent economies on the planet. That is a strength. It is also an attack surface. And as someone with a front-row seat to the country's network infrastructure, NTT's perspective on the threat landscape carries weight far beyond Japan's borders. What happens in Japanese enterprise security tends to preview what happens everywhere else a few years later.

Here is the big picture: AI has stopped being a security add-on. It has become the terrain itself. Attackers use it to scale. Defenders use it to keep up. And the organizations that treat AI as a nice-to-have in their security stack are the ones most likely to end up in a headline they did not write.

Why Japan Became a Prime Target

Japan's cyber risk profile is unusual, and it comes from success rather than failure. The country has a dense concentration of manufacturing, finance, logistics, and critical utilities, sectors where a single disruption ripples outward fast. Its supply chains are deeply interlinked, meaning a breach at a mid-sized parts supplier can quietly reach a global automaker or an electronics giant.

There is also a demographic dimension. Japan's workforce is aging faster than almost anywhere else, and a shrinking pool of IT and security professionals has to defend an expanding digital estate. Automation becomes not a luxury but a survival strategy. That is precisely the gap AI is being asked to fill, and precisely the gap attackers are learning to exploit.

On top of that, Japan's long-standing reputation for physical safety and social trust can create a false sense of digital security. Organizations that have never suffered a major incident are often the least prepared for one. Complacency is a vulnerability that no patch will fix.

AI Has Rewritten the Attacker's Playbook

The most significant shift in the threat landscape is not a new piece of malware. It is speed and scale. AI lets attackers generate convincing phishing messages in flawless, natural language, tailor them to a specific employee at a specific company, and do it by the thousand. The old tells, awkward grammar, odd formatting, generic greetings, are disappearing.

Beyond phishing, AI is automating reconnaissance. Tools can scan far more targets, map networks, identify weak points, and adapt in real time. Deepfake audio and video raise the stakes for identity verification, especially in finance where a convincing voice on a phone call has historically been enough to authorize a transfer. Attackers no longer need to be technical experts; they need access to a model.

The result is a lower barrier to entry and a higher volume of attacks. Small and mid-sized organizations that were never worth a sophisticated attacker's time are now worth an automated one's bandwidth. This is the core insight behind the current conversation: the economics of attack have flipped. Offense has gotten cheap. Defense has not gotten cheap enough, yet.

NTT's View: Defense Has to Be AI-Native

The takeaway from NTT's framing of the problem is that bolting AI onto an existing security stack does not work. Legacy defenses were built for a world where a human analyst could triage alerts one at a time. Modern environments generate more signals per hour than any team can read, and AI-generated attacks move faster than human response cycles.

What that points toward is an AI-native security posture, systems where models monitor network behavior continuously, spot anomalies that no rule was written for, and contain threats automatically. NTT's vantage point as network and data center operator matters here, because detection quality depends heavily on visibility. You cannot protect traffic you cannot see, and a great deal of the world's traffic flows across infrastructure that NTT helps run.

Three principles are emerging as the foundation of this approach:

• Automate the response, not just the detection. Finding a breach is only half the job. The window between detection and containment is where damage is determined.
• Learn normal, not just bad. Rule-based systems fail against novel attacks. Behavioral models that understand what "normal" looks like for a specific network can flag deviations no signature would catch.
• Keep humans on the decisions that matter. AI handles volume and speed. People handle judgment, ethics, and the calls that carry legal or operational weight.

The Critical Infrastructure Question

The highest-stakes part of this conversation is critical infrastructure, power grids, water systems, transportation, hospitals, telecoms. These systems were historically isolated. Many are now connected for efficiency and remote management. Every connection is a door.

Operational technology was never designed with adversarial networks in mind. It was designed for reliability. Retrofitting security into systems that must never stop running is a slow, expensive, and delicate job. AI can help by modeling anomalies in industrial control environments without disrupting operations, but it cannot substitute for the harder work of segmenting networks, removing unnecessary access, and knowing exactly what every connected device is.

This is where the AI conversation stops being abstract. A model that misreads normal maintenance activity as an attack can cause real-world disruption. False positives in an industrial setting are not an inconvenience; they can be dangerous. That means the future of AI in security is not just about smarter models, it is about trustworthy ones, with clear limits and human oversight built in.

The Supply Chain Is the Weak Point Nobody Owns

One theme that runs through any serious discussion of Japanese cyber risk is the supply chain. Large enterprises have invested heavily in security. Their suppliers often have not. Attackers know this and go where resistance is lowest, then ride the trust relationship inward.

AI changes the supply chain problem in two directions. It makes supplier risk easier to monitor at scale, continuously scoring vendors based on observable signals rather than annual questionnaires that go stale the moment they are filed. But it also makes supply chain attacks cheaper to launch and harder to attribute.

For businesses, the practical implication is direct: your security posture is now determined by the weakest vendor in your chain, and that vendor is probably using AI tools you did not approve. Contract language, access control, and continuous monitoring all need to be updated for that reality.

What This Means for Businesses Right Now

For leaders trying to translate this into action, the priorities are clearer than the noise suggests.

1. Treat identity as the new perimeter

Most modern intrusions begin with stolen credentials or a convincing impersonation. Strong authentication, least-privilege access, and verified out-of-band confirmation for high-value requests are no longer optional. Deepfakes are raising the bar for what "verification" means.

2. Instrument everything

AI defense is only as good as the data feeding it. Logging, network visibility, and telemetry are the foundation. Organizations with blind spots get blind models.

3. Measure time-to-respond, not just time-to-detect

A common failure pattern is fast detection followed by slow action. Set targets for containment and rehearse them the same way you rehearse disaster recovery.

4. Govern the AI you deploy

Every AI security tool must have defined limits, human escalation paths, and auditability. A model given authority to block traffic or disable accounts needs guardrails and accountability.

5. Include the AI you use elsewhere

Copilots, coding assistants, and customer-facing chatbots are all part of the estate. They can leak data, be manipulated, or be weaponized. Security planning that excludes them is incomplete.

The Talent Gap Is the Real Bottleneck

No amount of tooling removes the need for skilled people. Japan's security talent shortage is well known, and AI does not fix it, it changes what those people do. Rather than watching dashboards, analysts become supervisors of automated systems: validating model decisions, tuning thresholds, and handling exceptions.

That is a different job and it requires different training. Organizations that invest in upskilling, teaching existing IT staff to work alongside AI systems rather than compete with them, will close the gap faster than those waiting to hire specialists who are in short supply worldwide.

The Trust Layer: Regulation Meets Reality

Japan has been moving steadily toward stronger cyber governance, with expectations of accountability flowing up to board level. AI raises new questions: When an autonomous system makes a containment decision that breaks a business process, who is responsible? When a model is trained on attack data from one environment, how does it perform in another?

These are not theoretical problems. They are the practical friction points that will determine how quickly AI security moves from pilot to production. Vendors that answer them clearly, with documentation, transparency, and auditable behavior, will win enterprise trust. Those that treat AI as a black box will stall in procurement.

The Future: Security Where AI Is Assumed, Not Added

Looking forward, the direction is unmistakable. AI will be embedded in every layer of the security stack, from identity verification to network monitoring to incident response. The organizations that succeed will not be the ones with the most AI tools. They will be the ones that rebuilt their defenses around the assumption that attackers have the same tools they do.

NTT's assessment of cyberattacks in Japan is a useful mirror for the rest of the world. Highly connected economies with aging workforces and deep supply chains are exactly the profile most exposed to AI-accelerated attacks. The lesson is not to fear the technology but to stop treating it as an accessory. Security is now an AI problem, and an AI responsibility.

The companies that move first will not just be safer. They will be freer to adopt AI everywhere else in their business, because they will have built the trust layer that makes adoption possible. In that sense, cyber defense is not a cost center. It is the enabler of everything else AI promises.