CTC Launches Assessment Service That Evaluates Security Measures Along Attack Paths

This is an English translation of the original Japanese press release. In the event of any discrepancy between this translation and the Japanese original, the Japanese version shall prevail.

ITOCHU Techno-Solutions Corporation (President & CEO: Tatsushi Shingu; Headquarters: Minato-ku, Tokyo; hereinafter "CTC") today announced the launch of "CTC Attack Path Quick Assessment," a service developed in-house. The service evaluates a company's security measures along the route an attacker takes from initial intrusion to business damage (the attack path), and identifies gaps and priority issues. Based on the assessment results, CTC provides end-to-end support from selecting countermeasures to implementing them. As a series of data breaches has made it urgent for companies to strengthen security measures, including those involving their business partners, CTC will offer the service to companies working on ransomware countermeasures and rules for AI use.

In "Information Security 10 Major Threats 2026"^※1 published by the Information-technology Promotion Agency, Japan (IPA), "damage caused by ransomware attacks," "attacks targeting supply chains and contractors," and "cyber risks associated with the use of AI" were ranked as the top three threats to organizations, with AI-related risks selected for the first time. Since September 2026, there has been a series of cyberattacks that appear to have been carried out via business partners, and companies are now required to understand the status of security measures across their business partners and contractors. To advance security measures with limited budgets and personnel, it is important to understand the current situation and clarify priority issues.

The service evaluates three areas: ransomware, supply chain attacks, and AI use. Customers answer a questionnaire provided by CTC about the status of their security measures, without having to prepare evidence or other documents in advance.

For ransomware, which has been ranked among the 10 major threats for 11 consecutive years, the service identifies the areas that need to be strengthened at each stage, from intrusion to business disruption. For supply chain attacks, it checks measures against intrusions via business partners and contractors through questions on contractual security requirements, authentication management, and other topics. For AI use, it evaluates usage rules, such as measures against shadow AI and criteria for what information may be entered into AI tools.

The questions are mapped to the ★3 evaluation criteria of the "Security Measures Evaluation System for Strengthening Supply Chains (SCS Evaluation System),"^※2 allowing customers to check their readiness for the system as reference information based on their answers.

The report summarizes key issues and priority policies for management, as well as the basis for each assessment for staff in charge. For each item where measures are insufficient, it also presents recommended countermeasures and reference solutions. The report can be used for internal explanations and budget planning.

CTC independently designed the assessment method and questions by referring to public security frameworks such as the NIST framework and CIS Controls. The process takes approximately one month, from a briefing session for the customer to a debriefing session to explain the results. Depending on the assessment results, CTC supports the preparation of RFPs (requests for proposal), organizing functional requirements for product deployment and the basis for each assessment as procurement requirements, and leading to the consideration of implementation.

CTC will continue to expand its security services and solutions to address increasingly sophisticated cyberattacks, and will contribute to creating an environment in which companies can continue their businesses with confidence.