Japan's recent cybersecurity findings raise a question worth asking: Why are your protected systems visible to attackers? Why not make them invisible?
On November 6, Japan announced a ¥10 billion ($63 million) emergency cybersecurity package following a series of cyberattacks and data breaches.
But another recent report from Japan caught my attention.
On October 21, Japan's JPCERT/CC published an investigation into attackers using AI to scan for vulnerabilities and attack exposed APIs. Investigators also found attackers analyzing mobile applications to identify backend APIs, then probing those services for weaknesses.
Attackers are getting faster at finding and exploiting exposed systems. Meanwhile, security teams still need to investigate vulnerabilities, test fixes, and schedule updates.
The attackers don't have maintenance windows. We do.
Keeping thousands of systems patched across different networks and locations is difficult enough. Add AI agents, autonomous systems, and infrastructure operated by different organizations, and it becomes even harder.
Patching remains essential, but we can't assume every vulnerability will be fixed before somebody tries to exploit it.
So why leave protected systems publicly reachable when they don't need to be?
Some applications and APIs must be publicly accessible. But anything exposed to the internet should be designed to contain as little of value to an attacker as possible. Sensitive data and critical backend systems should remain protected, with tightly controlled connections to the public-facing services that need them.
A public-facing application might need information from a database. Fine. But that shouldn't give it broad network reachability to everything else.
At Atsign, we've flipped the traditional model of connect first, then authenticate. We authenticate first, then connect. If you're not authenticated and authorized, you can't establish a connection to the protected service.
There's no publicly exposed inbound port for attackers to discover and probe.
And organizations can control which systems are allowed to communicate, limiting the potential damage if one is compromised.
Of course, a compromised application could still misuse an authorized connection. Application-level permissions, monitoring, and patching remain necessary.
But reducing exposure and restricting communications removes opportunities for attackers to probe systems and move between them.
I discussed this at Smart City Expo World Congress in Barcelona recently.
When you're managing thousands of devices, sometimes owned by different organizations, there's no practical way to guarantee they're all patched all the time.
But if protected systems aren't directly reachable from the internet, attackers can't simply discover their inbound services through a scan and start probing them.
That buys security teams time to address vulnerabilities without unnecessarily exposing the systems they're trying to protect.
As more AI agents connect to applications, data, and other systems, controlling these communication paths becomes even more important.
We can't patch everything immediately. But we can change how systems connect. Authenticate first, then connect. Keep protected systems invisible to public internet scanning, and limit what an attacker could reach if a public-facing service is compromised.
That's a much better starting point.
Sources and further reading
