Several of Japan’s largest banks detected twice as many system vulnerabilities this summer as they did a year earlier, according to Nikkei, prompting regulators and industry groups to weigh proactive service suspensions if patches cannot keep pace with the threats uncovered.

The surge comes as frontier artificial intelligence reshapes the pace of vulnerability discovery across the financial sector, according to Takanori Nishiyama, Senior Vice President for APAC and Japan Country Manager at Keeper Security. Japan’s Financial Services Agency (FSA) and the Bank of Japan anticipated the pressure as early as May, when they asked financial institutions to treat frontier AI as a management issue and to set clear criteria for proactively stopping services.

A government-wide response to AI-era risk

Japan’s response has extended beyond individual banks. The government announced Project YATA-Shield the same month, bringing together 14 ministries and agencies to strengthen defences at financial institutions before extending the work across 15 critical infrastructure sectors. The Japanese Bankers Association has also acknowledged that banks may need to proactively suspend services such as ATMs to protect customer assets.

The FSA and the Bank of Japan have asked financial institutions to delete unnecessary privileged IDs and secure every privileged account with multi-factor authentication, a discipline that identity security vendors argue needs to extend beyond human administrators.

Why privileged access limits the damage

“Once inside an unpatched system, cybercriminals look for privileged credentials and secrets left in code or configuration files,” Nishiyama said. “Japanese financial institutions now run service accounts, API integrations and AI agents alongside human administrators, and each one holds privileged access.”

“The more tightly institutions control privileged access across both human and non-human identities today, the less likely they are to face that choice,” Nishiyama said, referring to the prospect of suspending customer-facing services.

Removing standing privilege and shifting to Just-In-Time (JIT) access that expires once a task ends, Nishiyama argued, limits how far a single breach can spread, whether the compromised identity is human or non-human. Privileged Access Management (PAM) platforms are designed to operationalise this discipline across both human and non-human identities at scale, giving security teams the audit trails, approval workflows and rapid revocation that regulated banking increasingly requires in the AI era.

For enterprises across Asia Pacific watching Japan’s financial sector navigate this trade-off, the underlying lesson is regional: as AI accelerates both the pace of attack and the number of non-human identities operating inside corporate networks, identity security is becoming the deciding factor in how contained a breach stays.