Tohoku Electrical Safety Association Foundation

Addressing security gaps beyond the endpoint

Operating seven regional divisions and 46 offices across the Tohoku region and Niigata Prefecture, Tohoku Electrical Safety Association Foundation provides inspection and electrical safety services for approximately 55,000 contracted facilities. Protecting customer data and personal information is, therefore, a critical responsibility.

The association had already put in place standard perimeter-based security measures, including firewalls and antivirus software. However, as ransomware and other cyber-attacks surged across Japan, and the government issued a public advisory urging industries to strengthen cyber resilience, the organization recognized the need to further reinforce its security posture.

The association introduced an endpoint detection and response (EDR) solution bundled with a managed security operations center (SOC) monitoring service. This enabled agent-based behavioral detection on endpoints, supported by 24/7 monitoring and incident response from external SOC analysts, including the isolation of compromised devices when required. While this approach strengthened defenses against external threats, concerns remained around internally driven risks, such as policy-violating communications and unauthorized data transfers.

At the same time, cyber-attacks were becoming increasingly sophisticated and faster through the misuse of AI, highlighting the limitations of rule- and signature-based perimeter defenses.

To address both internal and external threats at the network layer, in real time and without human intervention, the association turned to Darktrace / NETWORKTM, which applies a Self-Learning AI approach that continuously models normal behavior and communication patterns across users and devices. By detecting deviations from this baseline, the technology autonomously identifies and contains threats in real time, while also automating investigation, analysis, and Japanese-language reporting.

As Toshinari Kudo, Manager of the Information Systems Group, explained, “With Darktrace’s AI-driven NDR, we would be able to achieve real-time, autonomous detection and the ability to block suspicious communications.”

Demonstrating value through network-level visibility

A proof-of-value(*) was conducted across approximately 3,900 IP-connected devices in the organization’s on-premises environment.

The association operates Darktrace with a small information systems team. Using Darktrace’s web-based Threat Visualizer, network communications and alerts were displayed centrally and in real time, and automatically prioritized based on objective deviations from normal behavior. This enabled the team to quickly focus on meaningful anomalies, and the solution demonstrated its effectiveness by detecting large-scale data uploads by employees that had gone unnoticed by the existing EDR solution.

AI-driven visibility and continuous autonomous detection and containment

Following full deployment in April 2024, the organization gained greater confidence in its security operations. By moving beyond endpoint-level controls to network-wide visibility and autonomous protection, Darktrace’s AI allows potential risks to be identified and addressed holistically, providing reassurance that no critical activity is going unnoticed.

In addition, Darktrace’s Cyber AI Analyst capabilities included with Darktrace / NETWORK automate threat investigation and generates clear, objective incident reports in Japanese. “This has reduced the need for manual analysis and reporting, and has significantly changed how we handle security operations,” Kudo explained.

As a result, the association can operate a hybrid model that combines a staffed SOC with an AI-driven autonomous SOC. From a single interface, they can now centrally monitor and respond to anomalies across all offices, achieving comprehensive oversight without relying on deep specialist expertise or allocating excessive human resources.

“Overall, this has enabled us to establish a broader and more resilient XDR security posture,” Kudo said.

‍

‍