Most breaches start with unpatched VPN equipment, account takeover through contractors, or misconfiguration. We looked for companies that can turn more attacks straight into more sales. We described them to Katana's AI, which drafted the conditions and read annual reports to sort out cybersecurity stocks, firms whose main business is security, among companies with growing sales and operating profit. Two were supported.
Japan's National Police Agency counted 123 ransomware reports in the first half of 2026, a record for a half year. Of the 36 cases with a known entry point, 18 came through VPN equipment and 9 through remote desktop: three in four used a door from the outside into the company network.
In September 2026, Japan's Digital Agency disclosed that about 246,000 personal records may have leaked from GSS, a shared government platform. An intruder exploited a VPN vulnerability and accessed files with a maintenance contractor's account.
On October 5, Osaka Metropolitan University disclosed a ransomware attack that stopped about 500 servers and encrypted most of its backups; the entry point has not been disclosed. Since late September, a string of web services have also reported break-ins, many through vulnerabilities in web software.
The disclosed causes are mostly mundane: missing patches, hijacked accounts and misconfiguration.
More attacks mean more inquiries for the companies that defend against them. Whether that turns into higher sales and profit depends on how each company earns its money.
Services delivered by people, such as monitoring and consulting, need more staff hired and trained as work grows. Costs rise with sales, and a staff shortage caps how much work they can take on.
Companies that sell a system, such as software rented through the cloud, can add contracts with few new staff. Rising demand should flow more directly into sales and profit.
So we used Katana's financial data and annual reports to find security-focused companies whose costs need not rise in step with demand.
“Cyberattack damage now comes mainly from unpatched VPN equipment, account takeover through contractors, and misconfiguration. We want companies whose sales and profits are growing by capturing demand for these countermeasures, and whose sales and profits would keep growing if that demand rose further. Limited to companies whose main business is security products or services for other companies.”
Entered in Japanese; English translation.
We entered this profile in Japanese in Katana's AI search. To the conditions the AI drafted, we added a word condition on the business description (any of eight security terms), which left 30 companies for the AI to read.
Katana computes its metrics for every company.
AI reads each annual report and judges support and counterevidence.
The AI reads the questions in order and stops at the first one with counterevidence. Internal use, incidental sales and future plans do not count.
read the filings and supported two companies.
Of 30 companies, two were supported, 16 need review and 12 had counterevidence. Nearly every security specialist passed the first question on main business. The second question was narrowly worded: even HENNGE, a multi-factor authentication provider, fell short. Below are the two supported companies and four that split.
Its main service detects, blocks and visualizes attacks on web applications from the cloud.Filing ↗
Acquired Firmus, Malaysia's largest cybersecurity company, in November 2024.Filing ↗
Its main service, HENNGE One, is billed as an annual flat-fee subscription.Filing ↗
Develops, makes and sells its own cybersecurity products and services.Filing ↗
A cybersecurity company built around education and consulting for mid-sized firms.Filing ↗
Offers single sign-on and multi-factor authentication as part of its HR software.Filing ↗
This report is based on annual securities reports as of October 7, 2026.
If the causes are mundane, so are the fixes: find vulnerabilities, add a second login factor, check settings. Our questions picked companies built on those products, then asked whether profit would rise with demand.
The third question split them. Companies selling their own cloud or monthly services were supported; one delivering education and consulting through people got counterevidence.
| Company | Q3 | Revenue 3y CAGR | Op. income 3y CAGR | Op. margin |
|---|---|---|---|---|
| Cyber Security Cloud | Supported | +30.7% | +41.9% | 21.7% |
| Amiya | Supported | +25.7% | +58.6% | 17.7% |
| HENNGE | Supported | +24.6% | +57.1% | 16.4% |
| Global Security Experts | Counter | +25.6% | +44.8% | 20.3% |
On three years of numbers, the people-driven firm grew just as fast, so no gap shows yet. What we looked for are companies built to turn a further rise in demand, as attacks continue, into sales and profit.
Figures are results up to the latest annual report and do not indicate future sales or profit.
Katana narrows companies with its own metrics, and AI reads annual reports to judge qualitative conditions. For complex theses and company profiles, the selection you used to do one company at a time, AI now runs across the Japanese market.
Open the screenerMore examples
Recurring revenue, across Japan Data center construction stocks, across all of Japan Land-based aquaculture stocks, across all of Japan Japan's HALO stocks, found across the whole market Shipping stocks that profit from the tanker spike