Secure SketCH’s cyber rating is a new indicator of risk communication based on facts and benchmarks.

Mitsubishi UFJ Financial Group (MUFG), a leading comprehensive financial group in Japan, is known for its global operations, which include a wide range of subsidiaries, such as banks, trust banks, and securities companies. MUFG is committed to enhancing its risk and governance practices and continues to pursue better management of IT-related risks, especially cyberattacks. To improve security awareness and communication across its global network, MUFG adopted SecureSketCH to better understand the security posture of its affiliates and third-party vendors.

MUFG has set its corporate purpose as "Becoming the power that moves the world forward," and focuses on providing digital solutions in the financial sector. Cybersecurity, especially in the form of IT risks such as cyberattacks, is considered one of their top priorities. SecureSketCH, integrated with the globally recognized security rating system SecurityScorecard, helps the company evaluate cybersecurity risks in its supply chain quickly and automatically. By doing so, it also identifies areas for improvement related to the company’s domain and its security posture.

• CHALLENGE
  • MUFG needed a tool to understand its security posture objectively and improve risk communication.
• SOLUTION
  • In addition to the traditional security checklists used for selfassessment, MUFG adopted Secure SketCH’s automated diagnosis, which supports Japanese language and provides cyber ratings.
• RESULTS
  • Enabled objective understanding of vulnerabilities, patch application frequencies, and security risks based on publicly available data
  • Facilitated clear communication of security risks within the company, using a standardized scoring system and benchmarking against industry standards

Background of the Implementation - 
MUFG’s Search for Objective Risk Communication Tools

Previously, MUFG had in security management. Takahiro Tsuruta, Head of the Risk Management Department, shares:

Risk Management Department: Takahiro Tsuruta 

Selection Criteria - 
NRI Secure’s Expertise and Ease of Use Sealed the Deal

To address these challenges, MUFG began evaluating security rating services to assess cyber defense capabilities. After gathering information on various providers and their track records, MUFG chose SecureSketCH. Takahiro Tsuruta highlights the reasons for this choice:

MUFG also conducted a Proof of Concept (PoC) to evaluate the tool’s usability, including its interface and dashboard. Reflecting on the results, Tsuruta says:

Additionally, when adopting Secure SketCH’s automated assessments, the Risk Management Division appears to have moved cautiously to ensure organizational alignment. Takahiro Tsuruta explains:

In collaboration with SecurityScorecard, we continuously collect and analyze publicly available data, such as internet-facing servers and DNS records tied to domains, enabling objective assessments from a cyber attacker’s viewpoint.

Benefit 1 - 
Objective Risk Assessment and Communication

Since implementing Secure SketCH, the company has been performing automated security risk assessments on over 100 organizations, including MUFG Group companies and third-party vendors. Takahiro Tsuruta described the impact of this as follows:

The Risk Management Division presented benchmarks from SecureSketCH’s automated assessments to company presidents, bank executives, and C-suite members. Reika Sakakibara from the division summarized their feedback.

Risk Management Department: Reika Sakakibara

Benefit 2 - 
Benchmarking Against Industry Standards

As a platform provider in the financial industry, the company faces high expectations from customers and society for maintaining robust risk management standards. Takahiro Tsuruta explained further:

Future Outlook - 
Driving Ongoing Governance Improvements

Lastly, the duo shared their perspectives on the future utilization of Secure SketCH and their expectations for NRI Secure: