SHIFT Launches AI-Powered Third-Party Security Assessment Service
for Japan’s Public Sector
Combines AWS Security Agent, Amazon Bedrock and 250+ security specialists to support government agencies and municipalities from vulnerability assessment
through remediation verification

TOKYO, November 11, 2026 — SHIFT Inc. (TSE Prime: 3697), a provider of business transformation services rooted in quality, today announced the launch of its “Third-Party Security Assessment Service for the Public Sector.” The service helps Japan’s central government ministries, local governments and other public bodies find vulnerabilities in their systems and keep them secure over time, combining AI-powered source code analysis and autonomous penetration testing with validation by SHIFT’s security specialists.

Built on AWS Security Agent and Amazon Bedrock, the service is delivered in accordance with the Common Standards Group for Cybersecurity Measures for Government Agencies and Related Agencies (the Common Standards) and DS-221, Japan’s Digital Agency guideline on vulnerability assessments for government information systems. SHIFT’s specialists validate the AI-generated findings, trace attack paths from an attacker’s perspective, and set clear remediation priorities.

As an independent third party, separate from the vendors that build and maintain these systems, SHIFT goes beyond testing: it evaluates vendors’ remediation plans, retests fixes to support acceptance, and provides continuous vulnerability management. Drawing on more than 15,000 security engagements*, SHIFT aims to help public agencies raise the quality of systems subject to stringent security requirements and build sustainable security programs.
* As of December 2025
– Service Introduction Page: https://contents.shiftinc.jp/government/service/vulnerability-assessment/

Background
Cyberattack methods are rapidly becoming more sophisticated and complex, partly due to the malicious use of generative AI. Consequently, the threats to critical information and social infrastructure held by public bodies such as central ministries and local governments have reached an unprecedented level. In response, there is a growing demand for the systematic implementation of vulnerability assessments and strict management in public systems, based on the country’s Unified Standards and the Digital Agency’s “DS-221.”

However, on the front lines, organizations face difficulties handling these tasks internally due to a shortage of specialized personnel and tools. Additionally, obtaining an objective evaluation of remediations from a perspective other than the parties responsible for system development or modification is challenging, leading to issues in judging technical validity. Furthermore, managing progress across multiple systems and vendors, as well as reporting to related agencies, has become a significant burden.

To overcome this situation, it is essential to establish a framework that not only conducts comprehensive assessments using AI technology for cyber defense but also consistently ensures the technical validity of remediations from a neutral standpoint with no conflict of interest with the target system’s development vendor. To contribute to the establishment of effective security measures and robust governance in public systems, SHIFT is launching the “Third-Party Security Assessment Service for the Public Sector.”

Service Features
A Hybrid Model Combining AI with 250+ Security Specialists
SHIFT incorporates “AWS Security Agent,” which autonomously verifies attack paths from an attacker’s perspective, and “Amazon Bedrock,” which deeply understands and infers the context and logic of source code, into the assessment process. The assessments are conducted in compliance with the Common Standards and DS-221. The comprehensive and high-speed detection results generated by AI are scrutinized and judged by over 250 security engineers at SHIFT, achieving highly accurate and effective analysis while minimizing false positives.

High Quality, Cost-Effective, and Rapid Assessments Based on 15,000+ Engagements
By utilizing AI and standardized know-how cultivated through more than 15,000 cumulative security support projects—including those for finance, critical infrastructure, and large-scale business systems—SHIFT delivers highly cost-effective services while maintaining high quality. Additionally, if a critical vulnerability is detected, SHIFT provides an urgent preliminary report in as little as one day, even during the assessment period. SHIFT offers a diverse menu of services, including autonomous penetration testing and source code analysis using AWS Security Agent, as well as web application assessments, platform assessments, and cloud assessments.

Objective Acceptance Support for Vendor Remediations from a Third-Party Perspective
Going beyond mere vulnerability detection, SHIFT technically evaluates whether the remediation plans proposed by the vendor (permanent, interim, or compensating controls) address the root causes. Furthermore, SHIFT conducts retesting as a third party to confirm the resolution of vulnerabilities, software regressions introduced by the fixes, and whether the same flaw exists in similar components (variant analysis), and documents technical findings to support defect-liability (warranty) discussions with the vendor.

Diverse Add-on Services to Help Build Continuous Vulnerability Management Frameworks
SHIFT offers add-on services such as “On-Demand Assessments” conducted for every system release or modification, and “Continuous Monitoring (S4/ASM)” for constant surveillance of internet-facing assets and OSS. Additionally, SHIFT supports “Procurement Requirement Preparation” compliant with the Digital Agency’s “Security by Design Guidelines for Government Information Systems” (DS-200) to incorporate security requirements into the next procurement specifications, as well as the provision of training programs to cultivate staff security skills. Through these diverse add-on services, SHIFT consistently supports the establishment of sustainable security governance.

Service Delivery Flow
(1) Planning: Inventory system assets and formulate an assessment plan compliant with “DS-221.”
(2) Assessment Execution: Run assessments using AWS Security Agent and Amazon Bedrock; specialists review the results.
(3) Result Analysis and Reporting: Rate severity using CVSS and propose response priorities (Tiers).
(4) Reporting and Remediation Verification and Acceptance Support: Help prepare reports for internal audiences (executives and CISOs) and the National Cybersecurity Office (NCO), and ensure acceptance through the evaluation of remediation plans and retesting.

– Service Introduction Page: https://contents.shiftinc.jp/government/service/vulnerability-assessment/
– Inquiries regarding the service: https://contents.shiftinc.jp/government/contact/

About SHIFT’s AWS-Related Business
In response to customer needs, SHIFT fully launched its Amazon Web Services (AWS)-related business, focusing primarily on the public sector, in February 2024. Through its cross-company organization “AWS CCoE,” SHIFT has steadily strengthened its organizational structure, promoting human resource development and operational systematization. In August 2026, in recognition of its strategic approach and results thus far, SHIFT received the Special Award at the “2025 Japan AWSome Business Leaders Award.” Moving forward, SHIFT will continue to improve and expand its technological infrastructure and services, contributing to the secure infrastructure construction and application development required in the AI era.

Major Certifications Held
– AWS Advanced Tier Services Partner
– AWS 400 APN Certification Distinction
– AWS WAF Partner
– AWS In-house Development Support Partner
– AWS Foundational Technical Review (FTR) for Service Offerings:  Certified for “AWS Security Assessment”

Major Support Case Studies
– KDX ST Partners Inc.
Built a highly complex next-generation AWS infrastructure that holds the key to AI-driven development. Achieved both an increase in development speed and risk control.

https://service.shiftinc.jp/case/kenedix-st/

– Shinagawa City Office
Launched a proof-of-concept (PoC) for contact center automation utilizing AI agents.
https://www.shiftinc.jp/news/20260227_shinagawa_ward/