80% Insufficient Pre-Release Security Measures for AI Services; Measures Still Underway Even After Government AI Security Guidelines Released

ChillStack Inc. (Headquarters: Shibuya-ku, Tokyo; Representative Director: Michiaki Ito; hereinafter "ChillStack"), which supports the challenges of government agencies and major corporations with AI and security, conducted a "Survey on the Actual State of AI Security Measures" targeting decision-makers for their in-house services incorporating AI, receiving 188 responses.

The survey also defined "internal implementation layer" as those who handle AI security measures in-house and "outsourced layer" as those who outsource to external parties, comparing the current status and differences in challenges between these two structures.

[Survey Results Overview]

- Guideline awareness rate is 83.0%, but only 30% have "implemented measures." - Approximately 80% overall are in the "insufficient pre-release measures" category. The top reason is "lack of cost/resources." - Top 3 pre-release measures: 1st "Input validation/filtering," 2nd "Setting resistance to malicious instructions," 3rd "Output validation/filtering." - Implementation rate of regular post-release monitoring: 59.2% for internal implementation vs. 19.1% for outsourcing. - 32.4% of the outsourced layer "cannot grasp" the vendor's security measures. The reason is "lack of time/resources." - AI security measures to be strengthened: "Establishing a system for regular diagnostics" for the internal implementation layer, and "human resource development/acquisition" for the outsourced layer.

[Background of the Survey]

In March 2026, the Ministry of Internal Affairs and Communications released the "AI Security Technical Measures Guidelines." While guidelines for security measures have been provided for companies offering services incorporating AI, it is anticipated that actual implementation varies greatly among companies. Against this backdrop, ChillStack conducted this survey to grasp the actual situation on the ground.

[Detailed Survey Results]

◼️ Guideline Awareness Rate is 83.0%. "Well Understood" is More Than Twice as High in the Internal Implementation Layer Compared to the Outsourced Layer

When asked about awareness of the "AI Security Technical Measures Guidelines" released by the Ministry of Internal Affairs and Communications in March 2026, 83.0% responded with either "well understood" or "somewhat understood." It was found that there is a significant difference in the understanding of the guidelines among personnel depending on whether their company handles measures internally or outsources them (n=188).

◼️ Even Among Those Who Understand the Guidelines, Only 30% Have "Implemented Measures." The Outsourced Layer Shows a Marked Delay in Response

When asked those who understand the guidelines if their company's measures had changed, 30.8% responded that they had "reviewed measures and already reflected them." While 37.5% of the internal implementation layer responded that they had reflected the changes, only 17.3% of the outsourced layer did, indicating a visible delay in response (n=156/those who understand the guidelines).

◼️ Approximately 80% Overall Feel Pre-Release Measures are "Insufficient"

When asked if pre-release security measures were being sufficiently implemented, only 20.2% responded "sufficiently implemented." When combining "generally implemented but not sufficiently," "implemented but feel insufficient," and "hardly implemented," approximately 80% felt some level of insufficiency (n=188).

◼️ The Top Reason for Insufficient Pre-Release Measures is "Lack of Cost/Resources"

When asked for the reasons for insufficient pre-release measures, "lack of cost/resources" was the most common reason for both the internal implementation layer and the outsourced layer.

Looking at the 2nd and subsequent reasons, for the internal implementation layer, "lack of personnel with security expertise within the company" followed at 41.8%, and "too many items to address, making prioritization difficult" at 35.2% (n=91/those with insufficient pre-release measures).

On the other hand, for the outsourced layer, "too many items to address, making prioritization difficult" followed at 33.9%, and "uncertainty about the criteria for what constitutes sufficient measures" at 32.2% (n=59/those with insufficient pre-release measures).

While resource shortages are a common issue, the internal implementation layer's challenges are more focused on personnel, while the outsourced layer's challenges are more related to unclear judgment criteria.

◼️ Top 3 Pre-Release Measures: 1st "Input Validation/Filtering," 2nd "Setting Resistance to Malicious Instructions," 3rd "Output Validation/Filtering."

When asked about security measures implemented before release, "input prompt validation/filtering" was the most common at 46.8%, followed by "setting resistance to malicious instructions via system prompts" at 45.7%, and "output content validation/filtering (setting guardrails)" at 45.2% (n=188).

◼️ Implementation Rate of Regular Post-Release Monitoring: 59.2% for Internal Implementation vs. 19.1% for Outsourcing

When asked about the implementation status of regular security monitoring and risk assessment after release, 59.2% of the internal implementation layer responded "regularly implemented," compared to only 19.1% for the outsourced layer. This suggests that continuous management after release tends to be less robust in the outsourced layer (n=120/internal implementation layer, n=68/outsourced layer).

<Reasons for Not Implementing Regular Monitoring (Internal Implementation Layer) / Partial Excerpt>

- Because the benefits and returns do not justify the cost. - A system is not in place to plan and coordinate regular diagnostics in a way that does not affect actual operations.

<Reasons for Not Implementing Regular Monitoring (Outsourced Layer) / Partial Excerpt>

- An efficient system or workflow for operationalization has not been established. - No internal regulations. - Cost burden and lack of internal personnel/resources are bottlenecks.

◼️ 32.4% of the Outsourced Layer "Cannot Grasp" Vendor's Security Measures

When asked the outsourced layer if they understood the content of measures implemented by vendors, 26.5% responded "not very well understood" and 5.9% responded "hardly understood," totaling 32.4% who could not grasp the content of the measures, highlighting a reality where post-outsourcing management has become a black box (n=68/outsourced layer).

◼️ The Top Reason for Not Grasping Vendor's Measures is "Lack of Time/Resources."

When asked for the reasons for not sufficiently grasping the vendor's measures, "lack of time/resources to confirm" was the most common at 31.8%, followed by "lack of personnel within the company who can judge the content" at 27.3%, and "infrequent opportunities for reporting/explanation from the vendor" at 27.3%. This suggests that a combination of internal resource shortages and insufficient collaboration with vendors creates a situation where understanding is lacking (n=22/outsourced layer unable to grasp measure content).

◼️ 97.2% of the Internal Implementation Layer Implementing Regular Monitoring Respond "Can Adequately Implement Measures."

Among the internal implementation layer who regularly conduct monitoring and risk assessment, when asked if they can implement appropriate measures based on the results, 38.0% responded "sufficiently implemented" and 59.2% responded "generally implemented," totaling 97.2% who can appropriately implement measures (n=71/internal implementation layer conducting regular monitoring).

◼️ AI Security Measures to be Strengthened: "Establishing a System for Regular Diagnostics" for the Internal Implementation Layer, and "Human Resource Development/Acquisition" for the Outsourced Layer

When asked about AI security measure initiatives to be strengthened in the future, for the internal implementation layer, "establishing a system for regular security diagnostics/monitoring" was the most common at 55.0%, followed by "promoting understanding of security measures among personnel" at 47.5% (n=120/internal implementation layer).

For the outsourced layer, "development and acquisition of personnel with security expertise within the company" was the most common at 45.6%, followed by "promoting understanding of security measures among personnel" at 32.4% (n=68/outsourced layer).

The internal implementation layer prioritizes system establishment, while the outsourced layer prioritizes strengthening their human resource base, indicating that the differences in their challenges are reflected in their future needs.

Comment from Michiaki Ito, Representative Director CEO of ChillStack Inc.

This survey revealed that many companies providing AI services are not reflecting guidelines in their actual measures, despite high awareness of them. In the outsourced layer, unclear judgment criteria and a black-box approach due to reliance on vendors are creating gaps in security. In the internal implementation layer, a certain proportion are lagging in measures due to personnel shortages and difficulty in prioritization; while the nature of the challenges differs, the structure of "knowing but unable to act" is common to both layers.

What is particularly noteworthy is post-release management. Threats to AI are constantly evolving, and measures taken at the time of release can quickly become obsolete. Even when outsourcing measures, having a system in place to regularly grasp and verify their content is a condition for effective AI security management. It is considered important to embed a system within the organization that can continuously evaluate and improve risks after release.

Survey Overview

Survey Name: Survey on the Actual State of AI Security Measures

Survey Organization: Freeasy

Survey Target: Individuals with decision-making or selection authority involved in the consideration and implementation of AI security for companies developing in-house services/products incorporating AI.

Survey Method: Web questionnaire

Survey Date: May 25, 2026 - June 3, 2026

Number of Valid Responses: 188

*Percentages for each response item may not sum to 100% due to rounding.

Regarding Citation of Survey Results

*When reprinting or using the content of this survey, please indicate the source.

Example: "According to ChillStack's survey," "Surveyed by ChillStack," etc.

About ChillStack Inc.

◼️ Company Overview

Company Name: ChillStack Inc.

Location: Yoyogi Forest Building 2F, 5-18-20 Sendagaya, Shibuya-ku, Tokyo 151-0051

Founded: November 2018

Representative Director: Michiaki Ito

Corporate Site: https://chillstack.com/

Business Description:

"Supporting social innovation with cutting-edge AI and security technology."

ChillStack provides solutions using world-class AI security technology that comprehensively address the risks associated with the advancement of AI and DX. For corporations, we offer services that support fraud and anomaly analysis and safe AI utilization. We also collaborate with government agencies to advance research and development and social implementation for solving increasingly complex and advanced societal issues.

Award: EY Innovative Startup 2026

<Services> *Partial Excerpt

- Development and provision of "Stena Expense," an AI system that automatically inspects expenses for fraud and discrepancies https://expense.stena.chillstack.com

- Service "Safia" that promotes generative AI utilization through automatic detection of fraudulent use https://safia.chillstack.com

- Development and provision of "Security Diagnosis" that identifies security risks in services https://pentest.chillstack.com

- Research and development of AI security measures, educational business "AI Defense Laboratory" https://jpsec.ai

◼️ Profile of Representative Director CEO

Michiaki Ito

Engaged in research on AI x Security, received the Best Paper Award at the international conference IEEE CSPA 2018 and the Grand Prize at the IPA Security Camp Award 2018. He has won international security contests and has been involved in nurturing next-generation AI security talent, serving as a lecturer for AI security courses at Security Camp 2019 - 2026. Selected for "Forbes 30 Under 30 Asia 2025."

◼️ Recruitment Information

ChillStack is currently seeking individuals who resonate with our mission and vision and are eager to take on challenges together. We are always available for information exchange and casual interviews to help you get to know ChillStack, so please feel free to contact us. We look forward to your applications.

https://chillstack.com/career

◼️ note

ChillStack's note features employee interviews and the story behind the creation of "Stena Expense." Please take a look.

https://note.com/chillstack