Infiltrating Like a Ninja: Unveiling Detection Gaps in Physical Security Across Japan and the U.S.

The talk opens with a social engineering demonstration in which the audience follows a presenter's spoken directions without any real reason to. The speakers, red team members from Sophos and their Japanese colleagues, then frame physical intrusion as a real threat, pointing to ATM jackpotting and state-linked actors that used USB-based devices. They walk through a common physical testing toolkit: a wireless drop device hidden inside a building, a badge cloner, and long-range readers for capturing credentials.

The core of the talk compares technology, process and people in the two countries. Large corporate sites in Japan have security gates and cameras that are about as strong as those in the United States, so the gap is not in hardware. The difference lies in process and culture. In the U.S., staff are trained to challenge unfamiliar people and verify visitors, a habit reinforced by higher crime levels and regular awareness training. In Japan, a cultural emphasis on harmony and a low perceived threat level make staff less likely to question strangers. A cartoon example of a guest pass issued without any verification illustrates how procedural gaps can appear.

The closing message is that both countries are vulnerable to social engineering, based on the team's research. For defenders, the recommendation is to make greeting and verifying visitors a standard, formal process with clear criteria for challenging strangers. For testers, the reminder is that social engineering remains one of the most reliable methods when technical controls hold.