A security specialist can identify a serious weakness without the people controlling investment ever hearing about it. A recent attack on a Japanese cloud service shows why that gap matters to Norwegian business leaders: customer data and accounts can be exposed while an unresolved warning sits below the level where competing priorities are decided.
The immediate decision is not whether every technical finding belongs in a board paper. It is which unresolved security risks must reach an executive who can allocate resources, change a deadline or stop an unsafe service. The board should agree with management how material exceptions reach it and what evidence closes them.
What GMO has confirmed
On 24 October 2026, GMO Internet said its Onamae.com Desktop Cloud service had security weaknesses, had been accessed without authorisation and had lost customer information. In its 23 October incident update, it said 26,739 servers were potentially affected. That is the number potentially exposed, not the number of confirmed compromises or victims. Customers had reported unauthorised trading activity, and GMO said the investigation into the route and scope was continuing.
At a 2 November press conference, Jiji Press reported, GMO's leadership said an internal security subsidiary had raised system issues in April 2024. The company said its response was insufficient, despite four emergency maintenance operations, and that the matter had not reached group chief executive Masatoshi Kumagai. Jiji reports that management cited service stability and insufficient analysis of competing security priorities.
These are reported statements from the company, alongside its own incident notices. The publicly available notices do not establish that the exact issue raised in 2024 was the route used in the 2026 intrusion. Nor do they establish that AI was used in this particular attack. That distinction matters: the decision failure is important even while the technical investigation continues.
A warning needs a decision, not just a ticket
A ticket can prove that a concern was received. It cannot by itself show that the business understood its potential consequences, gave someone authority to act or checked whether the agreed action worked. Four maintenance operations, as reported in the GMO case, are a reminder to ask what was resolved and what remained open, rather than count activity as a result.
This distinction matters more as AI makes it easier to generate and analyse security findings. The UK National Cyber Security Centre's assessment published 3 November expects AI to increase the speed and scale of existing attack methods and says not every AI-discovered weakness is immediately exploitable. That is an assessment of the broader threat, not an attribution of the GMO incident.
A business needs skilled assessment to avoid escalating every low-quality report. It also needs a way to escalate a credible unresolved issue even when the technical owner cannot finish the work alone. More alerts without a decision process merely add to the queue.
Follow one warning through the company
Consider a hypothetical Norwegian software supplier hosting customer documents. An internal test identifies that an administrative account has broader access than necessary. The supplier cannot immediately change the setup without risking an interruption to customer work. Its technical team has proposed separating the access, but the change competes with a planned product release.
The technical team should document the finding, its confidence, the affected service and any temporary safeguards. The service owner should describe the operational cost of the change and the consequences of waiting. An executive with the necessary mandate should decide which work takes priority and when the decision must be revisited. If customer impact could be material, management should decide how and when to inform customers under the applicable arrangements.
The choices are not limited to “fix everything today” or “accept it forever”. The team might restrict access temporarily, change one group at a time, or schedule a controlled interruption. Each option needs technical validation. A proposed safeguard is not protection until someone has checked that it works, and a restriction that breaks emergency support needs an alternative.
The example is hypothetical. It does not describe GMO's architecture, customers or the actual intrusion route.
The record management should keep
For a material unresolved finding, management can use a short decision record:
- Exposure: the service and customers potentially affected, the evidence and what remains unknown.
- Action: the proposed correction, temporary protection and how each will be verified.
- Decision: the executive responsible, the reason for the chosen priority and resources committed.
- Deadline: the date for completion or a fresh decision, with a named deputy.
- Escalation: the condition that takes the issue to the CEO or board before the next scheduled meeting.
- Closure: evidence that the change works in the affected environment and who checked it.
The record is a proposed management tool, not a legal form or a substitute for a technical risk assessment. Keep exploit details and secrets in the appropriate restricted system. Executives need enough information to decide, not a copy of sensitive attack instructions.
What the board should ask
The board should not approve each patch or become the first destination for every alert. For a material service, it should ask management to demonstrate the route from a security warning to an accountable decision. How many important exceptions have passed their deadline? Which depend on an unavailable specialist or a supplier? What evidence shows a reported fix actually addressed the concern?
For a small Norwegian AS, this can start with one existing risk register and a quarterly review with the IT provider. A more complex group should test whether a subsidiary's finding reaches the executives responsible for shared services and investment. The operating company, the security team and the parent may see different pieces of the risk. Agree who brings those pieces together.
Buying expertise is valuable, but a security specialist's presence does not itself establish that their advice was acted on. Customers should ask their critical providers how material findings are escalated, how exceptions are reviewed and what information is shared when customer exposure changes. NSM recommends including security in supplier follow-up, timely customer notification procedures and incident preparedness. These are recommendations to adapt, not identical new legal duties for all businesses.
For the earlier step, make time to investigate security reports. For the later step, make delayed security updates a management decision. The missing link between them is a decision that the organisation can trace from the person who raised the concern to the person who can resolve it.
Sources checked 3 November 2026. The Norwegian company and decision record are hypothetical. The GMO investigation was continuing in the company notice cited. Management recommendations are the author's analysis. Illustration generated with AI.