After its September 2025 ransomware attack, Asahi Group published a list of recurrence measures: removing remote access VPN equipment, rebuilding network routes, segmenting the network, moving to zero-trust style PCs, changing passwords across all systems, and creating an independent security organisation. The list works as a rebuild checklist for any company.
Network and access
Asahi says it removed remote access VPN equipment and other at-risk devices and rebuilt its communication routes. It created a segmented network to limit spread and block unwanted traffic. It also redesigned network controls with tighter connection restrictions, and limited internet facing email and web applications to secure zones.
Your version: list every device that accepts connections from outside, remove what you cannot patch or justify, and separate user networks from server networks.
Identity and endpoints
The company changed passwords across all systems and tightened authentication. It automated account creation, changes and deletion, and moved to dedicated PCs designed for a zero-trust model. It also moved data to central cloud storage to reduce theft risk from individual PCs.
Your version: reset credentials after an incident without exception, keep joiner and leaver processes automatic so old accounts do not linger, and avoid storing important data on laptops.
Detection and testing
Asahi says it enhanced EDR on all PCs and cloud environments, added automated log analysis and monitoring, and conducts penetration testing and threat hunting on an ongoing basis. It also automated cloud security checks.
Your version: decide what you will alert on and who looks at it, and test the controls with an outside party on a schedule.
Recovery
The company rebuilt systems in phases from backups confirmed to be safe, starting with systems verified as resilient, and restored data exchange and email after integrity checks. It lists faster backups, recovery drills and staff training in its measures.
Your version: write the recovery order in advance, keep a known good backup tier that attackers cannot reach, and run a restore drill before you need one.
Governance
Asahi is establishing an independent information security organisation led by a dedicated executive, an Information Security Committee to track risks, revised security regulations with stronger auditing, and a review of the board's skill matrix to strengthen cyber oversight.
Your version: give security a leader with a direct line to the board, and make the board ask about restore times, not only about controls.
What not to copy blindly
This is Asahi's own account of its plan. A list of measures is not proof of outcomes. Choose the items that fit your risks and size, and verify them with testing.
For how the intrusion unfolded, see the Asahi dwell time post.
Where Safeguard fits
Safeguard's compliance and evidence automation can hold the records an auditor will ask for after a rebuild, such as policies and control evidence. It does not provide EDR or network segmentation. A free scan is at gold.safeguard.sh/scan.
Quick check
What did Asahi do about remote access VPN equipment?
It says it removed remote access VPN equipment and other at-risk devices and rebuilt its communication routes.
Is a published remediation list proof that a company is secure now?
No. It shows intent. Outcomes need testing, audits and time.
Sources
- Asahi Group, Measures to prevent recurrence and strengthening the governance system, 18 February 2026
- Asahi Group, Investigation results and future measures, 27 November 2025
Last reviewed: 19 October 2026.
