Skip to content
OVEL
Photo looking up at cranes in a shipyard

Cyber BCPCyber BCP Mawashitsuzukeru-kun

FDEs build it. AI keeps it running.

Cyber BCP Mawashitsuzukeru-kun automates how you plan, update, and run your BCP. In an incident, an AI agent gives instructions that follow procedures you approved in advance.

Our forward-deployed engineers (FDEs) work inside your sites and lead the rollout. After that, AI keeps it running.

Launch:
October 20, 2026
For:
Large enterprises, mainly in manufacturing
Pricing:
Quoted per engagement
Book a 15-minute consultation

01

The problem

Why factories fall behind

Factories work under three constraints.

  1. They can't stop.Production can't be halted, so measures that need downtime are off the table.

  2. They can't be touched.No one can freely touch control equipment while it runs.

  3. No one is watching.No one on site looks after security.

As a result, factories remain the hardest place to improve security.

A plant at night, with orange smoke and lights reflected on the water

Three reasons plans haven't kept up

  1. Companies have a BCP, but not one for cyberattacks.

    Most BCPs plan for earthquakes and floods. They don't say which operations to restore first, when to shut systems down, or how to decide on disclosure as an attack unfolds.

  2. Plans exist, but no one has turned them into actions.

    A cyber BCP spans IT, business units, and crisis management. With no clear owner, the documents sit untouched, with no updates and no drills.

  3. Plans stop short of the factory floor.

    Most plans stay inside IT. They don't cover the recovery order or fallback procedures for control systems.

02

By the numbers

The current situation in numbers

  • 123

    Ransomware damage reports in the first half of 2026, the most ever for a half-year period.

    Source: National Police Agency, "Cyber Threat Situation in the First Half of Reiwa 8," September 10, 2026.

  • 37 in manufacturing

    Manufacturing led all industries, followed by wholesale and retail (15), information and communications (9), real estate (9), healthcare and welfare (9), and construction (8).

    Source: National Police Agency, "Cyber Threat Situation in the First Half of Reiwa 8," September 10, 2026.

  • Over 80% / under 30%

    More than 80% of affected companies had backups. Fewer than 30% could restore from them.

    Source: National Police Agency

  • 75.8%

    BCP adoption rate among large companies (fiscal Reiwa 7).

    Source: Cabinet Office, "Survey on Business Continuity and Disaster Preparedness," March 2026

Ransomware damage reports by industry (first half of 2026)Ransomware damage reports by industry in the first half of 2026: manufacturing 37, wholesale and retail 15, information and communications 9, real estate 9, healthcare and welfare 9, construction 8. Manufacturing had the most.Manufacturing37Wholesale & retail15Info & comms9Real estate9Healthcare & welfare9Construction8Ransomware damage reports by industry (first half of 2026)Ransomware damage reports by industry in the first half of 2026: manufacturing 37, wholesale and retail 15, information and communications 9, real estate 9, healthcare and welfare 9, construction 8. Manufacturing had the most.Manufacturing37Wholesale & retail15Info & comms9Real estate9Healthcare & welfare9Construction8

03

Service overview

Three modes, from planning to incident response

Cyber BCP Mawashitsuzukeru-kun runs in three modes.

  • Dependency map screen showing how operations (orders, production, shipping), systems (ERP, MES, SCADA), and equipment (PLCs, robots, conveyors) connect, and the path with the greatest impact
    Planning (at rollout)Screens are for illustration.
  • Revision history screen showing the number of revisions and the weeks revised over the past 12 months, with milestones for the first plan, a tabletop exercise, and the annual review
    Updates and operation (normal times)Screens are for illustration.
  • Incident response screen showing incident mode triggered by a suspected ransomware attack, with the steps for network isolation, contacting stakeholders, switching to manual operation, and recovery, and their progress
    Incident responseScreens are for illustration.
ModeWhat AI doesWhat FDEs doWhat you do
Planning (at rollout)Reads your existing documents, generates the BCP, and lists the decisions you need to make.Interview your teams on site and draw out management's decisions.Make decisions and approve.
Updates and operation (normal times)Detects changes inside and outside your company, revises the BCP, and plans and scores drills.Run periodic reviews and drills.Approve revisions and take part in drills.
Incident responseStarts on an alert or report and identifies the scenario. Gives instructions for initial containment, communication, and recovery that follow approved procedures. Tracks reporting deadlines and shows the required steps.—Carry out instructions, handle decisions the procedures don't cover, and decide whether and what to report.

Planning (at rollout)

What AI does
Reads your existing documents, generates the BCP, and lists the decisions you need to make.
What FDEs do
Interview your teams on site and draw out management's decisions.
What you do
Make decisions and approve.

Updates and operation (normal times)

What AI does
Detects changes inside and outside your company, revises the BCP, and plans and scores drills.
What FDEs do
Run periodic reviews and drills.
What you do
Approve revisions and take part in drills.

Incident response

What AI does
Starts on an alert or report and identifies the scenario. Gives instructions for initial containment, communication, and recovery that follow approved procedures. Tracks reporting deadlines and shows the required steps.
What FDEs do
—
What you do
Carry out instructions, handle decisions the procedures don't cover, and decide whether and what to report.

Incident response mode is available within the scope above. AI makes no new decisions. People decide whether and what to report; AI only presents the information.

04

Workflow

Four phases

The work runs in four phases: rollout, requirements, normal times, and incidents. FDEs lead the first two. AI runs normal times. In an incident, AI gives instructions that follow approved procedures. Lessons from each incident go back into the BCP.

Four phasesFour phases: rollout, requirements, normal times, and incidents. Normal times and incidents alternate, and lessons from incidents feed back into normal times.RolloutLed by FDEsRequirementsLed by FDEsNormal timesRun by AIIncidentsAI instructsLessons fed backFour phasesFour phases: rollout, requirements, normal times, and incidents. Normal times and incidents alternate, and lessons from incidents feed back into normal times.RolloutLed by FDEsRequirementsLed by FDEsNormal timesRun by AIIncidentsAI instructsLessons fed back

  1. Rollout (led by FDEs)

    We work on site and build your cyber BCP.

  2. Requirements (led by FDEs)

    Around that BCP, we define an AI agent for your company. We build it to fit your organization, systems, control-system scope, and supplier network.

  3. Normal times (run by AI)

    AI detects changes and revises the BCP. It runs drills and restore tests and reports to management on a regular schedule. People approve the revisions.

  4. Incidents (AI gives instructions)

    AI starts on an alert or report and gives instructions that follow approved procedures. People carry them out and make any call the procedures don't cover.

People decide just two things: what to approve in advance, and anything the procedures don't cover.

05

Onboarding

How onboarding works

How onboarding worksFive onboarding steps: diagnose, review the current state, make the key decisions, generate the BCP, and test with drills. Owners, in order: customer, FDE, management and FDE, FDE and customer, customer and FDE. The first plan takes three to six months.First plan in 3–6 months1DiagnoseCustomer2ReviewFDE3DecideManagement · FDE4Generate BCPFDE · Customer5Test with drillsCustomer · FDEHow onboarding worksFive onboarding steps: diagnose, review the current state, make the key decisions, generate the BCP, and test with drills. Owners, in order: customer, FDE, management and FDE, FDE and customer, customer and FDE. The first plan takes three to six months.1DiagnoseCustomer2ReviewFDE3DecideManagement · FDE4Generate BCPFDE · Customer5Test with drillsCustomer · FDEFirst plan in 3–6 months

FDEs lead the rollout. The first version of your cyber BCP typically takes three to six months. Pricing is quoted per engagement.

  1. DiagnoseYou answer a questionnaire, and we identify what your BCP is missing.

  2. Review the current stateFDEs read your BCP, policies, and system diagrams, interview your teams, visit your sites, and map how each operation depends on systems.

  3. Make the key decisionsWe lay out the issues and options, such as cut-off authority, ransom policy, and restart criteria. Management decides. FDEs facilitate.

  4. Generate the BCPFrom those decisions, we automatically generate the BCP and a decision card, a one-page sheet to read in an incident. FDEs review it, and you approve it.

  5. Test with drillsWe design drill scenarios and measure the results. You take part, and FDEs run the drills.

After onboarding, the plan moves into normal-time operation.

06

Features

Three features

Photo of lit windows in an office building at night

  1. We plan down to the factory floor (OT).

    OT/ICS security is our core business, so we build your BCP to include control systems. An attack may come in through IT, but it's the factory that stops.

  2. It doesn't end once it's written.

    In normal times, AI detects internal and external changes and revises the BCP.

    In an incident, AI starts on an alert or report and identifies the scenario. Its instructions for containment, communication, and recovery follow procedures approved in advance.

  3. You don't need a dedicated specialist in-house.

    After rollout, AI runs the plan, so you can keep your cyber BCP current without a dedicated specialist.

    You still need someone in-house to approve revisions and reports.

07

Safety by design

Five conditions for AI to give instructions in an incident

We believe AI can give instructions in an incident only when five conditions hold. We design around all five.

  1. Instructions follow approved procedures only.AI's job is to carry out the decision card (cut-off conditions, who has authority, reporting deadlines) quickly. It makes no new decisions. Anything outside the procedures, such as paying a ransom or shutting down the whole company, goes to the person in charge.

  2. It runs outside your IT environment.If it sat alongside your internal network and identity systems, an attack would take it down too. It stays available from a smartphone even if every internal system is down.

  3. AI instructions can't be spoofed.We assume attackers will pose as the AI and send fake instructions. Instructions arrive only through pre-registered channels, and recipients can verify that they're genuine.

  4. If AI goes down, the same procedure still works.When AI is unavailable, teams run the same procedure from a paper decision card.

  5. Every instruction and action is logged with a timestamp.The log goes straight into reports, evidence, and post-incident BCP revisions.

Hands holding a tablet showing AI-suggested response steps in front of a factory control cabinet (AI-generated image)

08

How we differ

How this differs from other approaches

There are other ways to build a cyber BCP. Here is how each approach compares with ours.

Other approachHow it worksThis service
Add a chapter to a disaster BCPA cyberattack chapter is added to a BCP written for earthquakes and floods.We rebuild it, control systems included.We rebuild the BCP around how an attack unfolds, including control systems.
Planning support onlySupport ends once the plan is written. Updates and operation are out of scope.After planning, AI keeps it running.After planning, AI keeps running revisions, drills, and reports. In an incident, it gives instructions that follow approved procedures.
All-hazards drafts by AIAI drafts a BCP for disasters in general.We focus on cyberattacks.We focus on cyberattacks, include control systems, and keep the plan running after it's written.
This service
We rebuild it, control systems included.We rebuild the BCP around how an attack unfolds, including control systems.
Other approach
Add a chapter to a disaster BCP
How it works
A cyberattack chapter is added to a BCP written for earthquakes and floods.
This service
After planning, AI keeps it running.After planning, AI keeps running revisions, drills, and reports. In an incident, it gives instructions that follow approved procedures.
Other approach
Planning support only
How it works
Support ends once the plan is written. Updates and operation are out of scope.
This service
We focus on cyberattacks.We focus on cyberattacks, include control systems, and keep the plan running after it's written.
Other approach
All-hazards drafts by AI
How it works
AI drafts a BCP for disasters in general.

09

Track record and company

Track record and company

  • Selected for the accelerator program of GTIE, a startup support platform for university spinouts.
  • Delivered cybersecurity training to 18 companies.
  • Before the company was founded, our founding members supported security projects for government agencies and major telecom carriers. Winner of the Minister of Education, Culture, Sports, Science and Technology Award at the 21st Information Crisis Management Contest (May 2026).
About the company →

Contact

Start with a 15-minute consultation

Tell us about your situation, and we'll outline how we would proceed. Pricing is quoted per engagement.

Book a 15-minute consultation