The shortage of PMs in security consulting firms is a persistent issue. Consequently, there are many cases where individuals in their 40s and 50s from completely different fields have been entering the industry to handle PM duties and client communications. Since these PMs in their 40s and 50s lack experience in technical areas, consulting, and security, they find the work very challenging. They often join with the mindset of learning through handovers from other PMs. I have also been providing training and handovers to these PMs based on the following content, and the satisfaction levels have been high.

Achieved the highest rating for all clients over 6 years of performing Personal Information Protection Level Evaluation consulting for public institutions (covering various types from central administrative agencies to public enterprises, small-scale public institutions, and local governments), maintained the highest rating for all (continuous consulting experience with the same institutions), and holds a track record of achieving a perfect score of 100 (ranked 1st nationwide). Based on the 2026 manual, it is possible to effectively allocate the necessary tasks and performance records for writing quantitative/qualitative reports considering the strengthened penalties and changed indicators following the Coupang incident. Depending on the company's situation, it is fully possible to be designated as a best practice through either over-investment or strategic passive response.

Insufficient capability to audit new technologies (cloud management systems) due to a lack of theory and knowledge among management system inspection personnel. Training to strengthen the expertise of personnel who proactively prevent incidents by identifying management system deficiencies to protect companies from hacking. Training for existing infrastructure and penetration testing personnel to transition into management system roles. Securing definitive capabilities and materials through the provision of back data!

In cases where there is a lack of experience with electronic financial infrastructure due to only having experience in critical information and communications infrastructure, or where there is a lack of overall understanding of infrastructure projects due to insufficient experience as an Infrastructure PL or PM despite having experience with servers, DBs, networks, and security equipment, it is necessary to secure assessment capabilities for network infrastructure check items and provide assessment back-data.

As PaaS (previously categorized as WEB/WAS) in public and private cloud environments is integrated into in-house PaaS operations, this training is designed for Infrastructure Project Leaders (PLs) overseeing approximately 10 infrastructure inspection personnel, as well as vulnerability assessment specialists. The curriculum covers certification requirements such as ISMS-P, including cloud asset identification, asset classification, importance rating, and risk assessment reflection. It also addresses the 2026 Financial Company Security Standards (for Electronic Financial Infrastructure Vulnerability Analysis and Evaluation), which include the establishment and strengthening of container inspection and private cloud management system inspection items, as well as the addition and modification of virtualization and cloud items within Critical Information and Communication Infrastructure.

Lack of back data for private cloud inspections!! A severe shortage of experienced personnel for IaaS inspections!! Improve practical skills by providing back data and utilize it for various certifications such as Major Information and Communication Infrastructure, Financial Security Institute (FSI) assessments, ISMS-P, ISO27001, etc. Professional training for Infrastructure Project Leaders (PLs) who manage around 10 infrastructure inspection personnel. Providing inspection data and understanding of the technical areas within the cloud management framework!

Providing insights and materials for overall management of penetration testers (WEB, Mobile, HTS) targeted at Project Leaders who oversee financial company mock hacking/penetration testing. Situations have occurred where "blank" reports are repeatedly submitted when no vulnerabilities are found in each part (the same applies to the public sector). Therefore, controls are implemented to ensure that inspection results for each item are produced in the same format as educational materials. Perform inspections tailored to each theme and utilize them for security reviews and internal security deliberations to verify results.

Conducting Windows server competency training to break the trend of new and career-transitioning security consultants focusing solely on Linux servers. Understanding the Windows OS and its relationship with servers and programs installed on the OS, such as PC, WEB, WAS, and DBMS. Understanding vulnerabilities and continuing vulnerability assessment and improvement activities.

Education on the most basic Linux server inspection methods and items due to the continuous assignment of new security consultants for vulnerability assessment and the continuous placement of experienced professionals from other fields into management roles. Risk assessment for risk evaluation (remediation planning) and implementation review. Understanding and application of third-party security solutions. Establishment of the ISMS-P management system through appropriate analysis of technical and administrative domains.

Classification of inspection items and establishment of an inspection plan (strategy) during network inspection Establishment of inspection criteria considering the risk and difficulty of actions Inspection of network service items and strategies for utilizing server access control solutions Command-based inspection after remote network access and preparation of risk assessment reports Interviews with network personnel and application of manual inspection items

A lecture for security consultants who have experience only in Linux, DB, WEB, networks, and security equipment, but lack experience with PCs. Securing response capabilities for cases where PC inspections are replaced by security solutions or conducted via scripts. Categorizing inspection items to prepare inspection strategies and establish response strategies based on inspection experience. One of the business improvements (KPIs) to shorten inspection time and increase accuracy.

Security equipment cannot be inspected using scripts or solutions like databases. Experienced personnel must be assigned. Difficulty in recruiting, including experienced individuals, diligent diagnosticians, or freelancers. Numerous defects found during ISMS-P certification of security equipment; skill levels vary significantly depending on the inspector. Sharing inspection methods and management strategies (methodologies, etc.) for security equipment with those who need them.