Japan has approved an emergency cybersecurity package that will put AI-assisted penetration testers, a rapid-forensics unit and public-private incident responders into the country’s breach response. The government set aside about ¥10 billion ($63 million) for immediate work on November 6, after a wave of unauthorized access and data leaks hit companies and public agencies.
The plan is unusually specific about where Japan’s defenses have failed. In its official summary, the government points to unpatched known vulnerabilities, misconfigured websites, weak application-development security and gaps at contractors. AI is described as an accelerant that lets attackers find and exploit those openings faster and at greater scale, rather than as the underlying cause of the breaches.
Prime Minister Sanae Takaichi ordered ministries to shorten the time it takes for incident information to reach the National Cybersecurity Office. Her target for critical-infrastructure reports is within hours, or at least on the same day. The package also begins moving Japan from warnings and post-incident investigation toward active threat hunting, shared attack intelligence and selective government help inside compromised organizations.
The first cyber teams are due this month
The most immediate new capability is a “top-gun” team at Japan’s Information-technology Promotion Agency, or IPA. The Ministry of Economy, Trade and Industry is expected to establish the group in November. Its job will be to use high-performance AI in penetration testing, train security providers and expand authorized testing beyond government systems to private companies.
Government agencies are also being told to inventory the hardware and software in their systems and bring forward AI-assisted vulnerability assessments. Local governments will be asked to do the same, with a support team intended to cover every municipality. That support matters because the package explicitly includes contractor-run systems and services adopted by individual departments, two areas that can fall outside a central IT team’s normal asset inventory.
Several other operational changes have short deadlines:
- An outreach team is due in November to contact organizations that may already be at risk, check for suspicious activity and arrange threat hunting.
- Police will create a provisional “Fast Forensic Force” to preserve logs and other evidence early in an incident, before ordinary recovery work destroys useful traces.
- Threat-hunting manuals and detection tools are planned by the end of 2026.
- A 24/7 observation network for supply-chain companies is expected to begin testing around January 2027.
- A dedicated National Cybersecurity Office analysis unit, staffed in part with private-sector specialists, is planned for April 2027.
Japan’s AI Safety Institute will also work with the UK AI Security Institute to evaluate the offensive cyber capabilities of advanced models. Separately, the National Institute of Information and Communications Technology is to build an environment that can reproduce and analyze attacks carried out by AI agents.
The rescue squad is part of a three-level response
The public-private “cyber rescue team” has attracted the most attention, but it will not be a general emergency service dispatched to every breached business. The package sets out a response ladder controlled by the National Cybersecurity Office.
When there is only a potential risk, officials can proactively contact an organization and encourage checks or remediation. When the need and urgency for government help are judged to be particularly high, specialists from government and private incident-response firms can be sent to the victim. Incidents that threaten lives, property or national security can trigger a joint team drawn from the National Cybersecurity Office, ministries, police and the Self-Defense Forces.
The rescue-team secretariat is expected by March 2027. Small and midsize businesses get a separate path through an expansion of the existing Cybersecurity Support Team service, which will add recovery, backup and recurring vulnerability-scanning support.
That tiered design gives the government a way to concentrate scarce specialists, but it leaves an important dependency: companies still need to detect an incident, preserve evidence and ask for help unless the new outreach system finds the warning signs first.
Japan wants a domestic exploited-vulnerability list
The package is built around a two-way intelligence loop. Security vendors, cloud providers and overseas technology companies will be encouraged to share attack indicators and vulnerability information through the Cyber Council. A trusted group inside the council is meant to exchange source IP addresses, attack techniques and assessments in both directions, rather than sending reports only into government.
Officials plan to return the analysis in formats aimed at executives, practitioners and the public. The proposed outputs include cross-case analysis of attack methods, disclosure of attacker infrastructure and a Japanese list of vulnerabilities confirmed to be exploited inside the country. That “Japanese KEV” concept could give defenders a more locally relevant patch priority than a general vulnerability score, although the package does not set a publication date.
For serious incidents, ministries will seek reports and relevant logs from affected companies. Takaichi also asked officials to study a broader mechanism that would let the National Cybersecurity Office observe and analyze suspicious traffic hitting private companies, using systems in other countries as references. The legal authority, technical boundaries and privacy controls for that idea have not been settled.
Leaked identity documents are a separate target
The response is not limited to network defense. Japan wants organizations to delete personal data they no longer need and move online identity checks away from uploaded photos of driver’s licenses and other documents. Those images are difficult to replace after a breach and can be reused for fraud long after a password has changed.
The alternative is to read the IC chip in a My Number card or another supported credential. The government’s Digital Authentication Service is due for stronger certificate-validity checks and tighter token handling, while a planned age-check service would disclose only an age or age range instead of a full birth date. The Personal Information Protection Commission is aiming to put revised security-guideline examples into effect in January 2027 and will issue sector-specific guidance on retaining ID images.
What Japanese organizations should prepare for now
The package does not replace ordinary security work; it raises the likelihood that companies will be asked to show that work quickly. Organizations operating in Japan should be able to produce a current inventory of internet-facing systems, contractor-operated services, software dependencies and log sources. They should also know who can authorize a threat hunt, preserve evidence and share incident data with regulators or police.
Four near-term checks follow directly from the government’s diagnosis:
- Verify that known exploited vulnerabilities and internet-facing misconfigurations have owners, deadlines and independent validation.
- Confirm that important logs survive long enough for forensic work and cannot be altered from an ordinary administrator account.
- Review vendors that hold customer data or operate public applications, including their reporting time, evidence-retention and breach-support obligations.
- Minimize stored ID images and old payment or customer records, then document the business reason for anything retained.
The immediate ¥10 billion allocation does not cover the package’s full cost. Takaichi asked the finance minister and other agencies to identify additional funding, while longer-term items such as supply-chain rules, vendor contract standards, post-quantum preparation and possible carrier blocking of sites that distribute stolen data remain under study.
Japan’s plan is therefore both an emergency response and a test of execution. The November deadlines can create real defensive capacity quickly. The larger promise—faster reporting, useful shared intelligence and help that reaches victims before evidence disappears—depends on whether agencies and companies can turn a long list of new teams into one working incident-response system.
