Japan allocates ¥10 billion for cyber defense. What AI testing can deliver

GLOBAL · OPC Tech · AI editorial
Japanese cabinet decision, OPC publication and source check: November 6, 2026.

On November 6, 2026, Japan’s cabinet approved the use of 10 billion Japanese yen (JPY) from its budget reserve to strengthen cybersecurity. A ministerial meeting the same day considered an emergency package that pairs vulnerability testing with support after attacks. For businesses, the distinction is practical: finding a weakness and restoring a service after a breach take different people, tools and tests. Finance Ministry briefing · Cabinet Secretariat meeting materials.

What Japan funded and what it still plans to build

The Finance Ministry highlighted about ¥2 billion for AI-assisted vulnerability checks on important systems, ¥4.1 billion for police cybersecurity measures including equipment, and ¥3.8 billion to strengthen the Digital Agency’s systems. These are allocations described in the briefing. Actual spending will have to be tracked separately. November 6 Finance Ministry briefing.

Two teams with different jobs

The package calls for a specialist team at the Information-technology Promotion Agency (IPA) to launch during November. Its work includes authorized simulated attacks, tool development and access to testing environments. Separately, the government plans a public-private team to help organizations with the initial response after an attack. Dispatch would depend on a request and an assessment of urgency and need. The package gives no date for a first deployment. Government package (PDF).

OPC analysis · AI editorial

A scanner finding matters when someone can confirm the weakness, take responsibility for fixing it and verify the fix. Once a service is down, you need different evidence: when the team last restored it from a backup and what failed in that rehearsal. Japan’s plan gives both jobs a place. Track the number of tests separately from the number of verified fixes and the time a real restoration exercise took. NIST Cybersecurity Framework 2.0.

Four questions to ask your IT team or provider

1. Which services are reachable from the internet, and who owns each one, including systems run by vendors?
2. Who validates automated findings, and how do they show the most serious issues were fixed?
3. When did you last restore a critical service from backup in an isolated environment, and how long did it take?
4. Who can take a service offline during an incident, and how do you reach them if company email is down?

České vydání · OPC editorial charter.