Japan Adopts Emergency Cybersecurity Package With ¥10 Billion

Four pillars

The package points to many cases in which organizations or their contractors neglected the basics: unpatched known vulnerabilities, misconfigured websites and weak security in application development. It warns that AI now lets attackers exploit such gaps quickly and at scale. The plan rests on four pillars: thorough basic measures that also use AI, stronger intelligence gathering and investigation, strategic response to attacks, and better victim support.

Concrete steps include moving up vulnerability testing of government systems and helping local governments run AI-based vulnerability scans. The National Institute of Information and Communications Technology (NICT), which identified the recently problematic "A2B" attacks, will get stronger analysis capacity. The Information-technology Promotion Agency (IPA) plans to start a pilot observation network for supply chain attacks as early as the new year.

On the response side, an outreach team will be set up in November to contact organizations at risk, and a public-private cyber rescue unit will be dispatched to help victims with initial response. Operators of critical infrastructure will be urged to carry out threat hunting, with manuals and detection tools promised by year-end. The government will also take down attack infrastructure and compile measures for compromised domestic devices used as stepping stones.

Faster reporting

Takaichi ordered that information on attacks reach the National Cybersecurity Office within hours, or at least the same day. She also asked for a mechanism, modeled on other major countries, that would let the office detect and analyze suspicious traffic to private companies. For victims, consultation desks will open and about 60,000 digital promotion committee members will receive cybersecurity training.

The government will also study how telecom carriers could block access to abused content, including legal issues. Takaichi stressed that supply chain risk in IT systems and equipment cannot be overlooked.