Japan adopts emergency cybersecurity package built around AI vulnerability hunting and new response teams

Japan's government has adopted an emergency cybersecurity package in response to a series of data breaches at companies and public bodies. It was approved on November 6 at the second ministerial meeting on cybersecurity, chaired by Prime Minister Sanae Takaichi, less than two weeks after she ordered it at the first meeting on October 26. According to the Associated Press, Takaichi said a rapid response is essential in an era of AI-generated attacks.

AI moves to the centre of defence

The government's summary is organised around four pillars, and the first is about AI: make basic security hygiene routine for every organisation, and use AI to find and fix weaknesses before attackers do. In practice, ministries must take an inventory of their systems' components, and AI-based vulnerability diagnosis of government systems is being brought forward. Local governments are asked to run AI diagnostics too, with support teams covering all municipalities.

Several new bodies are planned. The Information-technology Promotion Agency (IPA), under the Ministry of Economy, Trade and Industry, is to launch a "Top Gun" talent team in November to expand penetration testing, including by private firms. AP reports that its members will use AI to counter hackers and will work with advanced AI developers from friendly countries. Japan's AI Safety Institute will be strengthened to evaluate and share findings on the cyberattack capabilities of high-performance models, in coordination with the UK's AISI. The National Institute of Information and Communications Technology is beginning to build an environment to reproduce and analyse attacks carried out by AI agents. The government also plans to work with frontier AI companies and overseas tech firms to obtain attack data and undisclosed vulnerabilities early.

Responders, funding and gaps

The package also adds human capacity: a public-private rescue team for initial response at victim companies, an outreach team for at-risk organisations, a police unit for fast evidence preservation and multi-ministry expert teams for serious incidents. AP adds that the government will make wider use of active cyber defence, which lets authorities access servers used by attackers.

AP and Impress Watch put the funding at 10 billion yen (about $63 million) drawn from reserve funds. The official summary, still marked as a draft, gives no budget figure. It also leaves open which AI models or vendors will be used, and on what terms. A Nikkei report from late October that Tokyo had sought wider access to Anthropic and OpenAI models is not addressed in the documents reviewed.