Cyber Security Cloud, Inc.
Strategic Business Division, Public Affairs
Yosuke Kamiyama

Report Summary

• Since around September 2026, there have been a series of data breaches due to unauthorized access at domestic organizations, prompting warnings from organizations such as the National Cyber Security Office and JPCERT/CC. Our observations have also confirmed attacks that use a large number of IP addresses in a short period of time to attempt authentication bypass and data theft.
• This report organizes the measures outlined in the FY2027 budget request from four perspectives: ① implementation and operation of proactive cyber defense, ② response to AI, ③ preparation for the quantum age, and ④ promotion of the domestic security industry and overseas expansion.
• The implementation of proactive cyber defense (under the Cyber Response Capability Enhancement Act and the Act on its Improvement), the development of AI-based defense technologies, and human resource development are designated as priority areas. 8.66 billion yen is requested for practical cybersecurity personnel training, and 6.55 billion yen for AI-based defense technologies. These policy advancements have the potential to boost security measures and investments not only in the public sector but also in private companies.
  

1. Introduction

There have been numerous reports of ransomware attacks targeting businesses and large-scale data breaches. According to the National Police Agency, the number of reported ransomware attacks in Japan during the first half of 2026 reached 123, the highest number for a half-year period since statistics began in the second half of 2020 (*1). Since September of this year, there have been a series of reports of unauthorized access and data breaches targeting domestic organizations, and the National Cyber Security Office, relevant ministries, and JPCERT/CC have each issued warnings this month (*2) (*3).

2. Successive Unauthorized Access and Our Observations

In a research report published by our company in October 2026 (*4), we observed communications related to this series of attacks and confirmed that what appears to be the same attacker used 326 different IP addresses over a period of approximately 40 minutes, making more than 1,200 access attempts on multiple occasions while exploring the possibility of authentication bypass and information theft. Based on the way the attacker switched tactics depending on the content of the response, we believe that this may be an attack using an AI agent or a similar mechanism. If such attacks spread, the automation and sophistication of attacks may progress at an even faster pace than before.

3. Priority areas as seen in the budget request

Attacks targeting supply chains and subcontractors are ranked second among organizational threats in the IPA's "Top 10 Information Security Threats 2026" (*5). Cybersecurity is no longer just a business issue for companies; it is an issue that underpins economic security and the foundation of people's lives, making it urgent to strengthen responses at the national and societal level.

In this context, the budget requests for fiscal year 2027 submitted by each ministry and agency clearly indicate a policy of expanding the budget for cybersecurity-related measures. Understanding which areas the government intends to prioritize investment in is crucial for forecasting future growth areas in the domestic cybersecurity market.

3-1. Implementation and Operation of Proactive Cyber Defense

First, it is noteworthy that the budget request is based on the implementation of the "Act on Strengthening Cyber Response Capabilities and the Act on Implementing the Same," which was enacted last year. This law enables the government to proactively detect signs of cyberattacks and prevent damage, and obligates key infrastructure operators to register specific critical electronic computers and report incidents. Parts of the law will be implemented on October 1, 2026, and the concrete operation of the system is progressing.

In response, requests were made for the establishment of systems within the National Cyber Security Office and the Ministry of Defense/Self-Defense Forces, as well as for strengthening the investigation and analysis infrastructure of the National Police Agency's Cyber Police Bureau. The Ministry of Internal Affairs and Communications also requested 8.66 billion yen (5.6 times the previous year's amount) for the development of practical cybersecurity personnel through NICT (*6). One of the major changes compared to the FY2026 budget is that the implementation of proactive cyber defense has moved from the planning phase to the implementation and operation phase.

3-2. Responding to AI

The Ministry of Internal Affairs and Communications has requested 6.55 billion yen for the development of AI-based defense technologies and the formation of an ecosystem to ensure cyber response capabilities through the collection of threat information using government terminals, etc., of which 2.48 billion yen has been allocated as a request budget (*6). In addition to the advancement of defense using AI, addressing the risks associated with companies' use of AI is also an important issue. In this report, we believe that risk assessment and countermeasures for vulnerabilities and information leaks specific to AI systems are areas where demand is expected to grow in the future.

Furthermore, in the IPA's "Top 10 Information Security Threats 2026," "cyber risks surrounding the use of AI" was selected for the third time as the third-highest threat for organizations (*5). Risks such as unintended information leaks associated with the business use of AI and cyberattacks exploiting AI have been pointed out, making measures to ensure the safe use of AI increasingly important for companies.

3-3. Preparing for the Quantum Age

350 million yen has been requested for demonstration projects aimed at transitioning to PQC (Post-Quantum Cryptography) and utilizing e-seals (electronic proof of issuer) in anticipation of the quantum computing era (*6). In addition, efforts are underway to demonstrate the construction and operation technologies of wide-area quantum cryptography communication networks, and there is a growing emphasis on shifting from research and development of quantum-related technologies to demonstration and implementation.

3-4. Promotion of the domestic security industry and overseas expansion

Another major pillar is the promotion of the domestic security industry and the continued implementation of support for its overseas expansion. The Ministry of Internal Affairs and Communications is continuously implementing the "Support Project for the Overseas Expansion of Digital Infrastructure with Ensured Safety and Reliability." The Ministry of Economy, Trade and Industry has indicated a policy to strengthen the competitiveness of domestic vendors and promote security investment throughout the supply chain through strengthening industrial cybersecurity and supporting startups (*7), and is also working on the establishment of new systems such as the Security Measures Evaluation System (SCS Evaluation System) for strengthening the supply chain.

4. Conclusion

The priority areas outlined in the government's budget request indicate that cybersecurity is no longer merely a national security issue, but is positioned as a crucial foundation supporting industrial competitiveness and business continuity. This policy development is expected to encourage the advancement of security measures and increased investment not only in the public sector but also in private companies, leading to medium- to long-term growth opportunities for the domestic cybersecurity market.

For companies, it is important to view these policy trends as clues to review the priorities of their security investments and human resource development. Moving forward, it will be necessary to closely monitor how the implementation of the system and the results of demonstration projects will translate into concrete measures needed by private companies and strengthen cybersecurity for society as a whole, based on the budgeting process of the budget request.

Reference information

(*1) National Police Agency, "Situation of Threats in Cyberspace in the First Half of 2026"
https://www.npa.go.jp/publications/statistics/cybersecurity/data/R8kami/R08_kami_cyber_jousei.pdf

(*2) National Cyber Security Office, "Regarding responses to incidents such as data leaks due to unauthorized access"
https://www.cyber.go.jp/pdf/press/taiou.pdf

(*3) JPCERT/CC "Warning regarding a series of recent incidents of unauthorized access to domestic organizations"
https://www.jpcert.or.jp/at/2026/at260030.html

(*4) Cyber Security Cloud, Inc. "A series of unauthorized access incidents in Japan may be attacks by AI agents. Over 1,200 access attempts were made using 326 different IP addresses in approximately 40 minutes."
https://www.cscloud.co.jp/news/report/202610099351/

(*5) IPA "Top 10 Information Security Threats 2026"
https://www.ipa.go.jp/security/10threats/10threats2026.html

(*6) Ministry of Internal Affairs and Communications, "Reference Materials for the Estimated Budget Request under the Jurisdiction of the Ministry of Internal Affairs and Communications for Fiscal Year 2027"
https://www.soumu.go.jp/main_content/001089628.pdf

(*7) Ministry of Economy, Trade and Industry, "Regarding the FY2027 Budget Request and Tax System Reform Requests"
https://www.meti.go.jp/main/yosangaisan/fy2027/index.html

*This report is based on publicly available information as of October 14, 2026. The budget figures listed are those at the preliminary request stage for fiscal year 2027 and may be subject to change during the budget compilation process.