GRC

Japan’s ¥10bn cyber emergency package: what it means for the UK

Japan pairs ¥10bn emergency cyber funding with rescue teams and active defence. How it compares with the UK’s Cyber Security and Resilience Bill.

Shield graphic with the headline Japan's ¥10bn cyber emergency plan and the label Cyber policy

Japan is tapping its budget reserve for a roughly 10 billion yen emergency cyber package, after weeks of serious breaches at household-name companies and state bodies. The measures pair rescue teams for victims with wider powers to go after attacker infrastructure, and that combination puts the UK’s slower, legislation-first route into sharp relief.

What happened

On Friday 6 November, Prime Minister Sanae Takaichi used a ministerial meeting on cyber security to set out an emergency package worth roughly 10 billion yen, or about $63m. The cabinet had decided earlier the same day to fund it from the fiscal 2026 budget reserve, according to Jiji Press and Kyodo News. Takaichi told ministers that fast response is essential now that attacks are increasingly AI-generated. She said “all government resources” should go into lifting response capability nationwide.

It follows breaches at dozens of companies and agencies; SecurityWeek links it to incidents at So-net, Nikkei, KDDI, Nichirei and the government’s own Digital Agency, among others. MLQ, citing Claims Journal, reports that Takaichi ordered officials on 26 October to draw up emergency measures, giving them about a week.

The detail

Finance Minister Satsuki Katayama set out how the money will be split. About 4.1 billion yen goes to police cyber units for equipment, intelligence analysis and investigator training. Around 3.8 billion yen will harden systems run by the Digital Agency. The remaining 2 billion yen or so will pay for AI tools that hunt for weaknesses in critical government systems.

The package is organised around four teams and one new power:

  • Active cyber defence in practice. Building on the active cyber defence law in force since October, the government will expand pre-emptive access to servers that attackers use.
  • A joint national security team. If national security could be at stake, a combined team drawn from the Defence Ministry, police and the National Cybersecurity Office will be sent in together.
  • A “top gun” expert team. The Ministry of Economy, Trade and Industry is to stand this team up by the end of November. It will use AI to find network weaknesses and counter intruders, working with tech firms and AI developers in friendly countries.
  • A cyber rescue team. Public and private sector specialists will handle the first response at companies that have been attacked.
  • A hardening team. A separate group will help weaker companies harden up in advance.

Inspenet adds further governance measures. It reports that critical infrastructure operators will be expected to report incidents to the National Cybersecurity Office as quickly as possible, so the office becomes the central point for threat data. It also reports that possible blocking of websites used for malicious activity, partly to curb the spread of stolen data, is under discussion, and that revised government security management guidelines due in January 2027 will call for deleting personal data that is no longer needed. Those points are not yet confirmed elsewhere.

Breakdown of Japan's 10 billion yen emergency cyber package: 4.1bn yen for police, 3.8bn for the Digital Agency, 2bn for AI vulnerability scanning, plus new expert and rescue teams

Why it matters for UK organisations

Japan had its active defence law in place before this crisis and has now put emergency money and named teams behind it within weeks. The UK is still waiting for its main new statute. The Cyber Security and Resilience Bill finished its Lords stages on 2 November and goes back to the Commons to consider peers’ amendments. Royal Assent is expected between late 2026 and spring 2027, and most operational duties, including the 24-hour initial incident notification and the 72-hour full report, will only start once secondary legislation sets the dates.

At its annual review launch on 3 November the NCSC warned that UK incident numbers could climb to unprecedented levels. Chief executive Richard Horne said the agency had issued 110,000 Early Warning alerts and other proactive notices about the PHP2Shell vulnerabilities alone. Ministers have also committed £60m to phase one of the Cyber Shield programme, £70m to set up the NERV vulnerability centre, and a 75% discount on Cyber Essentials for smaller firms. What the UK does not yet have is a standing, funded rescue capability for companies in the middle of a crisis.

That gap has already cost money. When Jaguar Land Rover was hit, the government responded with a £1.5bn loan guarantee. Ciaran Martin, who chairs the Cyber Monitoring Centre’s technical committee, warned in March that this was an “unfortunate precedent” because it was case-specific and had no clear criteria. Japan’s rescue team at least defines help in advance.

Expert view

Ten billion yen is modest for an economy of Japan’s size. What stands out is the sequencing: legal authority first, operational teams second, emergency funding to accelerate both. The UK has a mature technical agency in the NCSC and a strong certification baseline in Cyber Essentials, but the bridge between “here is guidance” and “here is someone in your server room on day one” is still mostly left to the commercial incident response market and to insurers.

I would be cautious about envying the active defence element. Reaching into attacker infrastructure is legally delicate and does nothing for an organisation whose own perimeter has been exposed for years. In my experience, the breaches behind headlines like these rarely need a state-level response to prevent. They come down to unpatched edge devices, flat networks, stale accounts and data kept long after it served any purpose. Japan’s reported plan to require deletion of unneeded personal data is, quietly, one of the most useful measures on the list.

The AI-assisted vulnerability hunting is worth watching. Horne’s argument is that AI has not invented new attacks so much as made long-tolerated weaknesses cheap to find at scale. If governments now point the same tools at their own estates, the private sector will be expected to do likewise, and regulators will soon ask why it has not.

What to do now

  1. Write down your day-one support. Do not assume the state will step in. Confirm your incident response retainer, your insurer’s panel firm and your NCSC reporting route, and test that they work out of hours.
  2. Prepare for 24 and 72-hour reporting now. If you are in scope of the Bill, or supply someone who is, rehearse an initial notification within a day and a fuller report within three.
  3. Close the Cyber Essentials basics. Patch internet-facing systems quickly (security update management), remove unused accounts and enforce MFA (user access control), and review firewall rules on edge devices (firewalls and secure configuration).
  4. Cut what you store. Run a retention review and delete personal data you no longer need.
  5. Point automated discovery at yourself. Use external attack surface scanning and NCSC Early Warning to hear about exposures first.
  6. Brief the board on state-support limits. Use the JLR debate to show directors that a bailout is neither guaranteed nor rule-based, and that resilience spending is the only dependable safety net.

Bottom line

Japan has answered a breach crisis with emergency funding, named rescue and expert teams, and a legal basis for going after attacker infrastructure, all within weeks. The UK has the strategy, the agency and a bill close to the finish line, but no comparable on-call rescue for businesses. For now, UK organisations should assume their first responders in a serious incident will be the ones they have contracted themselves.

Sources

Related Posts