Japan to expand cyber threat hunting for critical infrastructure in fiscal 2027

October 5, 2026 at 08:03 AM1 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Japan's government will strengthen cybersecurity measures in fiscal 2027 to detect hidden cyberattacks on critical infrastructure operators, including energy and telecommunications companies. The National Cybersecurity Office and Defense Ministry will develop threat-hunting methods and provide them to private firms. The initiative follows legislation that took effect Thursday.

Key Facts

Japan's National Cybersecurity Office will develop threat-hunting methods and provide them to private companies in fiscal 2027.
The Defense Ministry will dispatch personnel to assist critical infrastructure operators at their request.
NTT Data Japan has conducted proactive threat hunting in its own systems since 2024.
The relevant legislation took effect on Thursday.

Threat Hunting Expansion

Japan's National Cybersecurity Office will use information on potential threats to recreate attack scenarios in a virtual environment. The office will develop and test detection methods suitable for the private sector. Threat hunting is expected to be a key tool of active cyber defense, involving targeted searches for signs of malicious activity in systems. The initiative aims to prevent potential crises caused by infrastructure disruptions during emergencies.

Defense Ministry Assistance

Japan's Defense Ministry plans to directly assist critical infrastructure operators. At the operators' request, the ministry will dispatch personnel using threat-hunting capabilities developed in the Self-Defense Forces' information systems. The National Cybersecurity Office and the Defense Ministry included the costs of these measures in their budget requests for fiscal 2027. Such searches require significant resources because system event logs must be collected and analyzed.

Ransomware Countermeasures

A representative of the National Cybersecurity Office noted that these methods can help counter ransomware. Ransomware attacks use similar tactics, including exploring systems after gaining access. NTT Data Japan has been conducting proactive threat hunting in its own systems since 2024, checking logs for suspicious activity even without alerts.