Opinion · Commentary · Breaking

Japan's cyber emergency package is right. It still assumes everything stays connected.

Japan has announced a 10 billion yen emergency cybersecurity package, with AI defence and cyber rescue teams, after a wave of breaches. Mark Fermor argues that faster response must be matched by reducing what attackers can reach at all.

Mark FermorCTO, CMO and Founder, Firevault

Published 7 November 2026 · 6 min read

What happened

Japan has declared what amounts to a national cyber emergency in all but name. On Friday 6 November 2026, Prime Minister Sanae Takaichi announced an emergency cybersecurity package after a wave of data breaches hit major companies and government agencies, ABC News reported, carrying an Associated Press wire story.

"At this very moment, cases of unauthorized access and data breaches are occurring, causing a major impact on daily lives of the people and corporate activities," Takaichi told a ministerial meeting. "Let us increase the response capability across Japan by devoting all government resources."

The package is initially funded with 10 billion yen (about $63 million) from the government's budget, although Reuters, via CNA, reported that the overall cost is likely to be higher. According to the AP report, it includes:

• a "top gun" team of specialists, set up by the Ministry of Economy, Trade and Industry by the end of November, using AI to counter attackers and find weaknesses in network systems;
• a public-private "cyber rescue team" to provide the first response for companies that have been attacked, with a separate team helping vulnerable companies strengthen their defences;
• a joint support team drawn from the Defence Ministry, the National Police Agency and the National Cybersecurity Office for attacks that could challenge national security;
• greater use of "active cyber defence", the power to access servers used by attackers, which AP reports was legalised in October.

Bloomberg, citing the Nikkei, reported that about a fifth of the money will fund an AI-led sweep of critical infrastructure and government systems for vulnerabilities by March. The ruling Liberal Democratic Party has described the situation as "the eve of a cyber emergency".

Why Japan acted now

The package follows weeks of incidents. On 2 November, AP reported that GMO Internet Group had apologised after unauthorised access to its Onamae.com Desktop Cloud service led to leaked information and transactions customers did not recognise, affecting dozens of securities firms and other businesses, with more than 26,000 cases. GMO said the attackers deployed ransomware, that it refused to pay, and its chief executive acknowledged the company had been warned internally about a systemic weakness but had not acted on it.

Last month we also reported on the cyberattack on cloud provider Arcadia, which may have exposed data on 125,000 Japanese police officers and staff.

The government's own diagnosis is the most important part

The most striking line is not about money or new teams. According to Jiji Press, the package itself states that many recent leaks involved cases where basic measures were not sufficient, and that advances in AI mean such gaps can now be exploited in a short time and at large scale. Reporting by Impress Watch, summarised by Osegi, lists the basics in question: unpatched known vulnerabilities, misconfigured websites and weak security in application development.

That is an honest assessment, and it deserves credit. It is also the heart of the problem.

If AI can find and exploit a gap in hours, every system that is permanently reachable is permanently being tested. Patching, scanning and faster reporting all matter. The package's requirement that attack information reach the National Cybersecurity Office within hours, or at least the same day, is a real improvement. But every one of those measures still starts from the same assumption: that the systems and data being defended will remain connected, and that the defender must win the race every time.

A response model, not yet a reachability model

Read the four pillars closely: stronger basic measures, better intelligence and investigation, strategic response to attacks, and support for victims. Each is necessary. Taken together, they describe a country getting much better at detecting, responding to and recovering from attacks on connected systems.

What is largely missing is the question that comes before all of them:

Which systems and data should not be continuously reachable in the first place?

A cyber rescue team arriving within hours is welcome. A recovery copy that was offline throughout the attack means there is something clean for that team to restore. A sweep that finds vulnerabilities by March is welcome. An engineering connection into a critical system that exists only while approved work is under way, and is physically absent the rest of the time, leaves an attacker nothing standing to find.

What this means beyond Japan

Japan's experience is not unusual. It is simply further along a curve that the UK and Europe are also on. The same pattern of cloud dependencies, standing remote access and backups that sit on the same network as the systems they protect appears in breach after breach, including the Binance theft reported days before GMO's apology.

Governments can fund rescue teams. Boards still have to decide what their organisation keeps connected.

Where Firevault fits

At Firevault we argue that resilience has two halves. The first is defending the connected estate, and Japan is right to invest heavily in it. The second is reducing what needs to be connected at all.

Offline Secure Storage® keeps an organisation's most valuable data and recovery copies on dedicated hardware that is physically disconnected and offline by default. Authorised access is established when required and removed when the session ends. Control by Firevault applies the same principle to operational connections: just-in-time access, so a path into a critical system exists when approved work needs it and physically does not when it does not.

Neither replaces patching, monitoring, investigation or incident response. Neither can protect data while it is deliberately connected for use. What both do is remove standing paths that an attacker, human or AI-assisted, would otherwise be able to probe around the clock.

Japan has decided to fight AI-speed attacks with AI-speed defence. The quieter, more durable answer is to make sure the things that matter most are not there to be attacked when no one needs them.

Mark Fermor is CTO, CMO and Founder of Firevault. Learn why offline storage is different or talk to the team.