Japan’s government adopted an emergency cybersecurity package on 6 November, combining measures that begin this month with proposals that ministers have agreed only to examine. Prime Minister Sanae Takaichi chaired the ministerial meeting on cybersecurity that approved the package.
At the centre of the package is a public-private cyber rescue team, staffed by penetration-testing and incident-response specialists, to be established within November 2026. A separate team, drawn from government and private industry, will be dispatched to support companies that come under attack.
The two units differ in composition and in role. A penetration tester looks for the way into a system before an attacker finds it; an incident-response specialist deals with an intrusion that has already happened. The rescue team carries both skills. The mixed unit adds officials to the group sent to a company under attack, so that technical help and a route to the state arrive together.
The government will also work with artificial intelligence companies to detect the indicators of an attack and to identify weaknesses in systems, including checks carried out with AI tools. The National Cyber Security Office is to be strengthened as the body that coordinates the response across government.
Two further ideas were left at the study stage. Ministers agreed to consider blocking access to certain websites, and to study amendments to the active cyber-defence law. Neither question was settled at the meeting, and the package sets no date for a decision on either.
The meeting was the second held on cybersecurity, which makes the package the product of a forum that has now met twice rather than of a single announcement. That forum is where the two unresolved questions would return if ministers choose to pursue them.
The breaches behind it
The package was drawn up in response to a series of breaches at major companies and government agencies during 2026. The incidents spanned private industry and the public sector, and the response is organised across both. They set its priorities: a unit that can be sent into an organisation while an intrusion is still being contained, and a review of whether the legal powers available to the state are sufficient for what it now faces.
Read closely, the package contains two kinds of commitment. The rescue team and the dispatch unit carry a date, November 2026, and a defined operational task. Website blocking and the active cyber-defence law carry neither; they are commitments to look at a problem rather than to act on it. That distinction will decide how much of the package is in force by the end of the year, and how much is still a subject for officials to work through.
What happens next
The rescue team is due to be in place within November. Organisations that suffer an intrusion will then have access to specialists who can be brought in during an incident rather than recruited from scratch while systems are down.
The AI work and the legal review continue without the same deadline. Strengthening the National Cyber Security Office is intended to give incident coordination a single point of authority, so that a breach at a private company and a breach at an agency are handled within one framework rather than two.
What remains unresolved is a question of powers rather than of people. Blocking access to websites and amending the active cyber-defence law would both change what the state can do before an attack reaches its target. Both were referred for study on 6 November. The rescue team will be operating long before either question is settled.
