Toward fiscal 2027, the government has decided to significantly strengthen public-private initiatives targeting critical infrastructure, such as electric power and telecommunications, to detect cyber threats lurking within systems. Behind this move is the growing risk that a shutdown of critical infrastructure could directly lead to a national crisis, alongside the rise of sophisticated attack methods that abuse legitimate tools to remain hidden for extended periods.

Enhancing the Detection of Hidden Cyber Threats in Critical Infrastructure and Public-Private Sharing

Starting in fiscal 2027, the government has outlined a policy to launch a full-scale public-private partnership for threat hunting—verifying whether unknown threats have breached and are lurking within systems—to protect critical infrastructure such as electricity, telecommunications, gas, and water from cyberattacks. This initiative is one of the key measures based on the active cyber defense framework enacted in October 2026. Based on specific threat intelligence, the newly established National Cyber Office (NCO) will reproduce actual attack scenarios in a virtual environment, while private operators build and verify detection methods and signatures that can be utilized in their own environments. Furthermore, by leveraging the advanced cyber defense capabilities and expertise of the Self-Defense Forces, a system will be established for the Ministry of Defense to provide direct support to critical infrastructure operators upon request. Both agencies have included related expenses in their budget requests for fiscal 2027, advancing the development of a highly effective defense foundation. Please refer to the figure below.

By sharing such methods through public-private collaboration, it is expected to prevent the suspension of infrastructure functions and widespread social disruption during emergencies.

The Threat of Volt Typhoon Stealth-Type Attacks and the Underlying National Risks

The background behind the government’s rush to conduct threat hunting this time lies in the reality that stealth cyberattacks, which are difficult to detect with conventional security measures, have become a global threat. In 2024, U.S. government authorities announced that the Chinese government-sponsored threat group Volt Typhoon had maintained unauthorized access within U.S. critical infrastructure networks for over five years. Rather than deploying new malicious programs, the attackers employed techniques that abused legitimate commands and tools routinely used by system administrators to avoid triggering alarms, remaining hidden so they could disable the infrastructure at any time in the event of a crisis. If critical infrastructure were to be physically or functionally shut down, the damage would not merely be the loss of a single company; it would directly lead to a national crisis involving the disruption of vital lifelines and the paralysis of economic activity. In Japan, too, sophisticated cyber communications from overseas are surging across dark observation networks, with data showing that some form of probe is directed at each IP address at a rate of at least once every 13 seconds. Preparedness against such state-sponsored attacks has become a top priority in economic security and national security policy.

Legal Frameworks for Active Cyber Defense and Public-Private Partnership Frameworks

Enactment of the Cyber Response Capability Enhancement Act and Mandating Information Sharing Frameworks

To improve the cybersecurity defense capabilities of the entire nation, the government enacted and promulgated the Act on Strengthening Cyber Response Capabilities and related maintenance laws in May 2025, based on the National Security Strategy. This legislation stipulates a shift from the conventional reactive defense posture focused on post-incident response to active cyber defense aiming at advance detection and neutralization, in order to protect the foundation of people’s livelihoods and economic activities. A total of 257 business operators across 15 industries have been designated in the critical infrastructure sector, and they are now required to submit notifications regarding product names and configurations when introducing specified critical computers. In addition, a reporting system has been established in which, upon recognizing traces of unauthorized access or the threat of malware execution, a flash report must be submitted to the government promptly after recognition, followed by a detailed report within 30 days. Operational rules have also been formulated regarding the use of cloud services, under which recognition is deemed to have occurred at the time a notification is received from the service provider. Through these mandatory requirements, the prompt aggregation of incident information between the public and private sectors and multi-layered defense have become possible, establishing an early warning system on a nationwide scale.

Establishment of Public-Private Partnership Infrastructure and Specific Operations of the Council Friends

To facilitate incident reporting and the bidirectional sharing of threat information, the government is building a new public-private collaborative infrastructure (information-sharing system). This system is scheduled to begin preliminary operations, such as incident reporting features, around the summer of 2026, and transition to full-scale operation by around the spring of 2027. Furthermore, as a framework to promote information sharing and countermeasures discussions, a public-private partnership council is scheduled to be officially launched around the autumn of 2026. The initial members of the council will comprise critical infrastructure operators and major IT vendors who will share sensitive threat information under strict confidentiality obligations. Meanwhile, to widely deliver security information to the numerous small and medium-sized enterprises (SMEs) and local governments supporting the critical infrastructure supply chain, a quasi-member position known as “Council Friends” (tentative name) will be established. Please refer to the figure below.

By introducing a mechanism through which alerts and countermeasure guidelines are pushed out proactively by the government, efforts are being made to raise the baseline of security preparedness not only for a few large enterprises, but across the entire supply chain.

Cyber Risks Facing Businesses and Future Countermeasures

The Expanding Reality of Supply Chain Attacks and Ransomware Damage

In recent years, rather than directly breaching the robust defenses of large enterprises, supply chain attacks—which infiltrate systems via business partners or contractors with weaker security measures—have become a serious issue. In Japan, there have actually been cases where vulnerabilities in a car parts manufacturer’s VPN equipment were exploited to halt all factory lines of a major automaker, as well as incidents where intruders gained access through a contractor’s account, leading to the long-term suspension of a major e-commerce company’s services after an incubation period of about four months. Additionally, double-extortion ransomware attacks are surging, which not only encrypt data to demand money but also threaten to leak stolen confidential information onto the internet. In 2025, major beverage manufacturers, medical institutions, and publishing companies were successively struck by large-scale system failures, resulting in serious damages such as the leakage of hundreds of thousands to 1.9 million personal records, suspension of deliveries, and restrictions on medical treatment functions. As attackers even target and encrypt backup data, the reality that recovery cannot be achieved simply by having backups in place has been brought to light.

Future Outlook and Investment Decisions Required of Corporate Management

Looking ahead to the full-scale implementation of active cyber defense in 2027, businesses will be strongly urged to maintain proactive log management during normal times and establish rapid incident reporting systems. When introducing threat hunting, which is necessary to detect stealthy attacks, securing the human resources and costs associated with long-term log retention and constant analysis becomes a challenge. However, the internal exploration detection techniques used in threat hunting are also directly effective for the early discovery of ransomware attacks that traverse internal networks after breaching the perimeter. Management must reframe cybersecurity not as a mere cost, but as an essential management investment to protect business continuity and corporate value. Specifically, prompt patching of operating systems and software, company-wide implementation of multi-factor authentication (MFA), deployment of EDR to detect and isolate abnormal behavior at endpoints, and regular recovery drills are indispensable. Quickly integrating threat intelligence shared between the public and private sectors into corporate defense postures and building a robust security ecosystem in unity with the government and business partners will be the key focus and the greatest challenge going forward.

Reference Page

• 【Draft Concept for the Enforcement of the Act on Strengthening Cyber Response Capabilities (Public-Private Partnership)】https://www.cao.go.jp/keizai_anzen_hosho/suishinhou/infra/doc/infra_jigyousya.pdf
• 【Regarding the Threat Situation Surrounding Cyberspace in the First Half of 2025 (Reiwa 7)】https://www.npa.go.jp/publications/statistics/cybersecurity/data/R7kami/R07_kami_cyber_jyosei.pdf
• [Regarding Cybersecurity Measures in the Electric Power Sector] https://warp.da.ndl.go.jp/info:ndljp/pid/12213293/www.nisc.go.jp/conference/cs/ciip/dai07/pdf/07shiryou0601.pdf

[#Politics #Cybersecurity #CriticalInfrastructure #ActiveCyberDefense #PublicPrivatePartnership #EconomicSecurity #Ransomware]