On October 6, 2026, the Financial Services Agency launched “Delta Wall 2026,” a large-scale, cross-industry cybersecurity exercise for the financial sector. Amid the threat of a surge in cyberattacks using cutting-edge AI technology and core system failures, a record 181 financial institutions are participating.

Key Points of the Event and Objectives of the Exercise

The Financial Services Agency (FSA) has launched “Delta Wall 2026,” a cross-industry cybersecurity exercise, scheduled to run from October 6 to 22, 2026. Marking its 11th iteration, a record 181 financial institutions are scheduled to participate, including banks, securities companies, life insurance companies, non-life insurance companies, fund transfer service providers, and crypto-asset exchange operators. This surpasses the 177 participants in the previous exercise held in October 2025, making the scale of participation across the entire financial sector the largest ever. The primary objective of this exercise is to inspect the entire process—from initial response in the event of a cyberattack, investigation and analysis of the attack details, customer notification and response, through to business recovery—and to enhance effective IT resilience (business continuity and early recovery capabilities). Participants are taking part remotely from their respective organizational work environments and teleworking setups, conducting advanced verification tasks assuming real-world contingencies. The FSA places strong emphasis on post-exercise evaluation and feedback, and has established a policy to feed back specific improvement measures and best practices to the entire industry, enabling each organization to drive the PDCA cycle and improve its countermeasures.

Addressing Cutting-Edge AI Threats and Characteristics of Industry-Specific Scenarios

The most notable element in this exercise is the response to the sophistication and acceleration of cyberattacks driven by the rise of cutting-edge AI (artificial intelligence) technology. In recent years, threats such as frontier AI, which automatically discovers system vulnerabilities and generates advanced attack code in a short time, have become increasingly severe, dramatically accelerating the speed at which attacks occur. Along with this, simulated scenarios tailored to the actual circumstances of each business type have been set in the exercises. For securities companies, realistic incidents were established, such as unauthorized access and fraudulent transactions resulting from cyberattacks; for fund transfer service providers and prepaid payment instrument issuers, customer information leaks and fraudulent payments; and for crypto asset exchange operators, the outflow of customer assets and proprietary crypto assets. Meanwhile, for banks, Shinkin banks, credit cooperatives, labor banks, and insurance companies, a blind format in which the content is not disclosed in advance is adopted to rigorously test their initial decision-making ability and incident response capabilities in the event of sudden situations. Please refer to the following structure for the conceptual diagram of the exercise.

Measures to prevent the spread of damage in the event that core systems or perimeter defenses are breached are being intensively reviewed across various business sectors.

The Intensification of Cyber Risks Surrounding the Financial Industry and Its Background

The Growing Sophistication of Cyberattacks and the Materialization of Third-Party Risks

The cyber threat landscape surrounding financial institutions is growing increasingly complex and severe year by year. According to an analytical report published by the Financial Services Agency (FSA), recent years have seen a succession of reported incidents, including the outflow of customer assets at crypto-asset exchange service providers due to targeted social engineering, and unauthorized purchase incidents via phishing scams targeting securities firms. Furthermore, security incidents involving third parties such as outsourced business partners and cloud providers—not just the financial institutions themselves—are surging. There has been a high frequency of cases where external contractors fall victim to ransomware attacks resulting in the leakage of customer information and electronic document data, or where vulnerabilities in network equipment are exploited to allow unauthorized access, making securing the entire supply chain an urgent task. In addition, damages caused by DDoS (Distributed Denial of Service) attacks leveraging IoT botnets, which temporarily disrupt connectivity to internet banking and payment apps, are occurring frequently. Because such attacks have the potential to impact not only specific companies but the entire financial system, an even stronger posture of vigilance is required.

The Need for IT Resilience and Governance Based on “Assume Breach”

Traditional cybersecurity measures once focused primarily on perimeter defense, such as firewalls, with the main goal of “preventing intrusions.” However, due to the rapid evolution of attack methods exploiting generative AI and automated tools, achieving complete defense is becoming extremely difficult. Therefore, current financial regulations and guidelines prioritize the establishment of “IT resilience” and “operational resilience,” which assume from the outset that intrusions and system failures will occur. It is essential to build a framework that restarts critical operations in the shortest possible time in the event of a failure and minimizes negative impacts on customers and the market. To realize this initiative, rather than leaving the situation entirely in the hands of IT and security departments, a governance framework led by executive management is crucial. Management is required to correctly recognize cyber risks as top business risks, allocate appropriate human resources and budgets, and lead a mindset shift across the entire organization. Please refer to the overall diagram below for an illustration of how to build this governance.

Future Outlook and Cyber Defense Measures Required for Financial Institutions

Strengthening “Mutual Aid and Public Assistance” through Guideline Formulation and Public-Private Partnerships

On October 4, 2024, the Financial Services Agency (FSA) established the “Guidelines on Cybersecurity in the Financial Sector,” explicitly defining concrete guidelines for governance, risk identification, defense, detection, response and recovery, and third-party management required of financial institutions. Furthermore, in May 2026, the FSA issued a joint urgent request with the Bank of Japan, taking into account the changing threats posed by frontier AI, and called for risk-based patch application and thorough defense-in-depth. Responding to cyber attacks has limitations when relying solely on individual companies (“self-help” / jijo), making cooperation with “mutual help” (kyojo)—where the entire industry shares and analyzes threat information—and “public assistance” (kojo)—such as exercises provided by administrative agencies—the key to success. A framework is becoming established to rapidly share the latest vulnerabilities and attack methods (TTPs) through information-sharing organizations such as the Financial ISAC and JPCrypto-ISAC, thereby raising the defensive capabilities of the entire industry. Public-private partnerships with the government, the National Police Agency, and the National Center of Incident Readiness and Strategy for Cybersecurity (NISC) are also being strengthened, and systems are being developed to deter cross-border cybercrime and state-sponsored attack groups.

Future Focus Areas and Executive-Led Security Measures

The key point of interest moving forward will be how each financial institution translates the challenges highlighted by this exercise into concrete improvement measures. The Financial Services Agency (FSA) plans to analyze the exercise results and compile a report summarizing best practices and common challenges to share broadly. Based on their evaluation results, individual institutions must continuously review their contingency plans and communication frameworks. Additionally, from a medium- to long-term perspective, preparations are already underway to address the threat of quantum computers—expected to become practical by the mid-2030s—which could render current public-key cryptography obsolete. These efforts include preparing for the transition to Post-Quantum Cryptography (PQC) and compiling crypto inventories. To maintain the reliability of financial infrastructure amid rapidly evolving cyber threats, it will become increasingly vital for management to take the lead in driving continuous investment and talent development, while repeatedly conducting practical verifications during peacetime.

Reference page

• [Financial Services Agency] Publication of the “Guidelines on Cybersecurity in the Financial Sector” (October 4, 2024) https://www.fsa.go.jp/news/r6/sonota/20241004/20241004.html
• [Financial Services Agency] Regarding the Implementation of the Cross-Financial Industry Cybersecurity Exercise (Delta Wall) https://www.fsa.go.jp/news/r6/sonota/20241008/deltawall.html
• [Financial Services Agency] Analysis Report on IT Resilience in the Financial Sector https://www.fsa.go.jp/news/r6/sonota/20250610/itresilience2025.html

[#FSA #Cybersecurity #DeltaWall #AIAttacks #ITResilience #FinancialInstitutions]