Japan Adopts Proactive Cyber Defense Strategy

Japan's Active Cyber Defense law mandates critical-infrastructure incident reporting from October 2026, with disruption powers later.

Japan's Active Cyber Defense framework, enacted as Acts 42 and 43 of 2025, moves from voluntary sharing to mandatory reporting, communications analysis, and limited disruption of attack infrastructure. Designated critical-infrastructure operators must report qualifying incidents from October 1, 2026, while government communications-collection authority begins only on November 23, 2027. Japanese agencies recorded attack-related packets rising from 63.2 billion in 2015 to 686.2 billion in 2024, with 99.4 percent from overseas IPs. Recorded Future assesses the main constraint will be linking indicators fast enough to warn organizations, and expects actors to favor foreign subsidiaries, non-designated suppliers, employees, and short-lived hosting.