Japan is fighting AI with AI. On Friday, November 6, 2026, Prime Minister Sanae Takaichi approved an emergency cybersecurity package worth 10 billion yen — roughly $63 million — after a wave of data breaches hit dozens of major companies and government agencies across the country. At the centre of the plan are two new rapid-response units: an elite “top gun” team of cybersecurity specialists that will use artificial intelligence to hunt hackers, and a public-private “cyber rescue team” that rushes to the aid of organisations under attack.
Takaichi told a ministerial meeting that rapid response is essential “in the era of AI-generated attacks,” and urged government bodies and private firms to raise their level of preparedness. The package, drawn from Japan’s fiscal 2026 reserves, is designed to build what officials describe as a resilient society in which the public and private sectors share information, assist those affected, and recover quickly from damage — with the stated goal of giving Japan one of the highest levels of cybersecurity in the world.
A Wave of Breaches Forced Tokyo’s Hand
The emergency measures did not come out of nowhere. Takaichi ordered officials to draw up the package eleven days earlier, after a series of high-profile data leaks and cyberattacks struck Japanese companies and government agencies. The breaches were notable not just for their scale but for their methods: according to the information-security arm of GMO Internet Group, a Chinese AI cybersecurity tool known as Artex was used in several of the recent hacks of Japanese companies.
That detail captures the new reality defenders face. Attackers are no longer working alone — they are using AI tools to find weaknesses, automate intrusions, and move faster than human response teams. Japan’s answer is to put AI on the defensive side of the same fight, a shift mirrored across the industry as security teams adopt tools such as OpenAI GPT-6 Cyber, the AI security model that found 948 Linux exploits in testing. The difference in Tokyo is that the response is being organised at national scale, with public money, dedicated teams, and new legal powers behind it.
What’s Inside the ¥10 Billion Package
The package rests on four pillars: using AI to strengthen basic defences, improving the collection and analysis of threat information, mounting a strategic response to attacks, and supporting victims while preventing further damage. The funding breaks down into three main allocations, reported by Jiji Press:
- ¥2 billion for AI-assisted checks for vulnerabilities in government systems.
- ¥4.1 billion for equipment and training to support police investigations into cyberattacks.
- ¥3.8 billion to strengthen the Digital Agency’s system security.
The government also plans to speed up discussions on blocking access to websites that display stolen personal information — a measure aimed at cutting off the payoff for data theft, not just the break-in itself. Together, the measures cover the full arc of an incident: finding weaknesses before attackers do, responding fast when they get in, and limiting the damage afterwards.
The ‘Top Gun’ Team: AI Fighting AI
The most eye-catching element of the plan is the specialist “top gun” team that the Ministry of Economy, Trade and Industry (METI) will establish by the end of November. Its members will use AI to counter hackers and detect weaknesses in network systems, working alongside technology companies and advanced AI developers in friendly nations to keep Japan’s expertise current.
The team will also run simulated attacks — with the first exercises starting this month — to test and strengthen defences before real attackers do. It is the same logic behind November’s exploited vulnerabilities wave, where defenders race to patch flaws that attackers are already probing: the side that finds the weakness first usually wins. Japan is betting that a small, elite, AI-armed unit can find weaknesses faster than the attackers can exploit them.
Cyber Rescue Teams on Call for Breached Companies
While the top gun team hunts threats, a separate public-private “cyber rescue team” will be dispatched to companies hit by cyberattacks to help with the first response — containing the damage, stopping the spread, and getting systems back online. A second team is expected to support companies that need to strengthen their defences after an incident.
For incidents that could seriously affect national security, the government will deploy a joint support team drawn from the Defense Ministry, the National Police Agency, and the National Cybersecurity Office. The layered structure is deliberate: a breached company gets immediate help from the rescue team, while a national-security incident triggers the full weight of the state.
Active Cyber Defense: Going on the Offense
The package also expands Japan’s ability to neutralise threats proactively by accessing servers used by attackers as a preventive measure — a capability known as “active cyber defense” that was legalized in October 2026. Rather than waiting for an attack to arrive and then responding, Japanese authorities can now move against the infrastructure attackers rely on.
It is a significant legal and strategic shift, and one that other countries are watching closely. The same capability that lets defenders dismantle a botnet or take down a command-and-control server raises questions about attribution, escalation, and the line between defence and offence. Japan’s framing is firmly defensive: the power exists to prevent damage, not to retaliate. But the fact that a major democracy has now codified it — and is funding the teams to use it — sets a precedent that will shape how other governments think about their own cyber defences.
What It Means for Businesses and the Rest of the World
For Japanese companies, the message is practical: help is now a phone call away, and the government is investing in the tools to find weaknesses before criminals do. For security teams everywhere, Japan’s package is a case study in how a nation responds when AI changes the speed of attack. The tools on both sides are getting faster, and the gap between breach and response is shrinking to hours.
The broader trend is unmistakable. Enterprise AI spending is surging as organisations put AI agents to work, and the security industry is racing to keep up — with defensive models, agentic security operations centres, and now, government-run AI defence teams. Japan’s ¥10 billion is modest next to the trillions flowing into AI infrastructure, but it is aimed precisely at the weakest point in the chain: the first hours after a breach, when damage is done and reputations are lost.
Whether the top gun team and the rescue units deliver will be judged by the next wave of attacks, not the last one. The first test comes soon: METI’s team is due by the end of November, and its simulated-attack exercises start this month. If it works, expect other governments to copy the model. The age of AI-powered attacks has arrived — and Japan has just announced that the age of AI-powered defence has arrived with it.
