A cyber-defense watch across ten jurisdictions
A common evidence map for official opportunities, legal stages and cyber-defense feedback loops, with local eligibility and coverage gaps.
## 3 November update: administrative observations and conditional participation
The [NCSC annual review](https://www.ncsc.gov.uk/collection/annual-review-2026/understanding-threat/incident-management) reports 1,831 attack reports, 337 incidents requiring support and 80 nationally significant incidents in the supported subset for September 2025–August 2026. Its 8,500 refers to organisations notified through Early Warning. These are administrative quantities, not police case conversion or evidence of prevented attacks. [ASD’s financial-year release](https://www.asd.gov.au/news/2026-10-27-australian-signals-directorate-releases-seventh-annual-cyber-threat-report-2025-26) uses different populations and a July–June period; its lower bounds remain separate.
[Cyber Shield](https://www.ncsc.gov.uk/collection/annual-review-2026/future-cyber-defence/cyber-shield) describes staged agentic defence and assurance challenges. Its national-scale ambition is not completed deployment. The NCSC’s [2028 autonomous-attack scenario](https://www.ncsc.gov.uk/collection/annual-review-2026/understanding-threat/autonomous-attack) is explicitly hypothetical. Our models retain unmeasured effects as assumptions.
The [Singapore quantum-safe grant](https://www.csa.gov.sg/our-programmes/support-for-enterprises/quantum-safe-kickstarter-grant/) requires a Singapore-incorporated non-government applicant, while explicitly allowing overseas solution providers. Its completion window is not an application cutoff. [IPA’s international-network operations tender](https://www.ipa.go.jp/choutatsu/nyusatsu/2026/nyusatsu20261028.html) permits services A/B/C in Kanto-Koshinetsu but requires a service list by 7 December, before the 14 January bid deadline, and prescribed information receipt. [EUSPA’s briefing](https://www.euspa.europa.eu/newsroom-events/news/industry-day-present-mc-secmon-procurement-opportunity) is 4 November 09:30–12:30 CET, or 17:30–20:30 JST; its procurement conditions still need controlling-document review. These are newly verified older announcements, not all newly opened calls.
## A common map with local rules
We have expanded the daily cyber-defense watch from Japan to the United States, China, the European Union, the United Kingdom, Canada, Australia, South Korea, Singapore and New Zealand. The first selected-source snapshot is dated **2 November 2026**. The EU is a supranational jurisdiction; a European record is not automatically ten different national contracts. The watch covers official procurement, grants, recruitment, consultations, institutions and evidence about delivery. It does not establish complete coverage or eligibility to bid.
## What the initial evidence changes
[ENISA’s individual expert roster](https://www.enisa.europa.eu/procurement/cei-list-of-individual-external-experts-to-assist-enisa) is listed open until 8 November at 20:00, but the page does not identify the time zone. Companies cannot apply; eligible individuals need EU/EEA citizenship or permanent residence and an eligible bank account. A place on the roster does not guarantee work. [Kāinga Ora’s technical cybersecurity role](https://jobs.govt.nz/jobtools/jncustomsearch.viewFullSingle?in_jnCounter=226717926&in_organid=16563), listed on 29 October, closes on 11 November at 23:55 in New Zealand (19:55 JST, NZDT assumed from the Wellington location). Its requirements include six years of relevant experience; it is an operational defensive role in a housing agency.
[Beijing’s AI-enabled cyber-defense research reserve call](https://www.beijing.gov.cn/zhengce/zhengcefagui/202610/t20261021_4912463.html) includes products and adversarial testing. Its cutoff was 29 October at 18:00 Beijing time (19:00 JST), so it is historical evidence, not an opening. Product and testing tracks have different eligible institutions. A call, award and deployed capability are distinct states.
## Why “active defense” is not one comparable intervention
The [UK action plan](https://www.gov.uk/government/publications/government-cyber-action-plan/government-cyber-action-plan) separates accountability, services, response and skills. [Australia’s ASD plan](https://www.asd.gov.au/about/accountability-governance/publications/asd-corporate-plan-2026-27) discusses partnerships, workforce, cyber operations and oversight. [Singapore’s 2026 strategy announcement](https://www.csa.gov.sg/news-events/press-releases/singapore-launches-cybersecurity-strategy-2026-to-strengthen-national-cyber-resilience/) and [New Zealand’s strategy](https://www.dpmc.govt.nz/our-programmes/national-security/cyber-security-strategy) describe national priorities. None of these documents alone measures how much an extra hire, a new power or an international agreement reduces attacks.
The [US CIRCIA OIRA entry](https://www.reginfo.gov/public/do/eoDetails?rrid=1550967) shows pending review at the final-rule stage, received 1 October. That is not evidence that a final rule was published or entered into force. [Canada’s career hub](https://www.publicsafety.gc.ca/cnt/ntnl-scrt/cbr-scrt/cbr-crr-wrnss/index-en.aspx) is a directory of institutional roles, not a dated vacancy. [KISA’s disclosure training](https://safe.kisa.or.kr/kr/bbs/view.do?bbsId=B0000020&categoryCode=&menuNo=204946&nttId=180&pageIndex=1&searchCnd=) identifies workforce and investment reporting methods; it is not an extracted comparable time series.
## The feedback loops remain hypotheses
Our system-dynamics interpretation connects reporting and intake load, lawful evidence preservation, specialist capacity, international evidence access, prosecution and attacker incentives. More reporting can initially increase the visible incident count and queues. Faster lawful preservation may reduce evidence loss, but preserved evidence still needs attribution, jurisdiction and a viable case. Hiring creates capacity only after training, clearance and retention delays. International cooperation depends on provider custody, legal authority and local procedures. Oversight affects lawful scope, errors and trust; treating it as a single cost to remove would miss those feedbacks. Attackers may adapt or relocate. These are mechanisms to investigate, not fitted causal effects.
## Publication status and shared snapshot
This Blog article and [Mithril Analysis](https://analysis.mithril.fund/research/global-cyber-defense/) are published for snapshot `global-cyber-defense-2026-11-03-v1`. Use Analysis to inspect the sourced records, filter jurisdictions and status, check coverage gaps and download JSON/RDF. The Knowledge reference is prepared but **not yet published** as of 3 November 2026; its planned route is `https://knowledge.mithril.fund/wiki/research/global-cyber-defense?lang=en` and currently returns Article not found. A prepared reference or successful validation does not establish publication. The new extension is a reviewed publication dataset; it has not yet been materialized into the existing R2 Data Catalog/Iceberg/GraphAr snapshot. The [existing Atlas](https://analysis.mithril.fund/research/shared-ontology-atlas/) retains its own exact storage receipt.
## What the daily watch will change
At 09:00 Japan time, check official amendments, newly opened calls, deadlines and results. Preserve original titles, issuing body, source date, access date, local time zone and JST. Keep unverified access, absent times, restricted eligibility and earlier mandatory gates visible. Do not infer no opportunities from a blocked portal. New outcome data enters a model only after population, unit, period and measurement changes are reviewed. This English article is not a claim that every selectable interface language has a translated body.