Japan cyber-defense procurement: what three years of official records establish
A source-linked review of 38 selected government events, with eligibility, contract boundaries and the evidence still missing for deterrence.
Japan’s proposed IPA “off-white hacker” team is new policy context, but public spending on cyber research, vulnerability assessment, investigative tools and exercises has a longer history. We reviewed selected official material from 30 October 2023 through 30 October 2026 and published a [source-linked evidence explorer](https://analysis.mithril.fund/research/japan-cyber-procurement/).
The collection contains 38 event records across 35 procurement or policy families. It is a purposive sample, not a census of Japanese government procurement. Thirty-seven records were reviewed in official bodies or original PDF text; one official announcement has historical individual terms still unverified. Coverage gaps remain visible.
## Research, invitations and contracts are different stages
NEDO’s [December 2023 advanced-defense call](https://www.nedo.go.jp/koubo/IT2_100312.html) and [July 2024 selection](https://www.nedo.go.jp/koubo/IT3_100312.html) predate the recent IPA announcement. The selected-theme annex specifies a JPY 29 billion ceiling for combined research items 1–3 over a planned five-year period. That ceiling is not a signed contract amount or actual expenditure. Invitations and results are linked so they cannot silently become two independent contracts.
The [23 October 2026 ministerial statement](https://www.meti.go.jp/speeches/kaiken/2026/20261023001.html) describes a team planned for November. It does not establish formal recruitment, a specific procurement or operational deployment. Earlier programmes are not automatically contracts for that team.
## There is no universal C-grade rule
In this sample, IPA’s [2025 vulnerability-assessment tender](https://www.ipa.go.jp/choutatsu/nyusatsu/2025/nyusatsu20250707.html) allowed services grades A/B/C/D. Its [2026 SASE/SSE validation tender](https://www.ipa.go.jp/choutatsu/nyusatsu/2026/nyusatsu20261022.html) required A. Technical approval, service accreditation, valid qualification periods, regions and confidentiality procedures can be separate gates. Eligibility must be checked against the complete individual notice and the bidder’s current qualification.
## Procurement does not measure deterrence
Selected [NPA contract disclosures](https://www.npa.go.jp/news/procurement/npa/06_buppin_kyousou.pdf) document investigative software and analysis services. NICT forecasts describe exercises and training support. Acquiring tools is an input; completing usable evidence, retaining specialists and reducing processing delays are outcomes that need separate measurement.
Our [enforcement system-dynamics research](https://analysis.mithril.fund/research/cyber-enforcement/) keeps those boundaries explicit. These procurement records do not identify an effect on charging, cross-border assistance or attacker incentives. No simulation coefficient has been recalibrated from a contract value or programme ceiling.
## Explore, check and extend
The [Analysis explorer](https://analysis.mithril.fund/research/japan-cyber-procurement/) filters by year, issuer, evidence stage and topic. It preserves Japanese titles, English summaries, official URLs, deadlines where established and unknown fields. JSON, CSV, coverage notes and Mith/RDF extracts are downloadable. Hashes identify the curated extracts, not original government-file archives.
The stage chart describes this selected sample. It does not estimate annual market growth: boundary years are partial, coverage is uneven and contract dates differ from publication dates. No bid, application, public comment or inquiry was submitted.