Yano Sees Japan Cyber Security Market Reaching 2.1 Trillion Yen

Japan's domestic cybersecurity market is projected to reach 2.122 trillion yen in fiscal 2026 as corporate spending expands to counter rising attack exposure. The market grew an estimated 9.2% to 1.9471 trillion yen in fiscal 2025, driven by a strategic shift where management now views security as a fundamental requirement for business continuity. This growth comes as generative AI and cloud adoption broaden the threat landscape for Japanese firms across all sectors.

According to a study by Yano Research Institute conducted between March and May 2026, Japan’s cybersecurity market is experiencing significant growth, with fiscal 2025 estimates reaching 1.9471 trillion yen. This represents a 9.2% increase from the previous year, and the momentum is expected to carry into fiscal 2026 with a forecast of 2.122 trillion yen based on vendor sales. The expansion is attributed to a broadening attack surface as companies adopt cloud services and IoT devices, coupled with the "democratization" of cyber attacks through tools like generative AI, which has lowered the barrier to entry for malicious actors.

The research highlights a critical shift in how Japanese organizations perceive security investments, moving from a technical IT task to a core management foundation necessary for sustaining operations. This change is particularly relevant for small and midsized companies (SMEs), which have historically been reluctant to invest in security due to the belief that they were unlikely targets. Recent incidents affecting manufacturers and service providers have demonstrated the difficulty of maintaining daily operations and the lengthy recovery times required after an attack, prompting a more proactive stance toward business continuity planning (BCP).

A survey of 495 private-sector companies across industries including manufacturing, finance, and distribution revealed an average cybersecurity maturity score of 3.0 on a five-level scale. Yano Research Institute noted that this score indicates companies are only partially addressing security through documented internal procedures, a level that remains a cause for concern. The study found that fewer than 10% of organizations reached the highest level of maturity (Level 5) or the lowest (Level 1), with the vast majority concentrated in the middle tiers, suggesting that while investment is rising, comprehensive implementation remains a work in progress.