Demand
Japanese demand comes from government rules, supplier ratings and constant package attacks
Japan has added four new pressures on software suppliers since 2024. Each one asks buyers to know what is inside the software they build or buy.
IPA ranks supply chain attacks second for 2026
IPA's 情報セキュリティ10大脅威 2026 (jōhō sekyuriti jūdai kyōi, the Ten Major Information Security Threats), published 29 January 2026, ranks attacks on supply chains and contractors second for organisations, the same as last year. Only ransomware ranks higher. AI-related cyber risk entered the list for the first time at third.
Supplier security ratings were finalised in March 2026
METI and the National Cybersecurity Office finalised the SCS評価制度 (SCS hyōka seido, evaluation scheme) on 27 March 2026. Self-assessed ★3 (26 requirements, with an expert check) lasts a year. Third-party evaluated ★4 (43 requirements, including vulnerability management) lasts three years. IPA issued guides on 28 October 2026 and plans to name evaluators in late December.
SBOM guidance covers supplier contracts and medical devices
METI's SBOM guide 2.0 (29 August 2024) added vulnerability handling and SBOM terms for outsourcing contracts. METI and the National Cybersecurity Office signed the Japan and US-led, 15-country Shared Vision of SBOM on 3 September 2025. Since 1 April 2024, health ministry guidance has made medical device makers hold a full SBOM, ready to show.
Active cyber defence obligations began 1 October 2026
Under the 能動的サイバー防御 (nōdōteki saibā bōgyo, active cyber defence) laws, critical infrastructure operators must report specified incidents on designated important computers, with a detailed report within 30 days. They must also declare each computer's product name and maker, so the government can warn every operator using a product whose vulnerabilities are being exploited.
Malicious open source packages appear every day
In the 181 days to 18 August 2026, GMO Flatt Security scanned about 19 million packages in six registries and flagged about 31,000 as malicious, some every day. Japanese developer media covered npm waves in November 2025 (492 packages, per Aikido Security) and August 2026 (434 or more). No source here names a Japanese victim.
Named Japanese buyers and spending signals
Mitsubishi Electric (April 2024) and DIY chain Cainz (February 2024) announced Snyk deployments. Shimadzu and Yamaha trialled Hitachi Solutions' SBOM system, launched June 2026. IDC Japan says vulnerability management software grew over 40% in 2024, in a ¥586 billion security software market. In July 2025, 7% of surveyed manufacturing staff said their company used SBOMs.
Who sells it in Japan
Who sells software supply chain security in Japan now
Four foreign vendors have named a Japan head publicly, three with Japanese distributors. Japanese security firms and system integrators have launched their own SBOM and package security services since 2024.
| Company | What it sells | In Japan | Japan leader (public record) |
|---|---|---|---|
| Developer security for code, open source dependencies, containers and infrastructure as code | Snyk株式会社 (KK), full launch February 2022; resellers LAC, Classmethod, Hitachi Systems Engineering Service (from February 2024); Japanese site; customers Mitsubishi Electric, Cainz | Yuki Kanda, Country Manager and President, Snyk Japan (appointed 2026) | |
| SCA and SBOM (Black Duck), static analysis (Coverity), dynamic and interactive testing | Black Duck Software合同会社 (GK, gōdō gaisha) in Setagaya, Tokyo; distributors Macnica (from November 2024) and Hitachi Solutions (partner for over 15 years) | Hiroya Abe (阿部浩也), Country Manager, named in Macnica's November 2024 release | |
| Artifactory package repository and Xray component scanning | JFrog Japan KK, set up in 2018; SB C&S announced a sales partnership in 2021. Macnica Networks signed in 2018, but Macnica ended new JFrog sales in March 2024. | Vicky Chan, appointed Japan GM and Country Manager in June 2022; no later public update found | |
| Checkmarx One AppSec platform, used by 860+ large enterprises worldwide (October 2025) | Country Manager for Japan appointed July 2022; the release names no Japanese entity or partners | Yoshishige Nakamichi, Country Manager for Japan from July 2022; no later public update found | |
| Takumi byGMO security AI agent: Guard (blocks malicious packages), Runner, Takumi Images | Tokyo, founded 2017; GMO Internet Group took 66.6% in February 2024; ConoHa VPS AI agent templates include Guard free from September 2026 | President and Representative Director 井手康貴 (Ide) | |
| yamory vulnerability management cloud: SCA, SBOM, end-of-life and open source licence checks | Visional group company in Shibuya, Tokyo; yamory is on the government's ISMAP cloud service list | President 大森厚志 (Omori) | |
| SBOM management system announced 23 June 2026; long-standing Black Duck reseller | Japanese SI; tested the system with Shimadzu and Yamaha | Japanese company, no country manager seat | |
 NRI Secure | SBOM-based vulnerability monitoring and triage service, launched December 2024 | Japanese security services firm; aims the service at quality assurance teams and PSIRTs at manufacturers | Japanese company, no country manager seat |
 Veriserve | SBOM.JP; added EU vulnerability database matching (August 2026), SSVC prioritisation (October 2026) | Tokyo software quality assurance firm | Japanese company, no country manager seat |
 NTT DATA | Software Vulnerability Integrated Management Service, SBOM-based SaaS launched 25 September 2026 | Japanese SI; offers PoC, policy design and operations support alongside the service | Japanese company, no country manager seat |
Japanese SIs appear twice in this market: as competitors with their own SBOM services and as resellers of foreign tools.
Coming to Japan
Companies preparing a deeper Japan entry
These companies have a dated public Japan signal in 2025 or 2026 but no named Japan head.
| Company and backers | What it sells | Public signal |
|---|---|---|
Kleiner PerkinsIVPSeries D, 2025 | Hardened container images, open source libraries and OS packages with SBOMs | Two Japanese partner agreements in one week: SIOS Technology (24 July 2026) and Creationline (28 July 2026). APJ roles listed on 3 November 2026 are in Australia and the UK. |
DST GlobalPSG EquitySeries B, January 2026 | Developer-first application security platform, based in Belgium | Account Executive Japan ad (Tokyo) live on 3 November 2026, described as its first all-round salesperson for the market; fluent Japanese and English required. |
| Application security platform: code and container vulnerability management and dependency analysis | G-Gravity signed a Japan distributor agreement and began selling on 2 June 2026, at ¥200,000 per user per year for Mend AppSec. | |
| Nexus Repository, Firewall and Lifecycle for open source component management | Enterprise Account Executive, Japan ad (Singapore-based, Japanese fluency required) on a job aggregator updated 27 October 2026; not on Sonatype's Lever board when checked on 3 November 2026. | |
| Container platform; Docker Business adds central security settings for Docker Hub | SB C&S signed a distributor agreement on 16 December 2025 and will offer Docker Business through about 15,000 Japanese sales partners. |
Only public signals are listed: job ads, company registrations, partner announcements and press. A company on this list has not told us it is entering Japan, and none of them is named here as a client.
Who our clients are backed by
Investors behind companies we have worked with.
Venture and private equity firms behind clients we have run Japan searches for. Under each firm is the client it backs. These firms are not our clients and have not endorsed us.
Case studies
How companies like these built their Japan business.
Wiz Japan
Wiz opened Japan with a former VMware Japan president as its leader and local data centres, and won 80 customers in about a year.
Read it →Case study · SecurityThe Zscaler playbook
How Zscaler built its Japan business through partners, and what that meant for its first hires.
Read it →Research · SecurityJapan Cybersecurity Brief
The major breaches disclosed in Japan over the past year, what they cost, and the rules now in force.
Read it →More Japan market briefs
Next step
Talk to the partner who would run the search.
Thirty minutes on your Japan plan, the market for the role and what it will take to hire well. You leave with our view of that market whether or not it becomes a search.
- Placing Country Managers and presidents in Japan since 2003
- More than 70 Country Managers and go-to-market leaders placed
- ManpowerGroup (NYSE: MAN) bought his last search firm and made it Experis Executive
- Security searches include Recorded Future, Splunk, Fastly, Chainalysis and Zenity
- Eleven years recruiting in Japan, on executive and senior appointments across consulting, technology and manufacturing
- Partner appointments into a Big 4 consulting firm in Japan
- Country Manager appointments for overseas firms setting up in Japan
Partner, Managing Director and Director searches inside consulting firms.
How this page was researched. We produced this page with AI under Murray Clarke's direction. Every figure links to its original source, and the page was checked against those sources on 3 November 2026. Most sources are IPA, METI and National Cybersecurity Office publications, IDC Japan and Fuji Chimera releases, vendor and distributor press releases on PR TIMES, ITmedia, Cloud Watch and ScanNetSecurity articles, and Japan job postings. Murray Clarke is accountable for what the page says. If you find an error, tell us at hello@aspiringpartners.jp and we will correct it.
Aspiring Partners K.K. Licensed by the Ministry of Health, Labour and Welfare for fee-charging employment placement, licence 13-ユ-318925. Company names on this page describe the Japanese market and are not clients unless we say so. Nothing on this page is legal, tax or investment advice. aspiringpartners.jp