ESET has published the “SMB Cybersecurity Readiness Index (2026 Japan Edition),” finding that 47% of Japanese SMBs have experienced an incident, a high level, while confidence in resilience is extremely low and ranks among the lowest globally. Although AI adoption has reached 80%, the report identifies the limited implementation of measures against shadow AI as an ongoing challenge.
ESET has published the 2026 Japan edition of its SMB Cybersecurity Readiness Index. The survey examined SMBs in 13 countries, including Japan, focusing on their experience of incidents, awareness of threats, AI adoption and risk perceptions, budget and staffing challenges, and incident response capabilities. In Japan, almost half of SMBs have experienced an incident, while confidence in resilience remains low and below the global average.
The threats of greatest concern among Japanese companies were ransomware and malware, at 49%, followed by malware using AI at 29% and spyware at 24%. By contrast, the leading actual contributing factors included insufficient security monitoring at 29%, inadequate access management at 25%, and legacy systems at 18%, highlighting basic management deficiencies as significant challenges.
AI adoption was high among Japanese SMBs, at 80%, but 35% of companies had not established a clear AI policy restricting employees' unauthorized use of AI. Experts recommend improving visibility into security assets, consistently implementing basic cyber hygiene measures, and using external operational support where necessary.
The full report and ESET's press information are available in the Japan edition, with further updates on the latest research expected to be published in the future.