Read Michael Rogers for a few paragraphs and it is difficult not to nod along in agreement. Japan moves too slowly on cyber security. The private sector struggles with basic hygiene. Skilled people are scarce. Institutions built to investigate crimes after the fact are now asked to stop intrusions before they land. Rogers, who ran both the United States National Security Agency (NSA) and United States Cyber Command (USCYBERCOM), argues that Japan built the right foundation but takes too long to act on it. He is right about the delay. I spent years inside the machine as a United States civil servant working with the Japanese government. For those of us who worked the problem down in the trenches, none of this is revelation. It is just another Tuesday.
Then, deep in the interview, the context arrives. Rogers is a Senior Executive Advisor to Nihon Cyber Defence (NCD), a Tokyo cyber security vendor. None of this makes Rogers wrong. It changes what the warning is worth, and the company at the other end of it is selling Japan something stranger than advice.
Open the firm's leadership page and scroll. General Shigeru Iwasaki, once Japan's highest-ranking uniformed officer, is chairman. Rogers is there. Sir Jeremy Fleming, former director of Britain's GCHQ. John Noble, former Director of Incident Management at the United Kingdom's National Cyber Security Centre (NCSC). Admiral Lee Hsi-Min, former chief of Taiwan's general staff. Air Chief Marshal Mark Binskin, former chief of the Australian Defence Force. The company lists roughly fifty employees. The page reads less like the roster of a fifty-person Tokyo firm and more like the seating chart for an allied security summit.
But this very page is the actual product. Nihon Cyber Defence sells services. The public ones are consultancy, penetration testing, monitoring, digital forensics, incident response, and training. The incident response work is real, and the credential it leans on for that work is assurance from the UK's NCSC, the public-facing defensive arm of GCHQ, Britain's equivalent of the NSA. NCSC does many things, one of which is to properly vet incident response providers. A Tokyo firm's marquee quality control stamp is British.
What the firm offers that its competitors cannot is not technology. It is a beautifully crafted masthead. Take Rogers. He ran the NSA and USCYBERCOM, and running them is command, not practice. The director does not tune detections, reverse engineer a malware sample, or work an intrusion at three in the morning. He directs the very people who do the day-to-day work.
That mahogany bench is eye candy. A firm does not put a former NSA director on its leadership page because he will triage an alert queue. It does it because the title fills a room. Japan defers to rank more readily than most markets. Stack enough stars and directorships on a page and a buyer stops asking whether the product under them is any good. The buyer assumes names like these would never lend themselves to a weak product, so the product must be formidable. The assumption does the vendor's work for it.
That is the mechanism of snake oil. The label selling what the contents cannot, and it works here without a single person on the masthead being a fraud. These are accomplished people. They are also not the practitioners. Introduce the firm's best incident responder, the one who actually hunts the intrusion, and the wow is gone, even though that person reads the threat landscape far more closely than any retired flag officer ever did. Rank photographs well. Rank is not the hands on the keyboard.
Nihon Cyber Defence does not just sell services. It also has a product.
Set the technology beside the roster and there is not much to choose. NCD SIEM is the company's monitoring product. A security information and event management (SIEM) aggregates, analyzes, and manages all log data and security events across an entire organization in real time. The goal is to raise detections for activity worth investigating because of its potential to be an intrusion. The SIEM is the center of the universe of any Security Operations Center (SOC). NCD's version advertises licensing by node rather than events per second, event filtering before forwarding, mapping to MITRE ATT&CK, a severity score from one to one hundred, dashboards, and incident response playbooks. Those are ordinary SIEM functions.
They are not a reason to pick Nihon Cyber Defence over Microsoft, CrowdStrike, Palo Alto Networks, or Splunk. CrowdStrike publicly documents third-party telemetry ingestion, custom parsers, federated search, real-time pipelines, and cross-domain correlation across endpoint, identity, cloud, network, and external data. Palo Alto Networks describes Cortex XSIAM pulling those same surfaces together with analytics, threat intelligence, and automation, proven across thousands of environments. Nihon Cyber Defence publishes no connector ecosystem, no detection research, no benchmarks, no independent testing, and no deployment evidence of comparable depth.
On the technology alone, a buyer picks an incumbent. So the question is what Nihon Cyber Defence is actually selling. The answer is not in the product. It is on the label.
In 2025 the company announced MIJXDR, a cutesy industry acronym for Made in Japan Extended Detection and Response. The launch came with a ¥1 billion seed round from Incubate Fund, MPower Partners, and DBJ Capital. DBJ Capital is the venture arm of the Development Bank of Japan, which is wholly owned by the Japanese government.
Nihon Cyber Defence calls MIJXDR a fully sovereign architecture, designed, developed, hosted, and operated in Japan. It describes the platform as the only solution achieving compliance, responsiveness, and sovereignty at once. Sovereignty is not a feature of the sales pitch. It is the pitch. It is in the name.
Strip that one word away and look at what remains. The launch names no cloud provider, no data center operator, and no hosting partner. It says nothing about where customer data is retained, where backups and replicas sit, who can reach the system from abroad, or who holds the encryption keys. It points to no SOC 2 attestation and no ISO 27017 certification for cloud security. MIJXDR does not appear on the ISMAP registry, the list of cloud services the Japanese government has vetted for its own use.
ISMAP exists to certify exactly what MIJXDR claims to be. Amazon Web Services, Microsoft Azure, Google Cloud, Palo Alto Networks, and Splunk have all earned a place on it. The platform marketed as the sovereign choice for Japanese institutions has not.
MIJXDR is also missing from the company's English product site, where the product page returns a 404 not-found error. For a platform aimed at Japanese critical infrastructure under a government-funded banner, the first question a serious buyer asks is where the thing runs and who can touch it. The public record answers neither of those questions.
The fear underneath the notion of sovereignty is legitimate, which is what makes the vagueness worse. A United States company answers to United States law over the data in its control, wherever in the world the servers sit. Putting the servers in a Tokyo data center does not change that, because the obligation attaches to the provider, not the hardware.
The Stored Communications Act, broadened by the CLOUD Act, compels a provider to hand over stored content it controls regardless of where that content is kept. The Foreign Intelligence Surveillance Act, particularly Section 702, compels a provider to assist the United States with foreign-intelligence collection. National Security Letters compel subscriber and transactional records under a gag order, with no judge in the loop. Signals intelligence under Executive Order 12333 runs outside that framework altogether. Japanese data on infrastructure a United States firm operates sits within reach of every one of them.
A genuinely sovereign stack is built to put the provider, and the data, beyond that reach. A sovereign stack asserted without naming a single component of it removes none of it. It is a slogan aimed at a real and specific fear.
The company's own overseas work shows what the word is doing. Nihon Cyber Defence is running a United Nations Industrial Development Organization (UNIDO) feasibility study to localize MIJXDR inside a security operations center in Ukraine. The center would defend the energy grid, schools, and hospitals, alongside Ukraine's state special-communications service. UNIDO describes the underlying approach plainly. It is cloud-first and source-agnostic, built to integrate with existing security tools and adapt as threats evolve.
A portable platform can be built in Japan, hosted on Japanese infrastructure for Japanese customers, and localized onto Ukrainian infrastructure for Ukraine. That is what portable software does. The pairing forces a sharper question than contradiction. What exactly stays sovereign when the deployment moves? The software, the hosting, the operators, the data, the encryption keys, the supply chain, the development organization, or the jurisdiction? Pick one and the answer changes.
If MIJXDR becomes Ukrainian infrastructure the moment it is installed in Ukraine, then sovereignty was never a property of the product. It is produced by deployment and operational control, by where the thing runs and who holds the keys. That is the admission buried in the pitch. Made in Japan and sovereign are being sold as one claim, and they are not. Made in Japan says where the software was written. Sovereign says who controls it in operation. A buyer paying a premium for the second is being quoted the price of the first.
That should unsettle anyone, and it should unsettle Japan the most. The capital behind the platform includes a government-owned investor, and the launch ties the product to Japan's cyber industry promotion strategy and economic security policy. Yet Japan's own government cannot build what MIJXDR claims to be.
Japan's central government cloud, the Digital Agency's Government Cloud program, runs more than eighty percent on Amazon Web Services. That data sits in AWS's Tokyo and Osaka regions, physically inside Japan but under the same United States jurisdiction, because residency moves the servers, not the operator. That gap is the reason Japan went looking for a domestic provider at all, and Sakura Internet became the first one formally selected only in early 2026.
A fifty-person company is selling a fully sovereign architecture into national infrastructure on government-linked money, while the state itself runs its own cloud on American-operated platforms and has barely begun to find a way out. The claim is not merely unproven. It is bolder than anything the government funding it has managed.
Set against all that, the question is what the architecture has actually won. On the public record, no named national contract. No ministry, agency, or critical infrastructure operator has announced MIJXDR in production. The platform draws no subsidy beyond the DBJ round, and it carries no formal government endorsement. What it has won is proximity. Nihon Cyber Defence says it supported Cyber KONGO 2026, a multinational exercise hosted by a Ground Self-Defense Force school. It has announced a strategic cooperation with Shizuoka City to stand up a center of excellence. Its chairman ran the Self-Defense Forces Joint Staff. Its capital comes partly from a government-owned investor. Its services are aimed squarely at the new active cyber defense regime.
That is the conversion worth watching, and it is subtler than a purchased contract. Prestige, policy alignment, government-linked capital, a military exercise, and sovereign branding have combined to give Nihon Cyber Defence institutional standing before it has shown the technical proof standing is supposed to rest on. The markers of merit, a named deployment or a place on the government's own cloud register, are the ones still missing. Legitimacy is running ahead of evidence. In a market the government is deliberately inflating with industrial policy and public capital, that sequence is the risk, because the state can come to treat a vendor as proven on proximity alone and buy the label it funded rather than the capability it needs.
Return to the masthead with all of this in perspective. A firm selling Japanese data sovereignty draws its prestige from retired foreign spy chiefs and flag officers, sat over a Japanese establishment chair, and leans on a British assurance for its core work. Its credibility is imported even where its chairman is not. It then sells a second product that is also a word, and both work for the same reason.
Japan is short of domestic cyber talent, underpays the people it has, and defers to allied credentials. So it is receptive to reassurance it can buy rather than capability it has to build. A former director of the NSA warning that Japan must move faster, and a sovereign platform promising Japan can finally own its defenses, are the same transaction. Each sells the feeling of security in place of the engineering producing it, and Japan is being asked to trade capability for a label. Rogers can believe every word he said, and I suspect he does. The credential and the label sell regardless of sincerity.
Not all of Japan's slowness is the same disease. Some of it is bureaucratic paralysis. Some of it is a democracy doing its job. Japan's move to active cyber defense ran straight into Article 21 of the constitution and its protection of the secrecy of communications. Letting the state inspect private traffic to hunt attackers is a real civil liberties problem, and the answer cannot simply be that cyber moves fast so friction is waste. A month spent deciding whether a ministry may touch private communications is not the same as a month spent deciding who chairs the incident call. One protects legitimacy. The other protects turf. A pitch blurring the two, selling urgency against both, is selling past the problem.
Sovereignty is the word Nihon Cyber Defence should be made to define, because Japan is pointing public money and industrial policy straight at the category it occupies. It is not a Japanese flag on a product page or a Tokyo headquarters, not if the engineering, the detection logic, the keys, and the operators still answer to somewhere else. Real cyber sovereignty is data residency a buyer can name, key control the customer holds, a supply chain someone can trace, and engineers the company employs. Each of those is a fact a vendor can state and a buyer can verify. Nihon Cyber Defence stated none of them and asked for the word to be taken on trust.
Japan has heard Rogers' warning for twenty years, in Japanese, from engineers, incident responders, and practitioners who lived the problem rather than arrived to diagnose it. What they lacked was never awareness. It was money, authority, and the permission to act. That gap is the market, and a sovereign label is the latest thing being sold into it.
Japan will know it has built sovereign cyber capability when the most valuable thing on a Japanese cyber security company's website is what its engineers built and where its data lives, not the flag on the label or the photographs on the leadership page.