Who owns Cyber Defense Institute?

Cyber Defense Institute has been a wholly owned subsidiary of NEC Corporation (TSE: 6701) since March 1, 2013, when NEC acquired 100% of the firm from Itochu Corporation to build out its cybersecurity business, per NEC's own 2013-02-28 press release.

Is Cyber Defense Institute profitable?

No independent revenue or profit figures are disclosed. As a wholly owned NEC subsidiary since 2013, CDI's financials are consolidated into NEC's results and not broken out separately, so its standalone profitability cannot be assessed from public data as of July 2026.

Could AI replace Cyber Defense Institute's services?

Routine automated vulnerability scanning is already AI-exposed and undercut by cheaper competitors, but CDI's manual pentesting, ICS/SCADA forensics, and courtroom-facing reporting rely on human judgment and legal accountability, which are harder for AI to replace. CDI has not publicly shipped an AI-security product as of mid-2026.

Who is Cyber Defense Institute's biggest competitor?

GMO Cybersecurity by Ierae is a key rival, citing over 16,000 cumulative diagnostic engagements and, as of June 2026, already offering a commercial LLM Security Diagnostic service, an AI-security product CDI has not publicly matched.

What does Cyber Defense Institute actually do?

CDI provides web/mobile/platform vulnerability assessment, penetration testing including IoT and ICS/SCADA, incident response and digital forensics, malware analysis and threat intelligence, and security training, per its own service pages, positioning it as a boutique high-touch security consultancy rather than a large-scale SOC vendor.

Has Cyber Defense Institute launched any AI products?

No CDI-specific press release or product page describing an AI-powered diagnostic or forensics offering was found as of July 2026, an evidence gap contrasted against rival GMO Cybersecurity by Ierae's commercial LLM Security Diagnostic service launched by June 2026.

Cybersecurity companies · subsidiary of NEC Corporation (TSE: 6701) · Japan

Cyber Defense Institute

NEC-owned Japanese firm doing courtroom-grade incident response, forensics, and security diagnostics.

Defensible for now

Assessed 26 July 2026 · Evidence as of 26 July 2026

Real protection, with named pressure against it.

On the recordSince 26 July 2026 · Checkable from Nov 17-18, 2026 · Every call on the record Checkpoint: CODE BLUE 2026 conference, a likely window for CDI to announce any AI-security offering

The call

CDI's courtroom-grade forensics work looks safe for now, but it has not shown an AI-security product while a direct rival already sells one.

Cyber Defense Institute does forensics, penetration testing, and incident response for regulated Japanese companies and government. It is hard to replace because it holds special certifications (METI and JASA approval) and can testify in court, plus Japan's new Active Cyber Defense Act is sending clients its way. However, GMO Cybersecurity by Ierae and other rivals can now use AI to write vulnerability reports faster and cheaper, which squeezes CDI's profit margins on routine work, even though CDI's forensics and industrial control system expertise still requires human judgment. The deciding factor is whether CDI releases its own AI-powered diagnostic tool by late 2026; if it does not, cheaper competitors will keep chipping away at its regular business.

Why

AI pressure: GMO Cybersecurity by Ierae's LLM Security Diagnostic service. A rival already sells AI-app pentesting; CDI has no public equivalent, risking the commodity end of its diagnostic work. Could AI do the core job? Only partly.

Bigger players: GMO Cybersecurity by Ierae, LAC, Macnica. Bigger, more diversified rivals sell overlapping pentest and IR services at greater scale, squeezing CDI's commodity tier. Could a giant copy it? Yes, easily.

What protects it. METI/JASA certification plus elite forensic talent that courts and regulators trust for hard incident cases.

What would change this call

CDI launches an AI-augmented diagnostic or forensics offering by CODE BLUE 2026 (Nov 17-18). Shows CDI can match rivals' AI-assisted tooling instead of losing ground on price or speed.
GMO Cybersecurity by Ierae expands its LLM-Security Diagnostic product to enterprise or ICS clients. Shows a rival converting AI-assisted tooling into wins on CDI's premium account tier.
Named CDI senior staff (CODE BLUE speakers, elite reversers) depart to LAC, GMO, or elsewhere. Shows erosion of the talent base that is CDI's main moat, not just technology.

Key numbers

Japan ransomware incidents rose 17.5% YoY to 134 in 2025 (2025)
GMO Ierae cites 16,000+ cumulative diagnostic engagements (n.d.)
NEC has owned CDI 100% since March 2013 (2013-02-28)

Named risks

Commodity vulnerability scanning and report-writing increasingly automated, eroding CDI's pricing floor. Severity: medium
Peer GMO Ierae already shipped AI-security diagnostic product while CDI has none public as of mid-2026. Severity: medium
No independent financials disclosed; CDI's performance fully obscured within NEC's consolidated results. Severity: low
Conflicting headcount data (38 vs 65 employees) signals limited public transparency on firm scale. Severity: low
NEC could absorb or de-brand CDI as a subsidiary with no independent cap table or equity upside. Severity: medium

Rivals, as read in July 2026

Rival	Direction	Evidence
GMO Cybersecurity by Ierae	losing to	Shipped commercial LLM Security Diagnostic AI product by 2026-06-22 while CDI has no public equivalent
LAC Co., Ltd.	contesting	Operates JSOC monitoring center and Cyber Emergency Center, overlapping directly with CDI's IR service line
Macnica Holdings	contesting	TSE Prime listed, ~549.75B yen market cap as of 2026-05, far larger diversified cybersecurity consulting scale
SOMPO Cyber Security	losing to	Offers lower-cost flat-fee web app diagnostic plans undercutting CDI's premium manual-testing pricing
Sun*	losing to	Commoditized/SME-focused pentest and diagnostic pricing competes on cost against CDI's boutique model

Questions people ask

Who owns Cyber Defense Institute?: Cyber Defense Institute has been a wholly owned subsidiary of NEC Corporation (TSE: 6701) since March 1, 2013, when NEC acquired 100% of the firm from Itochu Corporation to build out its cybersecurity business, per NEC's own 2013-02-28 press release.
Is Cyber Defense Institute profitable?: No independent revenue or profit figures are disclosed. As a wholly owned NEC subsidiary since 2013, CDI's financials are consolidated into NEC's results and not broken out separately, so its standalone profitability cannot be assessed from public data as of July 2026.
Could AI replace Cyber Defense Institute's services?: Routine automated vulnerability scanning is already AI-exposed and undercut by cheaper competitors, but CDI's manual pentesting, ICS/SCADA forensics, and courtroom-facing reporting rely on human judgment and legal accountability, which are harder for AI to replace. CDI has not publicly shipped an AI-security product as of mid-2026.
Who is Cyber Defense Institute's biggest competitor?: GMO Cybersecurity by Ierae is a key rival, citing over 16,000 cumulative diagnostic engagements and, as of June 2026, already offering a commercial LLM Security Diagnostic service, an AI-security product CDI has not publicly matched.
What does Cyber Defense Institute actually do?: CDI provides web/mobile/platform vulnerability assessment, penetration testing including IoT and ICS/SCADA, incident response and digital forensics, malware analysis and threat intelligence, and security training, per its own service pages, positioning it as a boutique high-touch security consultancy rather than a large-scale SOC vendor.
Has Cyber Defense Institute launched any AI products?: No CDI-specific press release or product page describing an AI-powered diagnostic or forensics offering was found as of July 2026, an evidence gap contrasted against rival GMO Cybersecurity by Ierae's commercial LLM Security Diagnostic service launched by June 2026.

Timeline

2026-06-22GMO Cybersecurity by Ierae's commercial LLM Security Diagnostic service documented as active offering
2026-06-18CODE BLUE 2026 opens training registration with AI-era threat-response tracks
2025-11-11Japan supply-chain security rating scheme (star3 to star5 tiers) reported, slated for autumn 2026 start
2025-05Japan enacts Active Cyber Defense law (Cyber Response Capability Enhancement Act)
2024-04-23CDI launches PIV Gateway CA, described as world's first commercial CA for Platform Certificate issuance
2013-03-01NEC completes 100% acquisition of Cyber Defense Institute from Itochu Corporation
2008-10Current CDI legal entity incorporated with capital of 100 million yen
2001-01Company founded as iDEFENSE Japan, Japan's first dedicated security-intelligence distribution service

Revision history

26 July 2026

First assessed. Defensible for now. The text above is fixed as of this date and is not edited afterwards.

In the same band

SK Shieldus Tencent Security Systex Corporation