Threat intelligence and incident response for critical infrastructure in Japan
Nihon Cyber Defence operates a security operations stack built on Wazuh, Elastic Stack, Splunk, and EDR/XDR—the core SIEM and detection layer for monitoring critical infrastructure. The hiring pattern (3 security, 2 sales over 30 days) reflects a security-first org scaling operational depth, with active projects centered on SOC construction and SIEM/EDR implementation strategy. Pain points around SIEM architecture adaptation and incident response maturity suggest the team is moving beyond basic monitoring into proactive threat hunting and response automation.
Nihon Cyber Defence provides threat intelligence, threat detection, and incident response services to critical infrastructure operators, government entities, and large organizations across Japan and globally. Founded in 2017 and headquartered in Tokyo, the 11–50-person firm operates a mature security operations stack spanning detection (Wazuh, Splunk, EDR/XDR), cloud platforms (AWS, Azure, GCP), and threat analysis tools (MITRE ATT&CK, MISP). Current initiatives include next-generation SOC construction and SIEM/EDR implementation strategy development, indicating an active shift toward automated threat detection and response capabilities.
Nihon Cyber Defence uses Wazuh, Elastic Stack, Splunk, and EDR/XDR for detection and monitoring; AWS, Azure, and GCP for cloud infrastructure; MITRE ATT&CK and MISP for threat intelligence; and Windows, Linux, and VMware for endpoint and infrastructure management.
Active projects include cyber protection and threat analysis teams, next-generation SOC construction, and implementation strategy for SIEM, EDR, and network security monitoring (NSM) platforms.
Other companies in the same industry, closest in size